Re: How to get correct filename in probe.execve

[Arkady <larytet at gmail dot com>]

On Sat, Jan 21, 2017 at 8:52 AM, Frank Ch. Eigler <fche@redhat.com> wrote:
> Hi -
>
>> probe kprocess.exec
>> {
>>         .........
>>         EXEC_FILENAME[pid(),tid()] = ulong_arg(1)
>> }
>
> I'd use the tapset-provided variables or $context variables rather
> than ulong_arg*:
>

I am trying to ensure that I keep an integer in the EXEC_FILENAME.
If I do
EXEC_FILENAME=filename

SystemTap assumes a (zero terminated) string. After that I want to do
something like

user_string_quoted(EXEC_FILENAME[pid(), tid()])


> % stap -L kprocess.exec
>
> kprocess.exec name:string filename:string __argv:long args:string __envp:long env_str:string argstr:string $filename:long int $argv:long int $envp:long int
>
> Those are likely more stable across versions / architectures.  You can
> use the @defined() function to test for availability of $context
> variables, so your script can even fall back between one and the other.
>
>
> By the way, there is no need to index -both- by pid() and tid().
> Just tid() is enough if you want per-process+per-thread tracking;
> just pid() if per-process.
>
Great tip. I did not think about it - the kernel knows only threads, of course.
>
>> I am getting this marvel:
>>
>> [...]
>
> Good, enjoy!

Thank you!
>
>
> - FChE