If you perform the following two one-liner scripts, it will not give similar trace results: (1) stap -p2 -bM -e 'probe addevent.iosyscall.open {}' (2) stap -ve 'probe syscall.open { printf("%s(%d): %s\n", execname(), pid(), argstr)} ' outputs: (1) 9.302127 CPU:0 PID:2399 APPNAME:(null) EVT_NAME:iosyscall.open.entry filename:/dev/bus/usb/002/001,flags:2,mode:1, 9.302163 CPU:0 PID:2399 APPNAME:(null) EVT_NAME:iosyscall.open.entry filename:/dev/bus/usb/002/003,flags:2,mode:1, (2) pcscd(2395): "/dev/bus/usb/002/001", O_RDWR pcscd(2395): "/dev/bus/usb/002/003", O_RDWR Looks like the pid from the lket trace refers to tid(). APPNAME is pcscd but it's displayed as (null).
LKET will log only the tid for smaller trace data size and faster speed. But LKET will trace the fork event by default, so the relation between tid,pid,ppid could be figured out by looking at fork events. The problem is that, when lket-b2a record the relation of pid/appname, it does record pid and appname, but when at a later stage lket-b2a retrieve the appname for a process, it use tid instead of pid to search, and then it will return NULL. I will fix this in lket-b2a.
Please keep in mind that "critical" bugs are meant to refer to showstoppers: ones that absolutely must be fixed ASAP because systems are down. This one does not seem to qualify.
This patch should fix this problem. Index: tapset/LKET/Changelog =================================================================== RCS file: /cvs/systemtap/src/tapset/LKET/Changelog,v retrieving revision 1.33 diff -r1.33 Changelog 0a1,6 > 2007-11-18 Eugene Teo <eteo@redhat.com> > > PR 3536 > * lket_trace.stp: appNameTree is indexed by tgid and not > pid. See runtime/lket/b2a/lket_b2a.c (register_appname) > Index: tapset/LKET/lket_trace.stp =================================================================== RCS file: /cvs/systemtap/src/tapset/LKET/lket_trace.stp,v retrieving revision 1.10 diff -r1.10 lket_trace.stp 154c154 < (_FMT_)((int64_t)current->pid << 32 | \ --- > (_FMT_)((int64_t)current->tgid << 32 | \ 164c164 < (_FMT_)((int64_t)current->pid << 32 | \ --- > (_FMT_)((int64_t)current->tgid << 32 | \ 172c172 < (_FMT_)((int64_t)current->pid << 32 | \ --- > (_FMT_)((int64_t)current->tgid << 32 | \
a patch committed for this bug. Please try to see if it still has problems. I did a test for both dumping into local file and into mysql database, and they works fine for me.
LKET has been retired.