]>
Commit | Line | Data |
---|---|---|
210ff7bf | 1 | SYSTEMTAP EXAMPLES INDEX BY KEYWORD |
09a98ae0 | 2 | (see also index.txt) |
210ff7bf | 3 | |
3b33d8c4 | 4 | |
81a1a9e8 | 5 | For systemtap version 3.0. |
3b33d8c4 | 6 | |
b9ae0bc4 FCE |
7 | = _BEST = |
8 | ||
9 | general/eventcount.stp - Count Specified Events | |
10 | keywords: _best statistics thread process | |
11 | ||
12 | The script periodically prints a count of specified events and their | |
13 | related tid's over the course of execution. Numerous configuration | |
14 | options exist to control filtering / reporting, see the script | |
15 | source. | |
16 | ||
17 | # stap eventcount.stp syscall.* -c 'sleep 1' | |
18 | ||
19 | ||
20 | general/helloworld.stp - SystemTap "Hello World" Program | |
21 | keywords: _best simple | |
22 | ||
23 | A basic "Hello World" program implemented in SystemTap script. It | |
24 | prints out "hello world" message and then immediately exits. | |
25 | ||
26 | # stap helloworld.stp | |
27 | ||
28 | ||
29 | general/para-callgraph.stp - Callgraph Tracing with Arguments | |
30 | keywords: _best trace callgraph | |
31 | ||
32 | Print a timed per-thread microsecond-timed callgraph, complete with | |
33 | function parameters and return values. The first parameter names the | |
34 | function probe points to trace. The optional second parameter names | |
35 | the probe points for trigger functions, which acts to enable tracing | |
36 | for only those functions that occur while the current thread is | |
37 | nested within the trigger. | |
38 | ||
39 | # stap para-callgraph.stp 'kernel.function("*@fs/proc*.c")' \ | |
40 | 'kernel.function("vfs_read")' -c "cat /proc/sys/vm/* || true" | |
41 | ||
42 | ||
43 | general/varwatch.stp - Watch a Variable Changing Value in a Thread | |
44 | keywords: _best monitoring | |
45 | ||
46 | This script places a set of probes (specified by $1), each of which | |
47 | monitors the state of some context $variable expression (specified by | |
48 | $2). Whenever the value changes, with respect to the active thread, | |
49 | the event is traced. | |
50 | ||
51 | # stap -w varwatch.stp 'kernel.statement("do_sys_open@fs/open.c:*")' \ | |
52 | '$$vars' -c "sleep 1" | |
53 | ||
54 | ||
75ed3b3c FCE |
55 | general/whythefail.stp - Why did the function fail? |
56 | keywords: speculation monitoring function trace _best | |
57 | ||
58 | The whythefail.stp script prints a statement-execution trace for a | |
59 | given function, but only for those runs of the function that ended up | |
60 | with a (configurable) post-return condition. | |
61 | ||
62 | # stap whythefail.stp kernel sys_open '$return < 0' -c 'cat \ | |
63 | /root/no-such-file || true' | |
64 | ||
65 | ||
b9ae0bc4 FCE |
66 | network/netfilter_summary.stp - System-Wide Count of Network Packets by IPs |
67 | keywords: _best network traffic | |
68 | ||
69 | The script watches all IPv4 network traffic on the system. On exit | |
70 | the script prints a list showing the number of packets sent along | |
71 | source IP address / destination IP address pair encountered, and the | |
72 | total number of bytes sent among the pair. The list is ordered from | |
73 | greatest to least number of packets seen among the source/destination | |
74 | pairs. | |
75 | ||
76 | # stap netfilter_summary.stp -c "sleep 1" | |
77 | ||
78 | ||
a89c2e98 FL |
79 | network/netfilter_summary_json.stp - System-Wide Count of Network Packets by IPs |
80 | keywords: _best network traffic json | |
81 | ||
82 | The script watches all IPv4 network traffic on the system. The data | |
83 | is output in JSON format and includes the number of packets sent | |
84 | along source IP address / destination IP address pair encountered, | |
85 | and the total number of bytes sent among the pair. | |
86 | ||
87 | # stap netfilter_summary_json.stp -c "sleep 1" | |
88 | ||
89 | ||
b9ae0bc4 FCE |
90 | process/cycle_thief.stp - Track IRQ's and Other Processes Stealing Cycles from a Task |
91 | keywords: _best process scheduler time tracepoint interrupt | |
92 | ||
93 | The cycle_thief.stp script instruments the scheduler and IRQ handler | |
94 | to determine which processes and interrupts are competing with the | |
95 | specified task for the cpu cycles. This script uses the '-c' or '-x' | |
96 | options to focus on a specific task. The script output the number of | |
97 | times the task migrates between processors, histograms showing the | |
98 | length of time on and off processor, lists of processes running while | |
99 | the task is off the processor, and the interrupts that occurred while | |
100 | the task was running. | |
101 | ||
102 | # stap cycle_thief.stp -c "sleep 1" | |
103 | ||
104 | ||
944d282f AJ |
105 | process/proctop.stp - Periodically Print Process Information With History |
106 | keywords: process scheduler _best | |
107 | ||
108 | Every 5 seconds, print out a list of 25 processes that took the most | |
109 | system time with information about the processes. Includes | |
