Struct bcc::BPF

pub struct BPF { /* fields omitted */ }

The BPF struct contains the compiled BPF code, any probes or programs that have been attached, and can provide access to a userspace view of the results of the running BPF programs.

Implementations

impl BPF

pub fn new(code: &str) -> Result<BPF, BccError>

code is a string containing C code. See https://github.com/iovisor/bcc for examples

pub fn table(&self, name: &str) -> Table

Get access to a named table within the running BPF program.

pub fn load_net(&mut self, name: &str) -> Result<File, BccError>

Load a network traffic-control action which has the provided name within the BPF program

pub fn load(
    &mut self,
    name: &str,
    prog_type: u32,
    log_level: i32,
    log_size: u32
) -> Result<File, BccError>

load the named BPF program from within the compiled BPF code

pub fn get_syscall_prefix(&mut self) -> String

Returns the syscall prefix for the running kernel

pub fn get_syscall_fnname(&mut self, name: &str) -> String

Converts a syscall function name to a fully-qualified function name

pub fn get_kprobe_functions(
    &mut self,
    event_re: &str
) -> Result<Vec<String>, BccError>

Returns a list of kernel functions matching a provided regular expression

pub fn ksymname(&mut self, name: &str) -> Result<u64, BccError>

Resulves the name to a kernel symbol

pub fn support_raw_tracepoint(&mut self) -> bool

Returns true if raw tracepoints are supported by the running kernel

pub fn init_perf_map<F>(&mut self, table: Table, cb: F) -> Result<(), BccError> where
    F: Fn() -> Box<dyn FnMut(&[u8]) + Send>, 

pub fn perf_map_poll(&mut self, timeout: i32)

Trait Implementations

impl Debug for BPF

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Drop for BPF

fn drop(&mut self)

Executes the destructor for this type.