0

When I try to execute sudo opensnoop-bpfcc I get this message: 

In file included from /virtual/main.c:4:
In file included from include/linux/sched.h:14:
In file included from include/linux/pid.h:5:
In file included from include/linux/rculist.h:11:
In file included from include/linux/rcupdate.h:40:
In file included from include/linux/preempt.h:81:
In file included from ./arch/x86/include/asm/preempt.h:7:
In file included from include/linux/thread_info.h:38:
In file included from ./arch/x86/include/asm/thread_info.h:53:
./arch/x86/include/asm/cpufeature.h:150:2: warning: "Compiler lacks ASM_GOTO support. Add -D __BPF_TRACING__ to your compiler arguments"
      [-W#warnings]
#warning "Compiler lacks ASM_GOTO support. Add -D __BPF_TRACING__ to your compiler arguments"
 ^
1 warning generated.
Traceback (most recent call last):
  File "/usr/sbin/opensnoop-bpfcc", line 127, in <module>
    b.attach_kprobe(event="sys_open", fn_name="trace_entry")
  File "/usr/lib/python2.7/dist-packages/bcc/__init__.py", line 526, in attach_kprobe
    raise Exception("Failed to attach BPF to kprobe")
Exception: Failed to attach BPF to kprobe

I don't understand how to fix it. I've just installed bcc tools using this command 

sudo apt-get install bpfcc-tools linux-headers-$(uname -r)

as suggested on the github page https://github.com/iovisor/bcc/blob/master/INSTALL.md#ubuntu---binary

The running OS is 18.04.2 LTS (Bionic Beaver).

pchaigno
  • 11,313
  • 2
  • 29
  • 54
Maicake
  • 1,046
  • 10
  • 34
  • 1
    I believe [this bcc issue](https://github.com/iovisor/bcc/issues/2119) is related (and proposes a workaround). – Qeole Jul 22 '19 at 16:48
  • They 're taking about 5.0 kernel version do you think it's the same for 4.18? – Maicake Jul 22 '19 at 17:03
  • 1
    Yes. Yonghong gives additional details [in this commit log for kernel samples](https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=6bf3bbe1f4d4cf405e3c2bf07bbdff56d3223ec8), the issue has been around since 4.17. – Qeole Jul 22 '19 at 17:38
  • Thanks again, so I have to build it from the source code because the package maybe is not updated. – Maicake Jul 22 '19 at 17:43
  • You can try to build locally, I don't remember facing this issue last time I build on Ubuntu 18.04, so maybe it's been fixed somehow. Otherwise, try adding the `#define asm_volatile_goto(x...)` line [at the beginning of the BPF code](https://github.com/iovisor/bcc/blob/6c793317dac5866db2899e62504d047a02c089b7/tools/opensnoop.py#L81)... I'm afraid I don't have anything easier to suggest at the moment :/. – Qeole Jul 22 '19 at 17:53
  • After built it locally. modprobe: FATAL: Module kheaders not found in directory /lib/modules/4.18.0-15-generic Unable to find kernel headers. Try rebuilding kernel with CONFIG_IKHEADERS=m (module) chdir(/lib/modules/4.18.0-15-generic/build): No such file or directory Traceback (most recent call last): File "./tcpconnect", line 223, in b = BPF(text=bpf_text) File "/usr/lib/python2.7/dist-packages/bcc/__init__.py", line 347, in __init__ raise Exception("Failed to compile BPF module %s" % (src_file or "")) Exception: Failed to compile BPF module – Maicake Jul 22 '19 at 18:10
  • 1
    Do you have kernel modules installed on your system? This sounds like you don't. (`sudo apt install linux-headers-$(uname -r)`) – Qeole Jul 22 '19 at 18:41
  • I started again from installing the OS . Thanks again. You are great. 1) sudo apt install linux-headers-$(uname -r) 2)sudo apt-get -y install bison build-essential cmake flex git libedit-dev \ libllvm6.0 llvm-6.0-dev libclang-6.0-dev python zlib1g-dev libelf-dev 3) git clone https://github.com/iovisor/bcc.git mkdir bcc/build; cd bcc/build cmake .. -DCMAKE_INSTALL_PREFIX=/usr make sudo make install This sequence worked :) – Maicake Jul 23 '19 at 11:21
  • You're welcome, glad you got it working! :) – Qeole Jul 23 '19 at 11:59

2 Answers2

5

I had to compile bcc from source code instead of installing it using the package.

  1. Install linux kernel headers

sudo apt install linux-headers-$(uname -r)

  1. Install required dependencies

sudo apt-get -y install bison build-essential cmake flex git libedit-dev \ libllvm6.0 llvm-6.0-dev libclang-6.0-dev python zlib1g-dev libelf-dev

  1. Compile bcc from source code
git clone https://github.com/iovisor/bcc.git
mkdir bcc/build; cd bcc/build
cmake .. -DCMAKE_INSTALL_PREFIX=/usr
make
sudo make install
Adham Zahran
  • 1,973
  • 2
  • 18
  • 35
Maicake
  • 1,046
  • 10
  • 34
0

@Maicake is right. Compiling and installing from source did work for me. Here are the steps to install on Ubuntu 22.04:

  1. Follow the steps described here. Specifically for Ubuntu 22.04 you may need to make some changes after cloning the bcc repository.

  2. Add the following line to your .bashrc file:

    export PATH=$PATH:/usr/share/bcc/tools

  3. Create a symlink to python3 as most of the tools use python (not python3) to run the scripts.

    sudo ln -s /usr/bin/python3 /usr/bin/python

therealak12
  • 1,178
  • 2
  • 12
  • 26