libbpf-tools: oomkill: support display cgroup

Using a simple test program (not shown) called OOM, we performed the
following two tests:

   1. Allocating unlimited memory
   2. Adding the process to a cgroup named oom-memcg and limiting its memory
      usage to 200MB.

When we do not print cgroup information, we can only see process information
and cannot see the difference between memcg and non-memcg.

    $ sudo ./oomkill
    Tracing OOM kills... Ctrl-C to stop.
    14:28:23 Triggered by PID 179201 ("oom"), OOM kill of PID 179201 ("oom"), 6114610 pages, loadavg: loadavg: 0.56 0.51 0.38 2/968 179204

    14:28:42 Triggered by PID 179212 ("oom"), OOM kill of PID 179212 ("oom"), 51200 pages, loadavg: loadavg: 0.40 0.47 0.37 3/968 179212

The function implemented by this patch can clearly display cgroup information.

    $ sudo ./oomkill  -c
    Tracing OOM kills... Ctrl-C to stop.
    14:32:59 Triggered by PID 179879 ("oom"), CGROUP 8309 ("/sys/fs/cgroup/user.slice/user-1000.slice/[email protected]/session.slice/[email protected]"), OOM kill of PID 179879 ("oom"), 6114610 pages, loadavg: loadavg: 0.50 0.38 0.35 4/970 179879

    14:33:14 Triggered by PID 179884 ("oom"), CGROUP 122547 ("/sys/fs/cgroup/oom-memcg"), MEMCG 122547 ("/sys/fs/cgroup/oom-memcg"), OOM kill of PID 179884 ("oom"), 51200 pages, loadavg: loadavg: 0.47 0.38 0.35 3/971 179884

Signed-off-by: Rong Tao <[email protected]>

Author: Rtoax

libbpf-tools/cgroup_helpers.c

@@ -3,25 +3,31 @@
 #include <assert.h>
 #include <dirent.h>
 #include <errno.h>
+#include <limits.h>
 #include <stdbool.h>
 #include <stdio.h>
 #include <stdlib.h>
 #include <sys/stat.h>
 #include <string.h>
+#include <unistd.h>
 #include "cgroup_helpers.h"
 
 
-int cgroup_get_roots(char ***roots)
+/**
+ * Get cgroup mountpoints.
+ *
+ * @roots need to be free with cgroup_free_roots(), access with roots[idx].
+ *
+ * On success, the number of root path returned, need pass to cgroup_free_roots()
+ * nentries parameter. On error, -errno returned.
+ */
+static int cgroup_get_roots(char ***roots)
 {
-	char line[2048];
-	char fsname[128];
-	char mountpoint[PATH_MAX];
-	char fstype[64];
-	char mntoptions[256];
-	int dump_frequency;
-	int fsck_order;
+	char line[2048], fsname[128], mntpoint[PATH_MAX], fstype[64], mntopt[256];
+	int dump_frequency, fsck_order, n;
 	FILE *fp;
-	int n = 0;
+
+	n = 0;
 
 	fp = fopen("/proc/mounts", "r");
 	if (!fp)
@@ -30,8 +36,8 @@ int cgroup_get_roots(char ***roots)
 	*roots = NULL;
 
 	while (fgets(line, sizeof(line), fp)) {
-		if (sscanf(line, "%s %s %s %s %d %d\n", fsname, mountpoint,
-			fstype, mntoptions, &dump_frequency,
+		if (sscanf(line, "%s %s %s %s %d %d\n", fsname, mntpoint,
+			fstype, mntopt, &dump_frequency,
 			&fsck_order) != 6)
 			continue;
 
@@ -41,19 +47,24 @@ int cgroup_get_roots(char ***roots)
 
 		n++;
 		*roots = (char **)realloc(*roots, n * sizeof(char *));
-		(*roots)[n - 1] = strdup(mountpoint);
+		(*roots)[n - 1] = strdup(mntpoint);
 	}
 
 	fclose(fp);
 
 	return n;
 }
 
-int cgroup_free_roots(char **roots, int nentries)
+/**
+ * Used to release roots allocated by cgroup_get_roots().
+ *
+ * On success, zero returned. On error, -errno returned.
+ */
+static int cgroup_free_roots(char **roots, int nentries)
 {
 	int i;
 