110 | information on processes that may have exited while the script was | |
111 | running. The script contains configuration options listed in the | |
112 | script source. | |
113 | ||
114 | # stap proctop.stp -c "sleep 1" | |
115 | ||
116 | ||
b9ae0bc4 FCE |
117 | process/strace.stp - Trace system calls |
118 | keywords: _best process syscall | |
119 | ||
120 | The script loosely emulates strace, when applied to individual | |
121 | processes or hierarchies (via -c/-x), or the entire system (without | |
122 | -c/-x). A few output configuration parameters may be set with -G. | |
123 | ||
124 | # stap strace.stp -c "sleep 1" | |
125 | ||
126 | ||
127 | process/thread-business.stp - monitor syscall history | |
128 | keywords: _best process syscall | |
129 | ||
130 | Prints a periodic tabular report about the counts of syscall activity | |
131 | of all threads on the system, along with a textual | |
132 | recent-syscall-history for each | |
133 | ||
134 | # stap thread-business.stp -c "sleep 10" | |
135 | ||
136 | ||
137 | profiling/fntimes.stp - Show Functions Taking Longer Than Usual | |
138 | keywords: _best profiling | |
139 | ||
140 | The fntimes.stp script monitors the execution time history of a given | |
141 | function family (assumed non-recursive). Each time (beyond a warmup | |
142 | interval) is then compared to the historical maximum. If it exceeds | |
143 | a certain threshold (250%), a message is printed. | |
144 | ||
145 | # stap fntimes.stp 'kernel.function("sys_*")' -c "sleep 7" | |
146 | ||
147 | ||
148 | profiling/latencytap.stp - Show Reasons and Durations for Processes Sleeping | |
149 | keywords: _best profiling | |
150 | ||
151 | The latencytap.stp script collects data on the intervals processes | |
152 | are deactivated (sleeping). The script categorizes the reasons for | |
153 | the sleeps by analyzing the backtraces and displays a sorted list of | |
154 | the top 20 causes from largest total sum time sleeping to smallest. | |
155 | The output is updated every 30 seconds. The script needs to be | |
156 | compiled with the '--all-modules' option to produce reasons for | |
157 | sleeps caused by modules. Optionally, this script can be used with | |
158 | the '-c' or '-x' options to focus on a specific PID. | |
159 | ||
160 | # stap latencytap.stp --all-modules -c "sleep 1" | |
161 | ||
162 | ||
0a9d3bc8 FCE |
163 | profiling/linetimes.stp - Show Time Spent on Each Line of a Function |
164 | keywords: profiling _best | |
165 | ||
166 | The linetimes.stp script takes two arguments: where to find the | |
167 | function and the function name. linetimes.stp will instrument each | |
168 | line in the function. It will print out the number of times that the | |
169 | function is called, a table with the average and maximum time each | |
170 | line takes, and control flow information when the script exits. | |
171 | ||
172 | # stap linetimes.stp kernel sys_nanosleep -c "sleep 1" | |
173 | ||
174 | ||
b9ae0bc4 | 175 | profiling/pf4.stp - Profile Kernel/User Backtraces |
14a364c1 | 176 | keywords: _best profiling backtrace |
b9ae0bc4 FCE |
177 | |
178 | The pf4.stp script sets up time-based sampling. Every five seconds it | |
179 | prints out a sorted list with the top twenty kernel and/or user stack | |
180 | backtraces (on a per-cpu basis). Use any of --ldd, --all-modules, -d | |
181 | MODULE, -d /PATH/TO/EXEC to add more symbolic info. | |
182 | ||
183 | # stap pf4.stp -c "sleep 6" --all-modules --ldd | |
184 | ||
185 | ||
96ef4c2a FCE |
186 | profiling/thread-times.stp - Profile Kernel Functions |
187 | keywords: _best profiling | |
188 | ||
189 | The thread-times.stp script sets up time-based sampling. Every five | |
190 | seconds it prints out a sorted list with the top twenty threads | |
191 | occupying the CPUs, broken down as a percentage of user and kernel | |
192 | time. | |
193 | ||
194 | # stap thread-times.stp -c "sleep 1" | |
195 | ||
196 | ||
b9ae0bc4 FCE |
197 | stapgames/2048.stp - 2048 |
198 | keywords: _best stapgames | |
199 | ||
200 | The modern classic 2048 sliding-tiles game, using local keyboard and | |
201 | ansi animation. | |
202 | ||
203 | # stap -p4 2048.stp | |
204 | ||
205 | ||
206 | virtualization/kvm_service_time.stp - Time Statistics on KVM Exit Reasons | |
207 | keywords: _best virtualization kvm | |
208 | ||
209 | The kvm_service_time.stp script tracks the statistics about the | |
210 | amount of time that the processor left the guest virtual machine for | |
211 | each exit reason (for example fixing up a page table or handling an | |
212 | IO operation). When the script exits it prints out the number of | |
213 | times each exit reason was encountered, the total duration of time it | |
214 | left the guest VM, the minimum time, the average time, and the | |
215 | maximum time in microseconds for that exit reason. On Linux 2.6.38 | |
216 | and newer kernel the script can automatically determine whether it is | |
217 | running on Intel or AMD processors. For older kernels with a | |
