By reusing the "connect" BPF collector.
Testing it system wide and stopping/starting sshd:
# perf trace -e bind
LLVM: dumping /home/acme/git/perf/tools/perf/examples/bpf/augmented_raw_syscalls.o
DNS Res~er #18/15132 bind(243, { .family: PF_NETLINK }, 12) = 0
DNS Res~er #19/4833 bind(247, { .family: PF_NETLINK }, 12) = 0
DNS Res~er #19/4833 bind(238, { .family: PF_NETLINK }, 12) = 0
DNS Res~er #18/15132 bind(243, { .family: PF_NETLINK }, 12) = 0
DNS Res~er #18/10327 bind(258, { .family: PF_NETLINK }, 12) = 0
:6507/6507 bind(24, { .family: PF_NETLINK }, 12) = 0
DNS Res~er #19/4833 bind(238, { .family: PF_NETLINK }, 12) = 0
DNS Res~er #18/15132 bind(242, { .family: PF_NETLINK }, 12) = 0
sshd/6514 bind(3, { .family: PF_NETLINK }, 12) = 0
sshd/6514 bind(5, { .family: PF_INET, port: 22, addr: 0.0.0.0 }, 16) = 0
sshd/6514 bind(7, { .family: PF_INET6, port: 22, addr: :: }, 28) = 0
DNS Res~er #18/10327 bind(229, { .family: PF_NETLINK }, 12) = 0
DNS Res~er #18/15132 bind(231, { .family: PF_NETLINK }, 12) = 0
DNS Res~er #19/4833 bind(229, { .family: PF_NETLINK }, 12) = 0
^C#
Cc: Adrian Hunter <adrian.hunter@intel.com>
Cc: Jiri Olsa <jolsa@kernel.org>
Cc: Luis Cláudio Gonçalves <lclaudio@redhat.com>
Cc: Namhyung Kim <namhyung@kernel.org>
Link: https://lkml.kernel.org/n/tip-m2hmxqrckxxw2ciki0tu889u@git.kernel.org
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
.arg = { [0] = { .scnprintf = SCA_X86_ARCH_PRCTL_CODE, /* code */ },
[1] = { .scnprintf = SCA_PTR, /* arg2 */ }, }, },
{ .name = "bind",
+ .bpf_prog_name = { .sys_enter = "!syscalls:sys_enter_connect", },
.arg = { [0] = { .scnprintf = SCA_INT, /* fd */ },
- [1] = { .scnprintf = SCA_SOCKADDR, /* umyaddr */ }, }, },
+ [1] = { .scnprintf = SCA_SOCKADDR, /* umyaddr */ },
+ [2] = { .scnprintf = SCA_INT, /* addrlen */ }, }, },
{ .name = "bpf",
.arg = { [0] = STRARRAY(cmd, bpf_cmd), }, },
{ .name = "brk", .hexret = true,