libbpf-tools: oomkill: support display memory cgroup

Using a simple test program (not shown) called OOM, we performed the
following two tests:

   1. Allocating unlimited memory
   2. Adding the process to a cgroup named oom-memcg and limiting its memory
      usage to 200MB.

When we do not print cgroup information, we can only see process information
and cannot see the difference between memcg and non-memcg.

    $ sudo ./oomkill
    Tracing OOM kills... Ctrl-C to stop.
    14:28:23 Triggered by PID 179201 ("oom"), OOM kill of PID 179201 ("oom"), 6114610 pages, loadavg: loadavg: 0.56 0.51 0.38 2/968 179204

    14:28:42 Triggered by PID 179212 ("oom"), OOM kill of PID 179212 ("oom"), 51200 pages, loadavg: loadavg: 0.40 0.47 0.37 3/968 179212

The function implemented by this patch can clearly display cgroup information.

    $ sudo ./oomkill  -c
    Tracing OOM kills... Ctrl-C to stop.
    14:32:59 Triggered by PID 179879 ("oom"), CGROUP 8309 ("/sys/fs/cgroup/user.slice/user-1000.slice/[email protected]/session.slice/[email protected]"), OOM kill of PID 179879 ("oom"), 6114610 pages, loadavg: loadavg: 0.50 0.38 0.35 4/970 179879

    14:33:14 Triggered by PID 179884 ("oom"), CGROUP 122547 ("/sys/fs/cgroup/oom-memcg"), MEMCG 122547 ("/sys/fs/cgroup/oom-memcg"), OOM kill of PID 179884 ("oom"), 51200 pages, loadavg: loadavg: 0.47 0.38 0.35 3/971 179884

Link: iovisor#5384
Signed-off-by: Rong Tao <[email protected]>

Author: Rtoax

libbpf-tools/oomkill.bpf.c

@@ -8,10 +8,16 @@
 #include "compat.bpf.h"
 #include "oomkill.h"
 
+/* linux:include/linux/memcontrol.h */
+struct mem_cgroup {
+	struct cgroup_subsys_state css;
+};
+
 SEC("kprobe/oom_kill_process")
 int BPF_KPROBE(oom_kill_process, struct oom_control *oc, const char *message)
 {
 	struct data_t *data;
+	struct mem_cgroup *memcg;
 
 	data = reserve_buf(sizeof(*data));
 	if (!data)
@@ -20,6 +26,16 @@ int BPF_KPROBE(oom_kill_process, struct oom_control *oc, const char *message)
 	data->fpid = bpf_get_current_pid_tgid() >> 32;
 	data->tpid = BPF_CORE_READ(oc, chosen, tgid);
 	data->pages = BPF_CORE_READ(oc, totalpages);
+	data->cgroupid = bpf_get_current_cgroup_id();
+
+	/* Get the memory cgroup id */
+	memcg = BPF_CORE_READ(oc, memcg);
+	if (memcg) {
+		struct cgroup *cgrp = BPF_CORE_READ(memcg, css.cgroup);
+		data->mem_cgroupid = BPF_CORE_READ(cgrp, kn, id);
+	} else
+		data->mem_cgroupid = 0;
+
 	bpf_get_current_comm(&data->fcomm, sizeof(data->fcomm));
 	bpf_probe_read_kernel(&data->tcomm, sizeof(data->tcomm), BPF_CORE_READ(oc, chosen, comm));
 	submit_buf(ctx, data, sizeof(*data));

libbpf-tools/oomkill.c

@@ -1,10 +1,12 @@
 // SPDX-License-Identifier: (LGPL-2.1 OR BSD-2-Clause)
 // Copyright (c) 2022 Jingxiang Zeng
 // Copyright (c) 2022 Krisztian Fekete
+// Copyright (c) 2025 Rong Tao
 //
 // Based on oomkill(8) from BCC by Brendan Gregg.
 // 13-Jan-2022   Jingxiang Zeng   Created this.
 // 17-Oct-2022   Krisztian Fekete Edited this.
+// 03-Aug-2025   Rong Tao         Support display cgroup.
 #include <argp.h>
 #include <errno.h>
 #include <signal.h>
@@ -20,13 +22,15 @@
 #include "compat.h"
 #include "oomkill.h"
 #include "btf_helpers.h"
+#include "cgroup_helpers.h"
 #include "trace_helpers.h"
 
 static volatile sig_atomic_t exiting = 0;
 
 static bool verbose = false;
+static bool display_cgroup = false;
 