218 | kernel.trace("kvm_exit") tracepoint that does not have the $isa | |
219 | parameter you can explicitly state the kvm type with a "-G kvm=intel" | |
220 | or "-G kvm=amd" on the command line. | |
221 | ||
222 | # stap kvm_service_time.stp -c "sleep 1" | |
223 | ||
224 | ||
a8a7b9f4 FCE |
225 | = AUDIT = |
226 | ||
7080b0c3 | 227 | process/auditbt.stp - Generate backtraces for kernel audit events |
a8a7b9f4 FCE |
228 | keywords: monitoring security audit backtrace |
229 | ||
7080b0c3 FCE |
230 | Attaches to the kernel audit-log paths (also used by libaudit), and |
231 | log every record being sent, along with a user-space backtrace of the | |
232 | process that caused it. | |
a8a7b9f4 | 233 | |
54a385da | 234 | # stap auditbt.stp -d /usr/bin/sudo --ldd -c "sudo true" |
a8a7b9f4 FCE |
235 | |
236 | ||
8b88e771 FCE |
237 | = AUTOFS = |
238 | ||
cf29c85e | 239 | network/autofs4.stp - Watch autofs4 Operations |
8b88e771 FCE |
240 | keywords: network autofs nfs |
241 | ||
242 | Trace key autofs4 operations such as mounting or unmounting remote | |
243 | filesystems. | |
244 | ||
6a51196c FCE |
245 | # stap autofs4.stp -c "sleep 1" |
246 | ||
8b88e771 | 247 | |
210ff7bf FCE |
248 | = BACKTRACE = |
249 | ||
cf29c85e | 250 | general/watchdog.stp - Watchdog Timer for Arbitrary Events |
2dfeb3bf WC |
251 | keywords: watchdog backtrace |
252 | ||
253 | The watchdog.stp script provides a watchdog timer mechanism for | |
254 | arbitrary events. The script takes three arguments: the events to | |
255 | start watchdog timer, the event to stop the watchdog timer, and the | |
256 | time in millseconds for the watchdog. If the watchdog timer is | |
257 | exceed, the script will trigger a stack backtrace of the user-process | |
258 | that timed out using pstack. This script can be used to diagnose what | |
259 | the userspace application is doing when a slower than expected | |
260 | operation occurs. | |
261 | ||
262 | # stap watchdog.stp 'syscall.nanosleep' 'syscall.nanosleep.return' 1000 \ | |
1f115be7 | 263 | -c "sleep 1" |
2dfeb3bf WC |
264 | |
265 | ||
cf29c85e | 266 | interrupt/scf.stp - Tally Backtraces for Inter-Processor Interrupt |
1cc8a4c7 WC |
267 | keywords: interrupt backtrace |
268 | ||
269 | The Linux kernel function smp_call_function causes expensive | |
270 | inter-processor interrupts (IPIs). The scf.stp script tallies the | |
271 | processes and backtraces causing the interprocessor interrupts to | |
272 | identify the cause of the expensive IPI. On exit the script prints | |
273 | the tallies in descending frequency. | |
274 | ||
1f115be7 | 275 | # stap scf.stp -c "sleep 1" |
6a51196c | 276 | |
1cc8a4c7 | 277 | |
210ff7bf | 278 | io/io_submit.stp - Tally Reschedule Reason During AIO io_submit Call |
09a98ae0 | 279 | keywords: io backtrace |
210ff7bf FCE |
280 | |
281 | When a reschedule occurs during an AIO io_submit call, accumulate the | |
282 | traceback in a histogram. When the script exits prints out a sorted | |
283 | list from most common to least common backtrace. | |
284 | ||
1f115be7 | 285 | # stap io_submit.stp -c "sleep 1" |
6a51196c | 286 | |
210ff7bf | 287 | |
f70a0bc5 FCE |
288 | memory/last_100_frees.stp - Log recent free(3) calls. |
289 | keywords: memory process backtrace | |
290 | ||
291 | This script reports on the last few free(3) libc calls done by | |
292 | processes (possibly restricted by stap -x/-c), along with a userspace | |
293 | backtrace at those moments. | |
294 | ||
295 | # stap last_100_frees.stp -c "stap -V" -d `which stap` --ldd | |
296 | ||
297 | ||
7080b0c3 | 298 | process/auditbt.stp - Generate backtraces for kernel audit events |
a8a7b9f4 FCE |
299 | keywords: monitoring security audit backtrace |
300 | ||
7080b0c3 FCE |
301 | Attaches to the kernel audit-log paths (also used by libaudit), and |
302 | log every record being sent, along with a user-space backtrace of the | |
303 | process that caused it. | |
a8a7b9f4 | 304 | |
54a385da | 305 | # stap auditbt.stp -d /usr/bin/sudo --ldd -c "sudo true" |
a8a7b9f4 FCE |
306 | |
307 | ||
04c36a84 MW |
308 | process/pstrace_exec.stp - Print trace of process ancestors for matching exec commands |
309 | keywords: process backtrace | |
310 | ||
311 | The pstrace_exec.stp script watches each exec operation. If the exec | |
312 | contains a substring that matches the script's command-line argument, | |
313 | it prints out that process and all of its ancestors. | |
314 | ||
1f115be7 | 315 | # stap pstrace_exec.stp -c "sleep 1" bash |
04c36a84 MW |
316 | |
317 | ||
cf29c85e | 318 | process/sleepingBeauties.stp - Generate Backtraces of Threads Waiting for IO Operations |
09a98ae0 | 319 | keywords: io scheduler backtrace |
cae71dd3 | 320 | |
f3c4da44 | 321 | The script monitors the time that threads spend in waiting for IO |
cae71dd3 FCE |
322 | operations (in "D" state) in the wait_for_completion function. If a |
323 | thread spends over 10ms, its name and backtrace is printed, and later | |
324 | so is the total delay. | |