-	if (!roots || nentries <= 0)
+	if (!roots)
 		return -EINVAL;
 
 	for (i = 0; i < nentries; i++)
@@ -72,17 +83,11 @@ long cgroup_cgroupid_of_path(const char *cgroup_path)
 	return err ? -errno : st.st_ino;
 }
 
-long cgroup_cgroupid_of_mnt_path(const char *mntpoint, const char *cgroup_path)
-{
-	char path[PATH_MAX];
-	snprintf(path, sizeof(path) - 1, "%s/%s", mntpoint, cgroup_path);
-	return cgroup_cgroupid_of_path(path);
-}
-
 typedef int (*match_fn)(const char *path, void *arg);
 
 /**
- * Recursively search for a matching cgroup in a root directory.
+ * Recursively traverse all directories under the known cgroup root for
+ * matching.
  *
  * When @match returns true, the match succeeds and the function returns
  * without further searching.
@@ -100,7 +105,9 @@ static int find_cgroup_from_root_recur(const char *root, match_fn match,
 	struct stat st;
 	size_t path_len;
 
-	if (!root || !match)
+	assert(match && "match_fn is NULL");
+
+	if (!root)
 		return -EINVAL;
 
 	err = lstat(root, &st);
@@ -110,7 +117,8 @@ static int find_cgroup_from_root_recur(const char *root, match_fn match,
 		return -ENOTDIR;
 
 	path = malloc(PATH_MAX);
-	assert(path && "Malloc failed");
+	if (!path)
+		return -errno;
 
 	snprintf(path, PATH_MAX - 1, "%s/", root);
 
@@ -204,9 +212,9 @@ static int match_cgroupid(const char *path, void *arg)
 	return 0;
 }
 
-int cgroup_cgroup_path(long cgroupid, char *buf, size_t buf_len)
+int get_cgroupid_path(long cgroupid, char *buf, size_t buf_len)
 {
-	char **roots;
+	char **roots = 0;
 	int nroots, i, err;
 	struct match_cgroupid_arg arg = {};
 	bool found = false;
@@ -231,61 +239,3 @@ int cgroup_cgroup_path(long cgroupid, char *buf, size_t buf_len)
 
 	return found ? 0 : -ENOENT;
 }
-
-int cgroup_proc_for_each_cgroup_entry(pid_t pid, cgroup_proc_entry_fn callback,
-				      void *arg)
-{
-	char line[512];
-	char proc[64];
-	FILE *f;
-	int lines = 0;
-	struct cgroup_proc_entry cgrp;
-
-	if (!callback)
-		return -EINVAL;
-
-	snprintf(proc, sizeof(proc) - 1, "/proc/%d/cgroup", pid);
-
-	f = fopen(proc, "r");
-	if (!f)
-		return -errno;
-
-	/**
-	 * Parse each line, format:
-	 *
-	 *     <hierarchy_id>:<subsystem_list>:<cgroup_path>
-	 *
-	 * For cgroupv2, subsystem_list is empty.
-	 */
-	while (fgets(line, sizeof(line), f)) {
-		char *s_hid = line;
-		char *s_subsys = strchr(line, ':');
-		char *s_path = strrchr(line, ':');
-
-		s_subsys[0] = '\0';
-		s_subsys++;
-		s_path[0] = '\0';
-		s_path++;
-
-		memset(&cgrp, 0, sizeof(cgrp));
-
-		cgrp.hierarchy_id = atoi(s_hid);
-
-		if (strlen(s_subsys) == 0) {
-			cgrp.cgroup_type = 2;	/* cgroupv2 */
-		} else {
-			cgrp.cgroup_type = 1;	/* cgroupv1 */
-			snprintf(cgrp.subsystem_list, sizeof(cgrp.subsystem_list),
-				 s_subsys);
-		}
-
-		/* Use strlen() to strip '\n' */
-		snprintf(cgrp.cgroup_path, strlen(s_path), s_path);
-
-		lines++;
-		callback(&cgrp, arg);
-	}
-
-	fclose(f);
-	return lines;
-}

libbpf-tools/cgroup_helpers.h

@@ -1,74 +1,19 @@
 // SPDX-License-Identifier: (LGPL-2.1 OR BSD-2-Clause)
 /* Copyright (c) 2025 Rong Tao */
 #pragma once
-#include <limits.h>
-#include <unistd.h>
 #include <sys/types.h>
 
