In this lesson, you will learn how to observe the bridge between user applications and the kernel’s Virtual File System (VFS) using low-level tracing tools.
The VFS as a Translator
When you run a command like cat or ls, your application doesn't talk directly to your hard drive. Instead, it makes system calls to the VFS. The VFS acts as an abstraction layer, providing a unified interface so that applications can interact with different filesystems (like ext4, XFS, or even network mounts) without needing to know the technical details of the underlying storage.
Tracing allows us to peek into this layer to see exactly how these requests are translated.
Profiling with strace and bpftrace
The simplest way to observe the VFS in action is through strace. By tracing an application, you can see the specific system calls (like openat, read, and write) that trigger the VFS to perform work:
strace -e trace=file cat /etc/passwd
When you run this, you will see output like openat(AT_FDCWD, "/etc/passwd", O_RDONLY) = 3. This line represents the application asking the VFS to look up a path and return a file descriptor.
For a deeper look, we can use bpftrace to hook into kernel functions that the VFS calls during these operations. For instance, you can trace every time the kernel performs a VFS-level "read" operation:
# Tracing the vfs_read kernel function
sudo bpftrace -e 'kprobe:vfs_read { printf("Process %s is reading from VFS\n", comm); }'
By observing these calls, you can identify if an application is making an excessive number of small read requests, which often indicates inefficient file handling at the application level. While standard I/O monitoring shows you disk throughput, VFS tracing shows you the intent of the application before the kernel decides how to fulfill the request. This distinction is vital for troubleshooting why certain applications slow down when accessing specific directory structures or filesystems.
Key Takeaway: Virtual File System tracing allows you to inspect the precise system calls and kernel-level transitions triggered by an application, providing a window into how the operating system manages file interactions before they reach the storage hardware.