325 | ||
1f115be7 | 326 | # stap sleepingBeauties.stp -c "sleep 1" |
6a51196c | 327 | |
cae71dd3 | 328 | |
14a364c1 FCE |
329 | profiling/pf4.stp - Profile Kernel/User Backtraces |
330 | keywords: _best profiling backtrace | |
331 | ||
332 | The pf4.stp script sets up time-based sampling. Every five seconds it | |
333 | prints out a sorted list with the top twenty kernel and/or user stack | |
334 | backtraces (on a per-cpu basis). Use any of --ldd, --all-modules, -d | |
335 | MODULE, -d /PATH/TO/EXEC to add more symbolic info. | |
336 | ||
337 | # stap pf4.stp -c "sleep 6" --all-modules --ldd | |
338 | ||
339 | ||
210ff7bf FCE |
340 | = CALLGRAPH = |
341 | ||
81a1a9e8 FCE |
342 | general/callgraph.stp - Callgraph Tracing |
343 | keywords: simple trace callgraph | |
344 | ||
345 | Print a timed per-thread microsecond-timed nested callgraph. The | |
346 | first parameter names the function probe points to trace. | |
347 | ||
348 | # stap callgraph.stp 'kernel.function("*@fs/proc*.c")' -c "cat \ | |
349 | /proc/sys/vm/* || true" | |
350 | ||
351 | ||
cf29c85e | 352 | general/para-callgraph-verbose.stp - Callgraph Tracing with Verbose Arguments |
2515d897 JS |
353 | keywords: trace callgraph |
354 | ||
03568589 FCE |
355 | Print a timed per-thread microsecond-timed callgraph, complete with |
356 | pretty-printed function parameters and return values. The first | |
357 | parameter names the function probe points to trace. The optional | |
358 | second parameter names the probe points for trigger functions, which | |
359 | acts to enable tracing for only those functions that occur while the | |
360 | current thread is nested within the trigger. | |
2515d897 | 361 | |
6a51196c | 362 | # stap para-callgraph-verbose.stp 'kernel.function("*@fs/proc*.c")' \ |
15ecb1fe | 363 | 'kernel.function("vfs_read")' -c "cat /proc/sys/vm/* || true" |
6a51196c | 364 | |
2515d897 | 365 | |
cf29c85e | 366 | general/para-callgraph.stp - Callgraph Tracing with Arguments |
b9ae0bc4 | 367 | keywords: _best trace callgraph |
210ff7bf | 368 | |
03568589 FCE |
369 | Print a timed per-thread microsecond-timed callgraph, complete with |
370 | function parameters and return values. The first parameter names the | |
371 | function probe points to trace. The optional second parameter names | |
372 | the probe points for trigger functions, which acts to enable tracing | |
373 | for only those functions that occur while the current thread is | |
374 | nested within the trigger. | |
210ff7bf | 375 | |
6a51196c | 376 | # stap para-callgraph.stp 'kernel.function("*@fs/proc*.c")' \ |
15ecb1fe | 377 | 'kernel.function("vfs_read")' -c "cat /proc/sys/vm/* || true" |
6a51196c | 378 | |
210ff7bf FCE |
379 | |
380 | = CPU = | |
381 | ||
382 | general/graphs.stp - Graphing Disk and CPU Utilization | |
cf29c85e | 383 | keywords: disk cpu utilization |
210ff7bf FCE |
384 | |
385 | The script tracks the disk and CPU utilization. The resulting output | |
386 | of the script can be piped into gnuplot to generate a graph of disk | |
387 | and CPU USE. | |
388 | ||
1f115be7 | 389 | # stap graphs.stp -c "sleep 1" |
6a51196c | 390 | |
210ff7bf | 391 | |
53e5699f JS |
392 | = DEVICE = |
393 | ||
394 | network/netdev.stp - Trace Activity on Network Devices | |
395 | keywords: network device traffic | |
396 | ||
397 | The netdev.stp script traces configuration and transmit/receive | |
398 | activity on network devices. | |
399 | ||
1f115be7 | 400 | # stap netdev.stp -c "sleep 1" |
6a51196c | 401 | |
53e5699f | 402 | |
9e749e50 JS |
403 | = DIAGRAM = |
404 | ||
405 | process/pstree.stp - Generates a process diagram in DOT form. | |
406 | keywords: process diagram | |
407 | ||
408 | The pstree.stp script generates a process diagram in DOT form. For | |
409 | instance, it may be useful on a 'make' command to see all the | |
410 | processes that are started. | |
411 | ||
1f115be7 | 412 | # stap pstree.stp -c "sleep 1" |
9e749e50 JS |
413 | |
414 | ||
210ff7bf FCE |
415 | = DISK = |
416 | ||
417 | general/graphs.stp - Graphing Disk and CPU Utilization | |
cf29c85e | 418 | keywords: disk cpu utilization |
210ff7bf FCE |
419 | |
420 | The script tracks the disk and CPU utilization. The resulting output | |
421 | of the script can be piped into gnuplot to generate a graph of disk | |
422 | and CPU USE. | |
423 | ||
1f115be7 | 424 | # stap graphs.stp -c "sleep 1" |
6a51196c | 425 | |
210ff7bf | 426 | |
b96bcce8 WC |
427 | io/deviceseeks.stp - Histograms of Seek Behavior for Each Device |
428 | keywords: disk | |
429 | ||
430 | The deviceseeks.stp script generates a histogram showing the | |
875e1b27 | 431 | frequency of different sized seeks (in sectors) on each device. |
b96bcce8 | 432 | |
1f115be7 | 433 | # stap deviceseeks.stp -c "sleep 1" |
6a51196c | 434 | |
b96bcce8 | 435 | |
210ff7bf | 436 | io/disktop.stp - Summarize Disk Read/Write Traffic |
09a98ae0 | 437 | keywords: disk |
210ff7bf FCE |
438 | |
439 | Get the status of reading/writing disk every 5 seconds, output top | |
