{"action":"created","issue":{"url":"https://api.github.com/repos/iovisor/bcc/issues/429","repository_url":"https://api.github.com/repos/iovisor/bcc","labels_url":"https://api.github.com/repos/iovisor/bcc/issues/429/labels{/name}","comments_url":"https://api.github.com/repos/iovisor/bcc/issues/429/comments","events_url":"https://api.github.com/repos/iovisor/bcc/issues/429/events","html_url":"https://github.com/iovisor/bcc/pull/429","id":138583603,"number":429,"title":"add tcpv4listen.py tracing example, with comments","user":{"login":"yadutaf","id":739985,"avatar_url":"https://avatars.githubusercontent.com/u/739985?v=3","gravatar_id":"","url":"https://api.github.com/users/yadutaf","html_url":"https://github.com/yadutaf","followers_url":"https://api.github.com/users/yadutaf/followers","following_url":"https://api.github.com/users/yadutaf/following{/other_user}","gists_url":"https://api.github.com/users/yadutaf/gists{/gist_id}","starred_url":"https://api.github.com/users/yadutaf/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/yadutaf/subscriptions","organizations_url":"https://api.github.com/users/yadutaf/orgs","repos_url":"https://api.github.com/users/yadutaf/repos","events_url":"https://api.github.com/users/yadutaf/events{/privacy}","received_events_url":"https://api.github.com/users/yadutaf/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":1,"created_at":"2016-03-04T20:52:07Z","updated_at":"2016-03-05T00:03:30Z","closed_at":null,"pull_request":{"url":"https://api.github.com/repos/iovisor/bcc/pulls/429","html_url":"https://github.com/iovisor/bcc/pull/429","diff_url":"https://github.com/iovisor/bcc/pull/429.diff","patch_url":"https://github.com/iovisor/bcc/pull/429.patch"},"body":"This is yet-another-example(tm). It was originally written as a toy to experiment with bcc. The goal was to see how easily I could move from a per-namespace poller to a kernel event streaming for new TCP listener, in any namespace / container.\r\n\r\nIt includes a cleaned version of the notes I took while testing. I believe this could be valuable to new comers (like me) and avoid some pitfalls. Hence the example section.\r\n\r\nReal world use case includes\r\n- dynamic load balancer re-configuration when the application is *ready*.\r\n- monitor all listens, even short lived sockets."},"comment":{"url":"https://api.github.com/repos/iovisor/bcc/issues/comments/192531238","html_url":"https://github.com/iovisor/bcc/pull/429#issuecomment-192531238","issue_url":"https://api.github.com/repos/iovisor/bcc/issues/429","id":192531238,"user":{"login":"brendangregg","id":1101211,"avatar_url":"https://avatars.githubusercontent.com/u/1101211?v=3","gravatar_id":"","url":"https://api.github.com/users/brendangregg","html_url":"https://github.com/brendangregg","followers_url":"https://api.github.com/users/brendangregg/followers","following_url":"https://api.github.com/users/brendangregg/following{/other_user}","gists_url":"https://api.github.com/users/brendangregg/gists{/gist_id}","starred_url":"https://api.github.com/users/brendangregg/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/brendangregg/subscriptions","organizations_url":"https://api.github.com/users/brendangregg/orgs","repos_url":"https://api.github.com/users/brendangregg/repos","events_url":"https://api.github.com/users/brendangregg/events{/privacy}","received_events_url":"https://api.github.com/users/brendangregg/received_events","type":"User","site_admin":false},"created_at":"2016-03-05T00:03:30Z","updated_at":"2016-03-05T00:03:30Z","body":"I like most of this. I don't like pulling event data from /proc/<pid>/ns/net. I did that in my perf-tools only because of limitations with ftrace; in bcc we can walk data structures and fetch things directly. A big problem with my perf-tools tcpretrans that reads from /proc/net/tcp is that it can lag behind the kernel event. I've had many emails about tcpretrans printing zero values, because the /proc/net/tcp session information was missing by the time it was read. Which doesn't make a lot of sense -- the session has gone missing in-between the retransmit being sent (when these sessions are usually in ESTABLISHED) and then user-space trying to read /proc/net/tcp. You'd think I'd get a TIME_WAIT grace, but no...\r\n\r\nSo I'm not sure we should have another /proc reading hack as an /example for others to follow. There may be a time where we use the /proc stuff in a /tool because there's no other sensible way to do it.\r\n\r\nIncidentally, the namespace might be available from socket->sk->sk_socket->file->f_cred->user_ns (which may be a pain to fully fetch).\r\n\r\nWe also really should do #380 so that we can more easily make these into tools."}}