bpfebpfbcc

Using bcc python to detach probe

I am searching for a counterpart function with attach_kprobe(), which can detach the probe we insert previously.

If it doesn't exist, are there any possible to detach inserted probe in same program using Python?

Any suggestion will be appreciated!

Solution

  • detach_kprobe() is what you are looking for:

    b.attach_kprobe(event="nfs_file_read", fn_name="trace_entry")
b.attach_kprobe(event="nfs_file_read")

    I'm not sure why the documentation for that function is missing, but I'm sure the bcc maintainers would welcome a pull request to add it.