blkparse

blkparse [options] [<device> ...]
blkparse -i <file>

-a <action>
    Applies filters to display only trace points with the specified action type (e.g., 'Q' for queue, 'C' for completion).

-A <action>
    Suppresses (ignores) trace points with the specified action type.

-b
    Displays block numbers in hexadecimal format.

-c
    Sorts the output by CPU number.

-C
    Disables merging of concurrent events; outputs events strictly in their captured order.

-d <mask>
    Enables debugging output based on the specified mask value.

-D <directory>
    Specifies a directory for outputting separate files per-device. Only valid when reading from standard input.

-e <event>
    Specifies one or more event types to display. Can be specified multiple times.

-F <file>
    Reads the output format string from the specified file instead of an argument.

-f <format>
    Specifies the output format string for trace events. See man page for format specifiers.

-h
    Displays a brief help message and exits.

-i <file>
    Reads input trace data from the specified file instead of standard input.

-l <lines>
    Limits the output to a specific number of lines.

-L
    Prints latency values in microseconds for applicable events (e.g., completions).

-m
    Includes the minor number in the device name output.

-N
    Suppresses the device name output column.

-O
    Uses the old timestamp output format (seconds since boot).

-o <file>
    Writes the parsed output to the specified file instead of standard output.

-p <plugin>
    Loads and uses a specified output plugin for custom processing. Can be specified multiple times.

-P <plugin>
    Prints information about the specified plugin and exits.

-q
    Enables quiet mode, suppressing informative messages.

-r
    Enables raw data output format (implies -q).

-s
    Includes the sequence number in the output.

-S
    Includes syscall information in the output, if available in the trace data.

-t
    Displays timestamps for each event.

-T
    Displays timestamps relative to the first event in the trace.

-v
    Increases verbosity of output messages.

-V
    Prints the version information and exits.

-w <time>
    Waits for a specified time (in seconds) for blktrace to terminate, useful when piping from a live trace.

-x <plugin>
    Specifies an output format plugin to use for parsing raw trace data.

blkparse is a command-line utility used to convert the binary trace data generated by the blktrace utility into a human-readable format. It is an essential tool for in-depth analysis of disk I/O activity, debugging storage performance issues, and understanding how applications interact with the block layer of the Linux kernel. blkparse can read trace data from a specified file (captured previously by blktrace) or directly from standard input, typically piped from a live blktrace capture.

It offers extensive filtering and formatting options, allowing users to select specific event types, devices, or processes, and customize the output layout. This flexibility makes it invaluable for detailed I/O pattern analysis, helping administrators and developers pinpoint bottlenecks, optimize file system layouts, and improve overall system performance related to storage operations.

blkparse relies on binary data generated by blktrace. The output format and available information can vary depending on the kernel version and specific trace points enabled during the blktrace capture. Understanding the output often requires familiarity with block I/O concepts and blktrace event types. Using the default format or a custom format string (with -f or -F) is crucial for effective analysis, as raw output can be overwhelming.

By default, blkparse provides a human-readable summary that typically includes columns for timestamp, CPU, process ID, command, action (e.g., 'Q' for queued, 'C' for completed), device, block number, and size. The exact columns and their content depend on the captured events.

The -f option allows users to define a custom output format using a rich set of format specifiers (e.g., %a for action, %d for device, %T for timestamp, %S for sector). This enables highly tailored analysis views to focus on specific data points relevant to the investigation.

blkparse is often used in conjunction with blktrace in a pipeline for real-time I/O analysis, such as blktrace -o - <device> | blkparse -i -. The -w option is particularly useful in such scenarios, allowing blkparse to wait for blktrace to finish.

blkparse is an integral part of the blktrace suite, which was introduced into the Linux kernel around 2006. This project aimed to provide a robust and detailed mechanism for tracing block I/O operations, addressing the limitations of existing tools like iostat in providing granular I/O visibility. blkparse evolved alongside blktrace to serve as the essential user-space component for interpreting the raw binary trace data, making it accessible for system administrators and developers to diagnose and optimize storage performance.

blktrace(8), btt(1), iostat(1)