---
name: "biosnoop-bpfcc"
section: "8"
platform: "linux"
package: "bpfcc-tools"
version: "0.31.0+ds-7"
release: "Debian 13 (Trixie)"
platforms: ["linux"]
url: "https://new.carta.tech/biosnoop-bpfcc"
---

# biosnoop-bpfcc(8)

Trace block device I/O and print details incl. issuing PID.

## NAME

biosnoop - Trace block device I/O and print details incl. issuing PID.

## SYNOPSIS

**biosnoop \[-h\] \[-Q\] \[-d DISK\] \[-P\]**

## DESCRIPTION

This tools traces block device I/O (disk I/O), and prints a one-line summary for each I/O showing various details. These include the latency from the time of issue to the device to its completion, and the PID and process name from when the I/O was first created (which usually identifies the responsible process).

This uses in-kernel eBPF maps to cache process details (PID and comm) by I/O request, as well as a starting timestamp for calculating I/O latency.

This works by tracing various kernel blk\_\*() functions using dynamic tracing, and will need updating to match any changes to these functions.

This makes use of a Linux 4.4 feature (bpf\_perf\_event\_output()); for kernels older than 4.4, see the version under tools/old, which uses an older mechanism

Since this uses BPF, only the root user can use this tool.

## REQUIREMENTS

CONFIG\_BPF and bcc.

## OPTIONS

- \-h

  Print usage message.

- \-Q

  Include a column showing the time spent queued in the OS.

- \-d DISK

  Trace this disk only.

- \-P

  Display block I/O pattern (sequential or random).

## EXAMPLES

- Trace all block device I/O and print a summary line per I/O:

  \# **biosnoop**

## FIELDS

- TIME(s)

  Time of the I/O completion, in seconds since the first I/O was seen.

- COMM

  Cached process name, if present. This usually (but isn't guaranteed) to identify the responsible process for the I/O.

- PID

  Cached process ID, if present. This usually (but isn't guaranteed) to identify the responsible process for the I/O.

- DISK

  Disk device name.

- T

  Type of I/O: R = read, W = write. This is a simplification.

- SECTOR

  Device sector for the I/O.

- BYTES

  Size of the I/O, in bytes.

- QUE(ms)

  Time the I/O was queued in the OS before being issued to the device, in milliseconds.

- LAT(ms)

  Time for the I/O (latency) from the issue to the device, to its completion, in milliseconds.

## OVERHEAD

Since block device I/O usually has a relatively low frequency (\< 10,000/s), the overhead for this tool is expected to be negligible. For high IOPS storage systems, test and quantify before use.

## SOURCE

This is from bcc.

-

  https://github.com/iovisor/bcc

Also look in the bcc distribution for a companion \_examples.txt file containing example usage, output, and commentary for this tool.

## OS

Linux

## STABILITY

Unstable - in development.

## AUTHOR

Brendan Gregg, Rocky Xing

## SEE ALSO

disksnoop(8), [iostat(1)](/iostat/1.md)