440 | ten entries during that period. | |
441 | ||
1f115be7 | 442 | # stap disktop.stp -c "sleep 1" |
6a51196c | 443 | |
210ff7bf | 444 | |
7fcecf19 MW |
445 | io/enospc.stp - Report an disk out-of-space condition. |
446 | keywords: disk filesystem | |
447 | ||
448 | This script monitors a filesystem implementations for early internal | |
449 | indications of ENOSPC, and reports these to the system logger and the | |
450 | systemtap console. | |
451 | ||
1f115be7 | 452 | # stap enospc.stp -c "sleep 1" |
7fcecf19 MW |
453 | |
454 | ||
cf29c85e | 455 | io/mbrwatch.stp - Monitor Read/Write of the Boot Sector Area of Block Devices |
74e5c5cf FCE |
456 | keywords: io monitoring disk |
457 | ||
458 | The mbrwatch.stp script reports any attempted reads/writes of the | |
459 | first few sectors of a raw block device. | |
460 | ||
461 | # stap mbrwatch.stp -c "dd of=/dev/null count=1 if=/dev/`grep -v major \ | |
199197b8 FCE |
462 | /proc/partitions | grep . | grep -v 'sr[0-9]' | awk '{print $4}' | \ |
463 | head -1`" | |
74e5c5cf FCE |
464 | |
465 | ||
cf29c85e | 466 | network/nfsd_unlink.stp - Find Which Client Is Removing NFS Files on Server |
b7edd338 WC |
467 | keywords: nfs disk |
468 | ||
469 | The nfsd_unlink.stp script lists the ip address and file name each | |
470 | time time a file is being removed or unlinked by the nfsd. This | |
471 | script is run on the nfs server. | |
472 | ||
1f115be7 | 473 | # stap nfsd_unlink.stp -c "sleep 1" |
b7edd338 WC |
474 | |
475 | ||
cf29c85e | 476 | = FILE = |
db5bfb14 | 477 | |
cf29c85e FCE |
478 | io/iotime.stp - Trace Time Spent in Read and Write for Files |
479 | keywords: profiling syscall io file | |
db5bfb14 | 480 | |
cf29c85e FCE |
481 | The script watches each open, close, read, and write syscalls on the |
482 | system. For each file the scripts observes opened it accumulates the | |
483 | amount of wall clock time spent in read and write operations and the | |
484 | number of bytes read and written. When a file is closed the script | |
485 | prints out a pair of lines for the file. Both lines begin with a | |
486 | timestamp in microseconds, the PID number, and the executable name in | |
487 | parentheses. The first line with the "access" keyword lists the file | |
488 | name, the attempted number of bytes for the read and write | |
489 | operations. The second line with the "iotime" keyword list the file | |
490 | name and the number of microseconds accumulated in the read and write | |
491 | syscalls. | |
db5bfb14 | 492 | |
1f115be7 | 493 | # stap iotime.stp -c "sleep 1" |
db5bfb14 | 494 | |
ecf33ff4 | 495 | |
cf29c85e FCE |
496 | process/pfiles.stp - Print Process File Descriptors |
497 | keywords: process file | |
ecf33ff4 ET |
498 | |
499 | Run pfiles.stp to produce a human-readable summary of all open file | |
500 | descriptors of a given process. Specify the process-id as -x PID for | |
501 | fastest performance. | |
502 | ||
6a51196c FCE |
503 | # stap -g pfiles.stp -x $$ |
504 | ||
ecf33ff4 | 505 | |
ac505f97 JS |
506 | = FILESYSTEM = |
507 | ||
508 | general/badname.stp - Bad Filename Filter | |
1ca36a99 | 509 | keywords: filesystem guru |
ac505f97 JS |
510 | |
511 | The badname.stp script shows how one could prevent the creation of | |
6287a9e6 | 512 | files with undesirable names using guru mode. |
ac505f97 | 513 | |
15ecb1fe FCE |
514 | # stap -g badname.stp -c "touch /tmp/myXXXbadnameXXXfile.$$ 2>&1 | grep \ |
515 | denied" | |
6a51196c | 516 | |
ac505f97 | 517 | |
7fcecf19 MW |
518 | io/enospc.stp - Report an disk out-of-space condition. |
519 | keywords: disk filesystem | |
520 | ||
521 | This script monitors a filesystem implementations for early internal | |
522 | indications of ENOSPC, and reports these to the system logger and the | |
523 | systemtap console. | |
524 | ||
1f115be7 | 525 | # stap enospc.stp -c "sleep 1" |
7fcecf19 MW |
526 | |
527 | ||
0e81b7f5 FCE |
528 | lwtools/fslatency-nd.stp - Measure the distribution of file system synchronous read and write latency (non-debuginfo) |
529 | keywords: io filesystem | |
530 | ||
531 | This dynamically traces two common file system functions: | |
532 | do_sync_read() and do_sync_write(), and reports a histogram | |
533 | distribution of latency. Many, but not all, file systems and | |
534 | workloads use these functions. Tracing their time provides one view | |
535 | of suffered file system latency. | |
536 | ||
537 | # stap fslatency-nd.stp 1 1 | |
538 | ||
539 | ||
540 | lwtools/fsslower-nd.stp - Trace slow file system synchronous reads and writes (non-debuginfo) | |
541 | keywords: io filesystem | |
542 | ||
543 | This dynamically traces two common file system functions: | |
544 | do_sync_read() and do_sync_write(), and shows details of each call | |
545 | that is slower than a threshold. Many, but not all, file systems and | |
546 | workloads use these functions. Tracing their time provides one view | |
547 | of suffered file system latency. | |
548 | ||
