tools/syscount: add --ppid option

we may need to run some one time command and trace its syscount,
it's not easy to get the pid. but we can trace the ppid, usually the pid of current shell.

eg:
1. get pid of current shell(shell 1)
grep -i ppid /proc/self/status | cut -f2
2. run syscount in other shell(shell 2)
syscount --ppid $pid_of_step_1
3. run the target command in shell 1
curl https://github.com/

we can trace the one time curl command with the --ppid option

Author: curu

man/man8/syscount.8

@@ -2,7 +2,7 @@
 .SH NAME
 syscount \- Summarize syscall counts and latencies.
 .SH SYNOPSIS
-.B syscount [-h] [-p PID] [-t TID] [-i INTERVAL] [-d DURATION] [-T TOP] [-x] [-e ERRNO] [-L] [-m] [-P] [-l] [--syscall SYSCALL]
+.B syscount [-h] [-p PID] [-t TID] [-c PPID] [-i INTERVAL] [-d DURATION] [-T TOP] [-x] [-e ERRNO] [-L] [-m] [-P] [-l] [--syscall SYSCALL]
 .SH DESCRIPTION
 This tool traces syscall entry and exit tracepoints and summarizes either the
 number of syscalls of each type, or the number of syscalls per process. It can
@@ -23,6 +23,9 @@ Trace only this process.
 \-t TID
 Trace only this thread.
 .TP
+\-c PPID
+Trace only child of this pid.
+.TP
 \-i INTERVAL
 Print the summary at the specified interval (in seconds).
 .TP

tools/syscount.py

@@ -49,6 +49,8 @@ def handle_errno(errstr):
     help="trace only this pid")
 parser.add_argument("-t", "--tid", type=int,
     help="trace only this tid")
+parser.add_argument("-c", "--ppid", type=int,
+    help="trace only child of this pid")
 parser.add_argument("-i", "--interval", type=int,
     help="print summary at this interval (seconds)")
 parser.add_argument("-d", "--duration", type=int,
@@ -94,6 +96,8 @@ def handle_errno(errstr):
     sys.exit(0)
 
 text = """
+#include <linux/sched.h>
+
 #ifdef LATENCY
 struct data_t {
     u64 count;
@@ -127,6 +131,13 @@ def handle_errno(errstr):
         return 0;
 #endif
 
+#ifdef FILTER_PPID
+    struct task_struct *task = (struct task_struct *)bpf_get_current_task();
+    u32 ppid = task->real_parent->tgid;
+    if (ppid != FILTER_PPID)
+        return 0;
+#endif
+
     u64 t = bpf_ktime_get_ns();
     start.update(&pid_tgid, &t);
     return 0;
@@ -153,6 +164,13 @@ def handle_errno(errstr):
         return 0;
 #endif
 
+#ifdef FILTER_PPID
+    struct task_struct *task = (struct task_struct *)bpf_get_current_task();
+    u32 ppid = task->real_parent->tgid;
+    if (ppid != FILTER_PPID)
+        return 0;
+#endif
+
 #ifdef FILTER_FAILED
     if (args->ret >= 0)
         return 0;
@@ -195,6 +213,8 @@ def handle_errno(errstr):
     text = ("#define FILTER_PID %d\n" % args.pid) + text
 elif args.tid:
     text = ("#define FILTER_TID %d\n" % args.tid) + text
+elif args.ppid:
+    text = ("#define FILTER_PPID %d\n" % args.ppid) + text
 if args.failures:
     text = "#define FILTER_FAILED\n" + text
 if args.errno:

tools/syscount_example.txt

@@ -165,6 +165,7 @@ optional arguments:
   -h, --help            show this help message and exit
   -p PID, --pid PID     trace only this pid
   -t TID, --tid TID     trace only this tid
+  -c PPID, --ppid PPID  trace only child of this pid
   -i INTERVAL, --interval INTERVAL
                         print summary at this interval (seconds)
   -d DURATION, --duration DURATION