Re: How to get correct filename in probe.execve

["Frank Ch. Eigler" <fche at redhat dot com>]

Hi -

> probe kprocess.exec
> {
>         printf("exec pid=%u ts=%u filename=%s arg1=%s args=%s\n",
> pid(), gettimeofday_ns(), filename, user_string_quoted(ulong_arg(1)),
> argstr)
>         EXEC_FILENAME[pid(),tid()] = ulong_arg(1)
> }

I'd use the tapset-provided variables or $context variables rather
than ulong_arg*:

% stap -L kprocess.exec

kprocess.exec name:string filename:string __argv:long args:string __envp:long env_str:string argstr:string $filename:long int $argv:long int $envp:long int

Those are likely more stable across versions / architectures.  You can
use the @defined() function to test for availability of $context
variables, so your script can even fall back between one and the other.
 


> [...]
> probe kernel.function("do_filp_open").call
> {
>         if ([pid(), tid()] in EXEC_FILENAME)
> [...]

By the way, there is no need to index -both- by pid() and tid().
Just tid() is enough if you want per-process+per-thread tracking;
just pid() if per-process.


> I am getting this marvel:
> 
> exec pid=30825 ts=1484976492960517468 filename=00007f32db232177
> arg1=00007f32db232177 args=00007f32db232177, [00007f32db23217c,
> 00007f32db232174, "echo Hello"], [/* 20 vars */]
> [...]

Good, enjoy!


- FChE