549 | # stap fsslower-nd.stp -c "sleep 1" | |
550 | ||
551 | ||
0e0b566a WC |
552 | = FORMAT = |
553 | ||
554 | general/ansi_colors.stp - Color Table for ansi_set_color2() and ansi_set_color3() | |
555 | keywords: format | |
556 | ||
557 | The script prints a table showing the available color combinations | |
558 | for the ansi_set_color2() and ans_set_color3() functions in the | |
559 | ansi.stp tapset. | |
560 | ||
6a51196c FCE |
561 | # stap ansi_colors.stp |
562 | ||
0e0b566a WC |
563 | |
564 | general/ansi_colors2.stp - Show Attribues in Table for ansi_set_color3() | |
565 | keywords: format | |
566 | ||
567 | The script prints a table showing the available attributes (bold, | |
568 | underline, and inverse) with color combinations for the | |
569 | ans_set_color3() function in the ansi.stp tapset. | |
570 | ||
6a51196c FCE |
571 | # stap ansi_colors2.stp |
572 | ||
0e0b566a | 573 | |
fce7a922 WC |
574 | = FUNCTION = |
575 | ||
cf29c85e FCE |
576 | general/func_time_stats.stp - Function Time Statistics |
577 | keywords: function statistics | |
fce7a922 WC |
578 | |
579 | The func_time_stats.stp script tracks the wall clock time for each | |
580 | invocation of the function probe listed as the first command line | |
581 | argument. When the script exits it prints out the minimum, average, | |
582 | and maximum times in microseconds followed by a count of times that | |
583 | the function was called and a histogram showing the distributions of | |
584 | times. | |
585 | ||
1f115be7 | 586 | # stap func_time_stats.stp 'syscall.nanosleep' -c "sleep 1" |
fce7a922 WC |
587 | |
588 | ||
75ed3b3c FCE |
589 | general/whythefail.stp - Why did the function fail? |
590 | keywords: speculation monitoring function trace _best | |
591 | ||
592 | The whythefail.stp script prints a statement-execution trace for a | |
593 | given function, but only for those runs of the function that ended up | |
594 | with a (configurable) post-return condition. | |
595 | ||
596 | # stap whythefail.stp kernel sys_open '$return < 0' -c 'cat \ | |
597 | /root/no-such-file || true' | |
598 | ||
599 | ||
cf29c85e FCE |
600 | profiling/functioncallcount.stp - Count Times Functions Are Called |
601 | keywords: profiling function | |
210ff7bf FCE |
602 | |
603 | The functioncallcount.stp script takes one argument, a list of | |
604 | functions to probe. The script will run and count the number of times | |
605 | that each of the functions on the list is called. On exit the script | |
606 | will print a sorted list from most frequently to least frequently | |
607 | called function. | |
608 | ||
ca5d5a88 | 609 | # stap -w functioncallcount.stp "*@mm/*.c" -c "sleep 1" |
6a51196c | 610 | |
210ff7bf | 611 | |
cf29c85e FCE |
612 | profiling/sched_switch.stp - Display the Task Switches Happening in the Scheduler |
613 | keywords: profiling function | |
0449af03 JS |
614 | |
615 | The sched_switch.stp script takes two arguments, first argument can | |
616 | be "pid" or "name" to indicate what is being passed as second | |
617 | argument. The script will trace the process based on pid/name and | |
618 | print the scheduler switches happening with the process. If no | |
619 | arguments are passed, it displays all the scheduler switches. This | |
620 | can be used to understand which tasks schedule out the current | |
621 | process being traced, and when it gets scheduled in again. | |
622 | ||
6a51196c FCE |
623 | # stap sched_switch.stp -c "sleep 1" |
624 | ||
0449af03 | 625 | |
210ff7bf FCE |
626 | = FUTEX = |
627 | ||
628 | process/futexes.stp - System-Wide Futex Contention | |
09a98ae0 | 629 | keywords: syscall locking futex |
210ff7bf FCE |
630 | |
631 | The script watches the futex syscall on the system. On exit the | |
0fb74e68 | 632 | futex's address, the number of contentions, and the average time for |
210ff7bf FCE |
633 | each contention on the futex are printed from lowest pid number to |
634 | highest. | |
635 | ||
1f115be7 | 636 | # stap futexes.stp -c "sleep 1" |
6a51196c | 637 | |
210ff7bf | 638 | |
0fb74e68 JS |
639 | process/futexes2.stp - System-Wide Shared Futex Contention |
640 | keywords: syscall locking futex | |
641 | ||
642 | The script watches just shared futex syscalls on the system. On exit | |
643 | the futex's key, the number of contentions, and the average time for | |
644 | each contention on the futex are printed from lowest pid number to | |
645 | highest. | |
646 | ||
1f115be7 | 647 | # stap futexes2.stp -c "sleep 1" |
0fb74e68 JS |
648 | |
649 | ||
1ca36a99 FCE |
650 | = GURU = |
651 | ||
652 | general/badname.stp - Bad Filename Filter | |
653 | keywords: filesystem guru | |
654 | ||
655 | The badname.stp script shows how one could prevent the creation of | |
656 | files with undesirable names using guru mode. | |
657 | ||
658 | # stap -g badname.stp -c "touch /tmp/myXXXbadnameXXXfile.$$ 2>&1 | grep \ | |
659 | denied" | |
660 | ||
661 | ||
47300c64 | 662 | io/eatmydata.stp - disable fsync |
1ca36a99 FCE |
663 | keywords: io guru simple |
