Using bcc Tools to Monitor MySQL Performance with eBPF

The author, a member of the iKexing testing team, shares a practical guide on using the eBPF‑based bcc package to observe MySQL performance.

1. What is BPF and eBPF – BPF (Berkeley Packet Filter) is a low‑level interface for packet filtering on Unix‑like systems. Since Linux 3.18, an extended virtual machine called eBPF allows attaching programs to various tracepoints to collect kernel‑level information.

2. What is bcc – bcc is an open‑source project that provides a Python library and a collection of ready‑made eBPF programs, simplifying the development of eBPF‑based tools. The project repository is https://github.com/iovisor/bcc .

3. Installing bcc

# Ubuntu
sudo apt-key adv --keyserver keyserver.ubuntu.com --recv-keys 4052245BD4284CDD
echo "deb https://repo.iovisor.org/apt/$(lsb_release -cs) $(lsb_release -cs) main" | sudo tee /etc/apt/sources.list.d/iovisor.list
sudo apt-get update
sudo apt-get install bcc-tools libbcc-examples linux-headers-$(uname -r)
export PATH=$PATH:/usr/share/bcc/tools

# CentOS
yum install bcc-tools
export PATH=$PATH:/usr/share/bcc/tools

After installation on a CentOS 7.7 system, the /usr/share/bcc/tools directory contains dozens of ready‑to‑use tracing utilities (e.g., dbstat , dbslower , tcpstates , biolatency , etc.).

4. Using bcc tools to monitor MySQL

4.1 dbstat – aggregates MySQL/PostgreSQL query latency into a histogram.

dbstat [-h] [-v] [-p [PID ...]] [-m THRESHOLD] [-u] [-i INTERVAL] {mysql,postgres}

Typical options include -p to specify the MySQL PID, -u for microsecond units, and -i to set the reporting interval. Example output shows latency buckets with counts and a visual bar.

4.2 dbslower – traces queries whose execution time exceeds a given threshold.

dbslower [-h] [-v] [-p [PID ...]] [-x PATH] [-m THRESHOLD] {mysql,postgres}

Running dbslower mysql -p $(pidof mysqld) -m 2 prints a table of queries slower than 2 ms, including timestamp, PID, latency, and the SQL statement.

5. Usage limitations

bcc requires Linux kernel 3.15+, and most features need kernel 4.1+.

Some probes (e.g., query__start ) need MySQL compiled with DTrace tracepoints.