Exception: Failed to attach BPF to kprobe when executing sudo opensnoop-bpfcc

Question

When I try to execute sudo opensnoop-bpfcc I get this message:

In file included from /virtual/main.c:4:
In file included from include/linux/sched.h:14:
In file included from include/linux/pid.h:5:
In file included from include/linux/rculist.h:11:
In file included from include/linux/rcupdate.h:40:
In file included from include/linux/preempt.h:81:
In file included from ./arch/x86/include/asm/preempt.h:7:
In file included from include/linux/thread_info.h:38:
In file included from ./arch/x86/include/asm/thread_info.h:53:
./arch/x86/include/asm/cpufeature.h:150:2: warning: "Compiler lacks ASM_GOTO support. Add -D __BPF_TRACING__ to your compiler arguments"
      [-W#warnings]
#warning "Compiler lacks ASM_GOTO support. Add -D __BPF_TRACING__ to your compiler arguments"
 ^
1 warning generated.
Traceback (most recent call last):
  File "/usr/sbin/opensnoop-bpfcc", line 127, in <module>
    b.attach_kprobe(event="sys_open", fn_name="trace_entry")
  File "/usr/lib/python2.7/dist-packages/bcc/__init__.py", line 526, in attach_kprobe
    raise Exception("Failed to attach BPF to kprobe")
Exception: Failed to attach BPF to kprobe

I don't understand how to fix it. I've just installed bcc tools using this command

sudo apt-get install bpfcc-tools linux-headers-$(uname -r)

as suggested on the github page https://github.com/iovisor/bcc/blob/master/INSTALL.md#ubuntu---binary

The running OS is 18.04.2 LTS (Bionic Beaver).

I believe this bcc issue is related (and proposes a workaround). — Qeole
They 're taking about 5.0 kernel version do you think it's the same for 4.18? — Maicake
Yes. Yonghong gives additional details in this commit log for kernel samples, the issue has been around since 4.17. — Qeole
Thanks again, so I have to build it from the source code because the package maybe is not updated. — Maicake
Do you have kernel modules installed on your system? This sounds like you don't. (sudo apt install linux-headers-$(uname -r)) — Qeole

Maicake Maicake · Accepted Answer · 2019-07-23T11:30:01

I had to compile bcc from source code instead of installing it using the package.

1) Install linux kernel headers

sudo apt install linux-headers-$(uname -r)

2) Install required dependencies

sudo apt-get -y install bison build-essential cmake flex git libedit-dev \ libllvm6.0 llvm-6.0-dev libclang-6.0-dev python zlib1g-dev libelf-dev

3) Compile bcc from source code

 git clone github.com/iovisor/bcc.git
 mkdir bcc/build; cd bcc/build 
 cmake .. -DCMAKE_INSTALL_PREFIX=/usr 
 make 
 sudo make install

Exception: Failed to attach BPF to kprobe when executing sudo opensnoop-bpfcc

1 Answers