.[root@localhost ~]# stap -v -e 'probe vfs.read {printf("read performed\n"); exit()}'
Pass : parsed user script and library script(s) using 146900virt/23668res/3024shr/21332data kb, in 130usr/40sys/183real ms.
Pass : analyzed script: probe(s), function(s), embed(s), global(s) using 257648virt/78000res/6100shr/71736data kb, in 510usr/870sys/2099real ms.
Pass : using cached /root/.systemtap/cache/e2/stap_e2a36f2dcc498d9e1b0e44a8fa8004fa_1020.c
Pass : using cached /root/.systemtap/cache/e2/stap_e2a36f2dcc498d9e1b0e44a8fa8004fa_1020.ko
Pass : starting run.
read performed
Pass : run completed in 10usr/40sys/344real ms.
.[root@localhost ~]# uname -m
x86_64
.[root@localhost ~]# uname -r
2.6.-.el5
.[root@localhost ~]# uname -a
Linux localhost.localdomain 2.6.-.el5 # SMP Wed Dec :: EST x86_64 x86_64 x86_64 GNU/Linux
.stap -r kernel_version script -m module_name
stap -r 2.6.-.el5 -e 'probe vfs.read {exit()}' -m simple
生成simple.ko
staprun simple.ko
. [root@localhost ~]# echo "probe timer.s(10) {exit()}" | stap -v -
说明：To instruct stap to read a SystemTap script from standard input, use the - switch instead of the file name
.stap -e 'probe module("ext3").function("*") {println(execname()," ",pid()) }'
.stap -e 'probe timer.s(4) {println(execname()," ",pid()) }'
.stap -e 'probe begin{printf ("hello world\n"); exit() }'
.stap -e 'probe syscall.open { printf("%s(%d) open\n", execname(), pid()) }'
.[root@localhost ~]# cat >thread_indent.stp
probe kernel.function("*@net/socket.c").call
{
printf ("%s -> %s\n", thread_indent(), probefunc())
}
probe kernel.function("*@net/socket.c").return
{
printf ("%s <- %s\n", thread_indent(-), probefunc())
}
[root@localhost ~]# stap thread_indent.stp
pcscd(): -> sock_poll
pcscd(): <- sock_poll
pcscd(): -> sock_poll
pcscd(): <- sock_poll
.
[root@localhost ~]# cat .stp
probe syscall.* {
if(pid() == target())
printf("%s\n", name)
}
stap .stp -x
.[root@localhost ~]# stap .stp -c "ls -a"
.[root@localhost ~]# stap -L 'kernel.function("vfs_read")'
kernel.function("vfs_read@fs/read_write.c:248") $file:struct file* $buf:char* $count:size_t $pos:loff_t*
.
stap -e 'probe kernel.function("vfs_read") {
printf ("current files_stat max_files: %d\n",
@var("files_stat@fs/file_table.c")->max_files);
exit(); }'
.打印刷 函数的（vfs_read)四个参数
[root@localhost ~]# stap -e 'probe kernel.function("vfs_read") {printf("%s\n", $$parms); exit(); }'
file=0xffff81005429d0c0 buf=0x7fff98a0c270 count=0x2004 pos=0xffff8100363d3f50
说明:There are four parameters passed into vfs_read: file, buf, count, and pos.
The $$parms generates a string for the parameters passed into the function.
In this case all but the count parameter are pointers.
.打印数据结构
stap -e 'probe kernel.function("vfs_read") {printf("%s\n", $$parms$); exit(); }'
file={ .f_u={...},
.f_dentry=0xffff81003492c660,
.f_vfsmnt=0xffff810047fb70c0,
.f_op=0xffffffff886594a0,
.f_count={...},
.f_flags=,
.f_mode=,
.f_pos=,
.f_owner={...},
.f_uid=,
.f_gid=,
.f_ra={...},
.f_version=,
.f_security=0x0,
.private_data=0x0,
.f_ep_links={...},
.f_ep_lock={...},
.f_mapping=0xffff8100346125c0
}
buf=""
count=
pos=-
.打印更详细的数据结构
stap -e 'probe kernel.function("vfs_read") {printf("%s\n", $$parms$$); exit(); }'
file={.f_u={.fu_list={.next=0xffff810057a3e0f8,
.prev=0xffff8100440d70c0},
.fu_rcuhead={.next=0xffff810057a3e0f8,
.func=0xffff8100440d70c0
}
},
.f_dentry=0xffff810032dbb150,
.f_vfsmnt=0xffff810047fb70c0,
.f_op=0xffffffff8865b040,
.f_count={.counter=},
.f_flags=,
.f_mode=,
.f_pos=,
.f_owner={.lock={.raw_lock={.lock=}},
.pid=,
.uid=,
.euid=,
.security=0x0,
.signum=},
.f_uid=,
.f_gid=,
.f_ra={.start=,
.size=,
.flags=,
.cache_hit=,
.prev_page=,
.ahead_start=,
.ahea
说明:With the “$” suffix fields that are composed of data structures are not expanded.
The “$$” suffix will print the values contained within the nested data structures
.@cast:类型转换
function task_state:long (task:long)
{
return @cast(task, "task_struct", "kernel<linux/sched.h>")->state
}
The function returns the value of the state field from a task_struct pointed to by the long task.
The first argument of the @cast operator, task, is the pointer to the object.
The second argument is the type to cast the object to, task_struct.
The third argument lists what file that the type definition information comes from and is optional.
.命令行参数传递
Use $ if you are expecting the user to enter an integer as a command-line argument,
and @ if you are expecting a string.
cat >.stp
probe kenel.function(@)
{
printfln( execname(),@)
}
[root@localhost ~]# stap stap .stp vfs_read
.
foo["tom"] =
foo["dick"] =
foo["harry"] =
device[pid(),execname(),uid(),ppid(),"W"] = devname
All associate arrays must be declared as global,
regardless of whether the associate array is used in one or multiple probes
.
global reads
probe vfs.read
{
reads[execname()] ++
}
probe timer.s()
{
foreach (count in reads)
printf("%s : %d \n", count, reads[count])
}
.
probe timer.s()
{
foreach (count in reads- limit )
printf("%s : %d \n", count, reads[count])
}
reads:数组
limit :
The limit option instructs the foreach to only process the first ten iterations
(that is, print the first , starting with the highest value).
-:in descending order
cat >.stp
global reads
probe vfs.read
{
reads[execname()] ++
}
probe timer.s()
{
printf("=======\n")
foreach (count in reads-)
printf("%s : %d \n", count, reads[count])
if(["stapio"] in reads) {
printf("stapio read detected, exiting\n")
}
.
global reads
probe vfs.read
{
reads[execname(),pid()] <<<
}
probe timer.s()
{
foreach([var1,var2] in reads)
printf("%s (%d) : %d \n", var1, var2, @count(reads[var1,var2]))
}
@count(reads[execname()]) will return how many values are stored in each unique key in array reads.
@sum(reads[execname()]) will return the total of all values stored in each unique key in array reads.
the operator <<< $count stores the amount returned by $count to
the associated value of the corresponding execname() in the reads array