-const char *argp_program_version = "oomkill 0.1";
+const char *argp_program_version = "oomkill 0.2";
 const char *argp_program_bug_address =
 	"https://github.com/iovisor/bcc/tree/master/libbpf-tools";
 const char argp_program_doc[] =
@@ -35,17 +39,22 @@ const char argp_program_doc[] =
 "USAGE: oomkill [-h]\n"
 "\n"
 "EXAMPLES:\n"
-"    oomkill               # trace OOM kills\n";
+"    oomkill               # trace OOM kills\n"
+"    oomkill --cgroup      # trace OOM kills with cgroup display\n";
 
 static const struct argp_option opts[] = {
 	{ "verbose", 'v', NULL, 0, "Verbose debug output", 0 },
+	{ "cgroup", 'c', NULL, 0, "Display cgroup information", 0 },
 	{ NULL, 'h', NULL, OPTION_HIDDEN, "Show the full help", 0 },
 	{},
 };
 
 static error_t parse_arg(int key, char *arg, struct argp_state *state)
 {
 	switch (key) {
+	case 'c':
+		display_cgroup = true;
+		break;
 	case 'v':
 		verbose = true;
 		break;
@@ -60,18 +69,28 @@ static error_t parse_arg(int key, char *arg, struct argp_state *state)
 
 static int handle_event(void *ctx, void *data, size_t len)
 {
-	char loadavg[256];
+	char loadavg[256], cgroup_path[PATH_MAX];
 	char ts[32];
 	struct data_t *e = data;
 
 	str_timestamp("%H:%M:%S", ts, sizeof(ts));
+	printf("%s Triggered by PID %d (\"%s\"),", ts, e->tpid, e->tcomm);
+	if (display_cgroup) {
+		get_cgroupid_path(e->cgroupid, cgroup_path, sizeof(cgroup_path));
+		printf(" CGROUP %lld (\"%s\"),", e->cgroupid, cgroup_path);
+		if (e->mem_cgroupid) {
+			if (e->mem_cgroupid != e->cgroupid)
+				get_cgroupid_path(e->mem_cgroupid, cgroup_path,
+						  sizeof(cgroup_path));
+			printf(" MEMCG %lld (\"%s\"),", e->mem_cgroupid, cgroup_path);
+		}
+	}
+	printf(" OOM kill of PID %d (\"%s\"), %lld pages", e->tpid, e->tcomm, e->pages);
 
 	if (str_loadavg(loadavg, sizeof(loadavg)) > 0)
-		printf("%s Triggered by PID %d (\"%s\"), OOM kill of PID %d (\"%s\"), %lld pages, loadavg: %s",
-			ts, e->fpid, e->fcomm, e->tpid, e->tcomm, e->pages, loadavg);
+		printf(", loadavg: %s\n", loadavg);
 	else
-		printf("%s Triggered by PID %d (\"%s\"), OOM kill of PID %d (\"%s\"), %lld pages\n",
-			ts, e->fpid, e->fcomm, e->tpid, e->tcomm, e->pages);
+		printf("\n");
 
 	return 0;
 }

libbpf-tools/oomkill.h

@@ -8,6 +8,8 @@ struct data_t {
 	__u32 fpid;
 	__u32 tpid;
 	__u64 pages;
+	__u64 cgroupid;
+	__u64 mem_cgroupid;
 	char fcomm[TASK_COMM_LEN];
 	char tcomm[TASK_COMM_LEN];
 };