-#define CGROUP_DEFAULT_MNTPOINT	"/sys/fs/cgroup/"
-
-/**
- * Get cgroup mountpoints.
- *
- * @roots need to be free with cgroup_free_roots(), access with roots[idx].
- *
- * On success, the number of root path returned, need pass to cgroup_free_roots()
- * nentries parameter. On error, -errno returned.
- */
-int cgroup_get_roots(char ***roots);
-
-/**
- * Used to release roots allocated by cgroup_get_roots().
- *
- * On success, zero returned. On error, -errno returned.
- */
-int cgroup_free_roots(char **roots, int nentries);
 
 /**
  * Get cgroup id from cgroup path.
  *
  * On success, the cgroupid returned. On error, -errno returned.
  */
 long cgroup_cgroupid_of_path(const char *cgroup_path);
-long cgroup_cgroupid_of_mnt_path(const char *mntpoint, const char *cgroup_path);
 
 /**
  * Get cgroup path from cgroupid.
  *
  * On success, zero returned. On error, -errno returned.
  */
-int cgroup_cgroup_path(long cgroupid, char *buf, size_t buf_len);
-
-/**
- * This structure is used to describe a line of info in /proc/<pid>/cgroup.
- * For example, the following two entries show cgroupv1 and cgroupv2
- * respectively.
- *
- *   1:name=systemd:/user.slice/user-1000.slice/session-1.scope
- *   0::/user.slice/user-1000.slice/session-1.scope
- */
-struct cgroup_proc_entry {
-	/**
-	 * 1: cgroup v1
-	 * 2: cgroup v2
-	 */
-	int cgroup_type;
-	/**
-	 * The following variable stores a line of information from a
-	 * /proc/<pid>/cgroup file.
-	 */
-	int hierarchy_id;
-	char subsystem_list[256];
-	char cgroup_path[PATH_MAX];
-};
-
-typedef void (*cgroup_proc_entry_fn)(const struct cgroup_proc_entry *cgrp, void *arg);
-
-/**
- * This function traverses all cgroup information of a process, and each cgroup
- * entry will call the callback function.
- *
- * On success, the number of entry returned. On error, -errno returned.
- */
-int cgroup_proc_for_each_cgroup_entry(pid_t pid, cgroup_proc_entry_fn callback,
-				      void *arg);
+int get_cgroupid_path(long cgroupid, char *buf, size_t buf_len);

libbpf-tools/oomkill.bpf.c

@@ -8,10 +8,16 @@
 #include "compat.bpf.h"
 #include "oomkill.h"
 
+/* linux:include/linux/memcontrol.h */
+struct mem_cgroup {
+	struct cgroup_subsys_state css;
+};
+
 SEC("kprobe/oom_kill_process")
 int BPF_KPROBE(oom_kill_process, struct oom_control *oc, const char *message)
 {
 	struct data_t *data;
+	struct mem_cgroup *memcg;
 
 	data = reserve_buf(sizeof(*data));
 	if (!data)
@@ -20,6 +26,16 @@ int BPF_KPROBE(oom_kill_process, struct oom_control *oc, const char *message)
 	data->fpid = bpf_get_current_pid_tgid() >> 32;
 	data->tpid = BPF_CORE_READ(oc, chosen, tgid);
 	data->pages = BPF_CORE_READ(oc, totalpages);
+	data->cgroupid = bpf_get_current_cgroup_id();
+
+	/* Get the memory cgroup id */
+	memcg = BPF_CORE_READ(oc, memcg);
+	if (memcg) {
+		struct cgroup *cgrp = BPF_CORE_READ(memcg, css.cgroup);
+		data->mem_cgroupid = BPF_CORE_READ(cgrp, kn, id);
+	} else
+		data->mem_cgroupid = 0;
+
 	bpf_get_current_comm(&data->fcomm, sizeof(data->fcomm));
 	bpf_probe_read_kernel(&data->tcomm, sizeof(data->tcomm), BPF_CORE_READ(oc, chosen, comm));
 	submit_buf(ctx, data, sizeof(*data));

