Firing

The top for what's really going on.

Caveats

• firing is in alpha stage, expect usage changes.
• By the nature of sampling, firing may leave transient or out-of-sample processes out.
• For now, firing only resolves process comm during summarization. Exited processes may show without names.
• In uncommon cases, PID may be reused so comm is wrong.
• Linux only.

Introduction

firing is a eBPF based non-interactive process viewer with low overhead.

Output

firing outputs PID, observed sample count, estimated CPU usage, and command name, ordered by sample count.

firing reports CPU activity using ~CPU% column. The ~ means the number is estimated from scheduler samples. Like top, 100% CPU usage means a full logical core.

How it works

firing does not walk through the process table (/proc/<pid> on Linux). Instead, it sets up periodic timers on each CPU core by perf_event_open. When any of these timers fires, kernel will run a small eBPF program provided by firing to record the current process.

After collection time, firing stops, summarizes occurrence of processes, then output the result to terminal.

Thus, firing does not provide insights of inactive processes. A process did not run over the period will not show up in the list. And by the nature of sampling, some running processes may be left out.

Usage

Need to be root or with sufficient perf and bpf capability.

Default capture at 9Hz for 15s:

sudo firing

Build

Requires clang and libbpf. Put a copy of vmlinux.h into src/bpf, since vmlinux.h is not provided.

bpftool btf dump file /sys/kernel/btf/vmlinux format c can be used to create a copy of vmlinux.h for your kernel.