从funccount的字面意思可以看出，其作用在于统计函数被调用的次数。
废话少说，先看help信息
usage: funccount [-h] [-p PID] [-i INTERVAL] [-d DURATION] [-T] [-r] [-D] pattern Count functions, tracepoints, and USDT probes positional arguments: pattern search expression for events optional arguments: -h, --help show this help message and exit -p PID, --pid PID trace this PID only #仅仅跟踪某个进程调用情况 -i INTERVAL, --interval INTERVAL #每间隔多长时间打印一次跟踪结果 summary interval, seconds -d DURATION, --duration DURATION #跟踪持续多长时间，单位为ms total duration of trace, seconds -T, --timestamp include timestamp on output #显示时间戳 -r, --regexp use regular expressions. Default is "*" wildcards #对于跟踪某一类的函数，匹配规则可以采用*符号 only. -D, --debug print BPF program before starting (for debugging # 显示跟踪调试信息 purposes)
./funccount 'vfs_*'
用于显示vfs_*类函数调用次数
Tracing... Ctrl-C to end. ^C FUNC COUNT vfs_create 1 vfs_rename 1 vfs_fsync_range 2 vfs_lock_file 30 vfs_fstatat 152 vfs_fstat 154 vfs_write 166 vfs_getattr_nosec 262
./funccount 'tcp_*'
用于显示tcp类函数调用次数
Tracing... Ctrl-C to end. ^C FUNC COUNT tcp_try_undo_recovery 1 tcp_twsk_destructor 1 tcp_enter_recovery 1 tcp_xmit_retransmit_queue 1 tcp_update_scoreboard 1 tcp_verify_retransmit_hint 1
./funccount -p 1442 /home/ubuntu/contentions:*
用于跟踪进程1442调用contentions中所有函数的次数
Tracing 15 functions for "/home/ubuntu/contentions:*"... Hit Ctrl-C to end. ^C FUNC COUNT main 1 _start 1 primes_thread 2 insert_result 87186 is_prime 1252772
./funccount -r 'c:(write|read)$'
跟踪用户态动态库write和read的调用情况
用户态函数如果要匹配某类规则的话，需要采用添加字母‘c’, c个人认为表示的是libc。
Tracing 2 functions for "c:(write|read)$"... Hit Ctrl-C to end. ^C FUNC COUNT read 2 write 4
./funccount t:block:*
用于跟踪内核态，block类函数的调用次数，t表示tracepoint
Tracing 19 functions for "t:block:*"... Hit Ctrl-C to end. ^C FUNC COUNT block:block_rq_complete 7 block:block_rq_issue 7 block:block_getrq 7 block:block_rq_insert 7
./funccount u:pthread:*mutex* -p 1442
用于跟踪线程1442中线程调用mutex类相关函数的使用次数
Tracing 7 functions for "u:pthread:*mutex*"... Hit Ctrl-C to end. ^C FUNC COUNT mutex_init 1 mutex_entry 547122 mutex_acquired 547175 mutex_release 547185
其中u表示用户态。
./funccount -i 1 'vfs_*'
每隔一秒跟踪一次vfs_*类函数
FUNC COUNT vfs_fstatat 1 vfs_fstat 16 vfs_getattr_nosec 17 vfs_getattr 17 vfs_write 52 vfs_read 79 vfs_open 98 FUNC COUNT vfs_fstatat 10
./funccount -i 1 -d 5 vfs_read
每隔1s打印一次跟踪结果，持续5s,5s表示的一共打印5次
Tracing 1 functions for "vfs_read"... Hit Ctrl-C to end. FUNC COUNT vfs_read 30 FUNC COUNT vfs_read 26 FUNC COUNT vfs_read 54 FUNC COUNT vfs_read 25 FUNC COUNT vfs_read 31
但是如果去掉‘-i 1’的话，那就是跟踪时间总共只持续5s
user-mode statically defined traces (USDT)