664 | ||
665 | Suppresses fsync() syscalls from processes identified by stap -c/-x | |
00b943ad FCE |
666 | by turning them into presumed-faster fsync() on some dummy or other |
667 | file descriptor | |
1ca36a99 FCE |
668 | |
669 | # stap -g eatmydata.stp -c 'strace ls || true' | |
670 | ||
671 | ||
672 | io/ttyspy.stp - Monitor TTY Typing | |
673 | keywords: io tty monitoring guru | |
674 | ||
675 | The ttyspy.stp script uses tty_audit hooks to monitor recent typing | |
676 | activity on the system, printing a scrolling record of recent | |
677 | keystrokes, on a per-tty basis. | |
678 | ||
679 | # stap --skip-badvars -g ttyspy.stp -c "sleep 1" | |
680 | ||
681 | ||
682 | network/netfilter_drop.stp - System-Wide Network Packet Dropping Tool | |
683 | keywords: network packets guru | |
684 | ||
685 | The script drops the specified number of packets of the specified | |
686 | protocol. Valid protocols are TCP, UDP, or ALL. If ALL is specified, | |
687 | all incoming packets are dropped. The number of packets to drop can | |
688 | be specified with a positive integer. A value of 0 indicates that | |
689 | packets should be dropped until the user manually exits. | |
690 | ||
691 | # stap -g netfilter_drop.stp TCP 1 -c "sleep 2" | |
692 | ||
693 | ||
694 | network/tcp_init_cwnd.stp - Increase Initial TCP Congestion Window to 10 | |
695 | keywords: network tcp socket guru | |
696 | ||
697 | Run the tcp_init_cwnd.stp script in the background to override a | |
698 | kernel's default tcp cwnd value to 10, which has been found to | |
699 | improve latency for web server type workloads. The script prints a | |
700 | count of cwnd value changes when it is stopped. | |
701 | ||
1f115be7 | 702 | # stap -g tcp_init_cwnd.stp -c "sleep 1" |
1ca36a99 FCE |
703 | |
704 | ||
705 | process/noptrace.stp - Disable ptrace from Hierarchies of Processes | |
706 | keywords: process security guru | |
707 | ||
708 | Blocks ptrace(2) attempts from processes identified by stap -c/-x, as | |
709 | also specifiable from /proc/systemtap/stap_XXX/ control files. | |
710 | Processes may be added or removed from the blocked list. | |
711 | ||
712 | # stap -g noptrace.stp -c 'strace ls || true' | |
713 | ||
714 | ||
715 | process/threadstacks.stp - Override default new-pthread stack sizes | |
716 | keywords: thread guru | |
717 | ||
718 | Overrides default NPTL pthread_create stack size for all new threads | |
719 | created by target processes. Reports one line per process when the | |
720 | related glibc variable __default_stacksize is updated. Moot for | |
721 | glibc versions that support $LIBC_PTHREAD_DEFAULT_STACKSIZE_NP. | |
722 | ||
f70a0bc5 | 723 | # stap -g threadstacks.stp -Gsize=65536 -c "sleep 1" -d `which stap` |
1ca36a99 FCE |
724 | |
725 | ||
0c0aaff5 FCE |
726 | security-band-aids/cve-2008-0600.stp - cve-2008-0600 security band-aid |
727 | keywords: security guru | |
728 | ||
729 | historical emergency security band-aid, for reference/education only | |
730 | ||
0c0aaff5 FCE |
731 | |
732 | security-band-aids/cve-2012-0056.stp - cve-2012-0056 security band-aid | |
733 | keywords: security guru | |
734 | ||
735 | historical emergency security band-aid, for reference/education only | |
736 | ||
0c0aaff5 FCE |
737 | |
738 | security-band-aids/cve-2013-2094.stp - cve-2013-2094 security band-aid | |
739 | keywords: security guru | |
740 | ||
741 | historical emergency security band-aid, for reference/education only | |
742 | ||
0c0aaff5 FCE |
743 | |
744 | security-band-aids/cve-2014-7169.stp - cve-2014-7169 security band-aid | |
745 | keywords: security guru | |
746 | ||
747 | historical emergency security band-aid, for reference/education only | |
748 | ||
0c0aaff5 FCE |
749 | |
750 | security-band-aids/cve-2015-0235.stp - cve-2015-0235 security band-aid | |
751 | keywords: security guru | |
752 | ||
753 | historical emergency security band-aid, for reference/education only | |
754 | ||
0c0aaff5 FCE |
755 | |
756 | security-band-aids/cve-2015-3456.stp - cve-2015-3456 security band-aid | |
757 | keywords: security guru | |
758 | ||
759 | historical emergency security band-aid, for reference/education only | |
760 | ||
0c0aaff5 | 761 | |
6a3b8027 FCE |
762 | security-band-aids/cve-2015-7547.stp - cve-2015-7547 security band-aid |
763 | keywords: security guru | |
764 | ||
765 | historical emergency security band-aid, for reference/education only | |
766 | ||
767 | ||
0c0aaff5 FCE |
768 | security-band-aids/cve-2016-0728.stp - cve-2016-0728 security band-aid |
769 | keywords: security guru | |
770 | ||
771 | historical emergency security band-aid, for reference/education only | |
772 | ||
0c0aaff5 | 773 | |
1cc8a4c7 WC |
774 | = INTERRUPT = |
775 | ||
cf29c85e | 776 | interrupt/interrupts-by-dev.stp - Record Interrupts on a Per-Device Basis |
6b95efe9 JS |
777 | keywords: interrupt |
778 | ||
779 | The interrupts-by-dev.stp script profiles interrupts received by each | |
780 | device per 100 ms. | |
781 | ||