libbpf-tools/oomkill.c

@@ -1,10 +1,12 @@
 // SPDX-License-Identifier: (LGPL-2.1 OR BSD-2-Clause)
 // Copyright (c) 2022 Jingxiang Zeng
 // Copyright (c) 2022 Krisztian Fekete
+// Copyright (c) 2025 Rong Tao
 //
 // Based on oomkill(8) from BCC by Brendan Gregg.
 // 13-Jan-2022   Jingxiang Zeng   Created this.
 // 17-Oct-2022   Krisztian Fekete Edited this.
+// 03-Aug-2025   Rong Tao         Support display cgroup.
 #include <argp.h>
 #include <errno.h>
 #include <signal.h>
@@ -20,13 +22,15 @@
 #include "compat.h"
 #include "oomkill.h"
 #include "btf_helpers.h"
+#include "cgroup_helpers.h"
 #include "trace_helpers.h"
 
 static volatile sig_atomic_t exiting = 0;
 
 static bool verbose = false;
+static bool display_cgroup = false;
 
-const char *argp_program_version = "oomkill 0.1";
+const char *argp_program_version = "oomkill 0.2";
 const char *argp_program_bug_address =
 	"https://github.com/iovisor/bcc/tree/master/libbpf-tools";
 const char argp_program_doc[] =
@@ -35,17 +39,22 @@ const char argp_program_doc[] =
 "USAGE: oomkill [-h]\n"
 "\n"
 "EXAMPLES:\n"
-"    oomkill               # trace OOM kills\n";
+"    oomkill               # trace OOM kills\n"
+"    oomkill --cgroup      # trace OOM kills with cgroup display\n";
 
 static const struct argp_option opts[] = {
 	{ "verbose", 'v', NULL, 0, "Verbose debug output", 0 },
+	{ "cgroup", 'c', NULL, 0, "Display cgroup information", 0 },
 	{ NULL, 'h', NULL, OPTION_HIDDEN, "Show the full help", 0 },
 	{},
 };
 
 static error_t parse_arg(int key, char *arg, struct argp_state *state)
 {
 	switch (key) {
+	case 'c':
+		display_cgroup = true;
+		break;
 	case 'v':
 		verbose = true;
 		break;
@@ -60,18 +69,28 @@ static error_t parse_arg(int key, char *arg, struct argp_state *state)
 
 static int handle_event(void *ctx, void *data, size_t len)
 {
-	char loadavg[256];
+	char loadavg[256], cgroup_path[PATH_MAX];
 	char ts[32];
 	struct data_t *e = data;
 
 	str_timestamp("%H:%M:%S", ts, sizeof(ts));
+	printf("%s Triggered by PID %d (\"%s\"),", ts, e->tpid, e->tcomm);
+	if (display_cgroup) {
+		get_cgroupid_path(e->cgroupid, cgroup_path, sizeof(cgroup_path));
+		printf(" CGROUP %lld (\"%s\"),", e->cgroupid, cgroup_path);
+		if (e->mem_cgroupid) {
+			if (e->mem_cgroupid != e->cgroupid)
+				get_cgroupid_path(e->mem_cgroupid, cgroup_path,
+						  sizeof(cgroup_path));
+			printf(" MEMCG %lld (\"%s\"),", e->mem_cgroupid, cgroup_path);
+		}
+	}
+	printf(" OOM kill of PID %d (\"%s\"), %lld pages", e->tpid, e->tcomm, e->pages);
 
 	if (str_loadavg(loadavg, sizeof(loadavg)) > 0)
-		printf("%s Triggered by PID %d (\"%s\"), OOM kill of PID %d (\"%s\"), %lld pages, loadavg: %s",
-			ts, e->fpid, e->fcomm, e->tpid, e->tcomm, e->pages, loadavg);
+		printf(", loadavg: %s\n", loadavg);
 	else
-		printf("%s Triggered by PID %d (\"%s\"), OOM kill of PID %d (\"%s\"), %lld pages\n",
-			ts, e->fpid, e->fcomm, e->tpid, e->tcomm, e->pages);
+		printf("\n");
 
 	return 0;
 }