Note
.stp
, and contains probes written in the following format:
probeevent
{statements
}
,
). If multiple events are specified in a single probe, SystemTap will execute the handler when any of the specified events occur.
{ }
) and contains the statements to be executed per event. SystemTap executes these statements in sequence; special separators or terminators are generally not necessary between multiple statements.
Note
functionfunction_name
(arguments
) {statements
} probeevent
{function_name
(arguments
)}
statements
in function_name
are executed when the probe for event
executes. The arguments
are optional values passed into the function.
Important
system_call
system_call
. If the exit from a syscall is desired, appending a .return
to the event monitor the exit of the system call instead. For example, to specify the entry and exit of the system call close
, use syscall.close
and syscall.close.return
respectively.
file_operation
file_operation
event for Virtual File System (VFS). Similar to syscall
event, appending a .return
to the event monitors the exit of the file_operation
operation.
function
")function
. For example, kernel.function("sys_open")
refers to the "event" that occurs when the kernel function sys_open
is called by any thread in the system. To specify the return of the kernel function sys_open
, append the return
string to the event statement; i.e. kernel.function("sys_open").return
.
*
) for wildcards. You can also trace the entry or exit of a function in a kernel source file. Consider the following example:
Example 3.1. wildcards.stp
probe kernel.function("*@net/socket.c") { } probe kernel.function("*@net/socket.c").return { }
net/socket.c
. The second probe specifies the exit of all those functions. Note that in this example, there are no statements in the handler; as such, no information will be collected or displayed.
tracepoint
")tracepoint
. Recent kernels (2.6.30 and newer) include instrumentation for specific events in the kernel. These events are statically marked with tracepoints. One example of a tracepoint available in systemtap is kernel.trace("kfree_skb")
which indicates each time a network buffer is freed in the kernel.
module
").function("function
")Example 3.2. moduleprobe.stp
probe module("ext3").function("*") { } probe module("ext3").function("*").return { }
ext3
module. The second probe points to the exits of all functions for that same module; the use of the .return
suffix is similar to kernel.function()
. Note that the probes in Example 3.2, “moduleprobe.stp” do not contain statements in the probe handlers, and as such will not print any useful data (as in Example 3.1, “wildcards.stp”).
/lib/modules/kernel_version
, where kernel_version
refers to the currently loaded kernel version. Modules use the file name extension .ko
.
hello world
every 4 seconds. Note that you can also use the following timer events:
timer.ms(milliseconds
)
timer.us(microseconds
)
timer.ns(nanoseconds
)
timer.hz(hertz
)
timer.jiffies(jiffies
)
Important
man stapprobes
. The SEE ALSO section of man stapprobes
also contains links to other man
pages that discuss supported events for specific subsystems and components.