flextrace

flextrace is an ebpf-powered application profiling toolkit for linux

(minimum kernel version is something pretty modern cause this uses aya mainline until next version is actually released and it has weird verifier issues on older kernels)

todo:

✅ ability to do basic perf event data gathering based on various hardware and software events, including info about what process triggered it, mostly helpful for big picture info

✅ have a decent command line (will expand it for future features of course)

✅ ability to unwind stack traces using frame pointers (easy)

✅️ clean up the codebase so it can be used as a library

• ability to unwind stack traces using .eh_frame (pain)

• have nice data analytics features

• decent tui frontend

nothing is production yet lol but hopefully it will be some time

Prerequisites

1. stable rust toolchains: rustup toolchain install stable
2. nightly rust toolchains: rustup toolchain install nightly --component rust-src
3. (if cross-compiling) rustup target: rustup target add ${ARCH}-unknown-linux-musl
4. (if cross-compiling) LLVM: (e.g.) brew install llvm (on macOS)
5. (if cross-compiling) C toolchain: (e.g.) brew install filosottile/musl-cross/musl-cross (on macOS)
6. bpf-linker: cargo install bpf-linker (--no-default-features on macOS)

Build & Run

Use cargo build, cargo check, etc. as normal. Run your program with:

cargo run --release --config 'target."cfg(all())".runner="sudo -E"'

Cargo build scripts are used to automatically build the eBPF correctly and include it in the program.

Cross-compiling on macOS

Cross compilation should work on both Intel and Apple Silicon Macs.

CC=${ARCH}-linux-musl-gcc cargo build --package flextrace --release \
  --target=${ARCH}-unknown-linux-musl \
  --config=target.${ARCH}-unknown-linux-musl.linker=\"${ARCH}-linux-musl-gcc\"

The cross-compiled program target/${ARCH}-unknown-linux-musl/release/flextrace can be copied to a Linux server or VM and run there.