Received-SPF: pass (google.com: domain of linux-nfs-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
Message-ID: <0466021aedfd6fc67d0ddc47487b3b9f13082bcb.camel@gmail.com>
Subject: Re: Best kernel function to probe for NFS write accounting?
From:   Trond Myklebust <trondmy@gmail.com>
To:     lars@pixar.com, linux-nfs@vger.kernel.org
Date:   Sat, 22 Jul 2023 13:51:28 -0400
In-Reply-To: <20230721224530.I6e45%lars@pixar.com>
References: <20230721224530.I6e45%lars@pixar.com>
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
User-Agent: Evolution 3.48.4 (3.48.4-1.fc38) 
MIME-Version: 1.0
Precedence: bulk

Hi Lars,

On Fri, 2023-07-21 at 15:45 -0700, lars@pixar.com wrote:
> Hello,
>=20
> I'm using BPF to do NFS operation accounting for user-space
> processes. I'd like
> to include the number of bytes read and written to each file any
> processes open
> over NFS.
>=20
> For write operations, I'm currently using an fexit probe on the
> nfs_writeback_done function, and my program appears to be getting the
> information I'm hoping for. But I can see that under some
> circumstances the
> actual operations are being done by kworker threads, and so the PID
> reported by
> the BPF program is for that kworker instead of the user-space process
> that
> requested the write.
>=20
> Is there a more appropriate function to probe for this information if
> I only
> want it triggered in context of the user-space process that performed
> the
> write? If not, I'm wondering if there's enough information in a probe
> triggered
> in the kworker context to track down the user-space PID that
> initiated the
> writes.
>=20
> I didn't find anything related in the kernel's Documentation
> directory, and I'm
> not yet proficient enough with the vfs, nfs, and sunrpc code to find
> an
> appropriate function myself.
>=20
> If it matters, our infrastructure is all based on NFSv3.
>=20
> Thanks for any leads or documentation pointers!
> Lars

I tend to use the nfs:nfs_writeback_done and nfs:nfs_commit_done
tracepoints.

We make no attempt to track the PID that initiated the writes, because
it is often impossible to do so, for instance, if the file was mmapped,
or multiple processes owned by the same user are writing to the same
page.
If you want to track I/O at that level, I suggest rather tracing the
sys_write()/sys_writev()/... system calls since those will be called
from the user context.

Cheers
  Trond

--=20
Trond Myklebust
Linux NFS client maintainer, Hammerspace
trond.myklebust@hammerspace.com