1f115be7 | 782 | # stap interrupts-by-dev.stp -c "sleep 1" |
6a51196c | 783 | |
6b95efe9 | 784 | |
cf29c85e | 785 | interrupt/scf.stp - Tally Backtraces for Inter-Processor Interrupt |
1cc8a4c7 WC |
786 | keywords: interrupt backtrace |
787 | ||
788 | The Linux kernel function smp_call_function causes expensive | |
789 | inter-processor interrupts (IPIs). The scf.stp script tallies the | |
790 | processes and backtraces causing the interprocessor interrupts to | |
791 | identify the cause of the expensive IPI. On exit the script prints | |
792 | the tallies in descending frequency. | |
793 | ||
1f115be7 | 794 | # stap scf.stp -c "sleep 1" |
6a51196c | 795 | |
1cc8a4c7 | 796 | |
cf29c85e | 797 | process/cycle_thief.stp - Track IRQ's and Other Processes Stealing Cycles from a Task |
b9ae0bc4 | 798 | keywords: _best process scheduler time tracepoint interrupt |
e01bc08e WC |
799 | |
800 | The cycle_thief.stp script instruments the scheduler and IRQ handler | |
801 | to determine which processes and interrupts are competing with the | |
802 | specified task for the cpu cycles. This script uses the '-c' or '-x' | |
803 | options to focus on a specific task. The script output the number of | |
804 | times the task migrates between processors, histograms showing the | |
805 | length of time on and off processor, lists of processes running while | |
806 | the task is off the processor, and the interrupts that occurred while | |
807 | the task was running. | |
808 | ||
1f115be7 | 809 | # stap cycle_thief.stp -c "sleep 1" |
6a51196c | 810 | |
e01bc08e | 811 | |
210ff7bf FCE |
812 | = IO = |
813 | ||
beb59e38 FCE |
814 | general/alias_suffixes.stp - Count I/O Syscalls using Alias Suffixes |
815 | keywords: io statistics | |
816 | ||
817 | alias_suffixes.stp is a demonstration of how alias suffixes in the | |
818 | systemtap language might be used. The script tracks the wall clock | |
819 | time for each invocation of the system calls open, close, read, and | |
820 | write. When the script exists it prints out the minimum, average, and | |
821 | maximum times in microseconds for each system call, followed by a | |
822 | count of times that each syscall was invoked and a histogram showing | |
823 | the distributions of times. | |
824 | ||
1f115be7 | 825 | # stap alias_suffixes.stp -c "sleep 1" |
beb59e38 FCE |
826 | |
827 | ||
47300c64 | 828 | io/eatmydata.stp - disable fsync |
1ca36a99 FCE |
829 | keywords: io guru simple |
830 | ||
831 | Suppresses fsync() syscalls from processes identified by stap -c/-x | |
00b943ad FCE |
832 | by turning them into presumed-faster fsync() on some dummy or other |
833 | file descriptor | |
1ca36a99 FCE |
834 | |
835 | # stap -g eatmydata.stp -c 'strace ls || true' | |
836 | ||
837 | ||
d8878d94 WC |
838 | io/inodewatch.stp - Monitoring Reads and Writes to a File |
839 | keywords: io | |
840 | ||
841 | The inodewatch.stp outputs the executable name and process id each | |
842 | time a read or write occurs to the specified inode on the specified | |
843 | major/minor device. | |
844 | ||
1f115be7 | 845 | # stap inodewatch.stp 0x08 0x01 100 -c "sleep 1" |
6a51196c | 846 | |
d8878d94 | 847 | |
7ad79dbe WC |
848 | io/inodewatch2.stp - Monitoring Attribute Changes to a File |
849 | keywords: io | |
850 | ||
851 | The inodewatch2.stp script outputs the executable name, process id, | |
852 | and attributes each time the attributes are changed on the specified | |
853 | inode on the specified major/minor device. | |
854 | ||
1f115be7 | 855 | # stap inodewatch2.stp 0x08 0x01 100 -c "sleep 1" |
6a51196c | 856 | |
7ad79dbe | 857 | |
210ff7bf | 858 | io/io_submit.stp - Tally Reschedule Reason During AIO io_submit Call |
09a98ae0 | 859 | keywords: io backtrace |
210ff7bf FCE |
860 | |
861 | When a reschedule occurs during an AIO io_submit call, accumulate the | |
862 | traceback in a histogram. When the script exits prints out a sorted | |
863 | list from most common to least common backtrace. | |
864 | ||
1f115be7 | 865 | # stap io_submit.stp -c "sleep 1" |
6a51196c | 866 | |
210ff7bf | 867 | |
67f8611b WC |
868 | io/ioblktime.stp - Average Time Block IO Requests Spend in Queue |
869 | keywords: io | |
870 | ||
871 | The ioblktime.stp script tracks the amount of time that each block IO | |
cc20d853 | 872 | requests spend waiting for completion. The script computes the |
f3c4da44 MW |
873 | average waiting time for block IO per device and prints list every 10 |
874 | seconds. In some cases there can be too many outstanding block IO | |
875 | operations and the script may exceed the default number of | |
67f8611b WC |
876 | MAXMAPENTRIES allowed. In this case the allowed number can be |
877 | increased with "-DMAXMAPENTRIES=10000" option on the stap command | |
878 | line. | |
879 | ||
1f115be7 | 880 | # stap ioblktime.stp -c "sleep 1" |
6a51196c | 881 | |
67f8611b | 882 | |
a4f3198f WC |
883 | io/iodevstats.stp - List Executables Reading and Writing the Most Data by Device |
884 | keywords: io profiling | |
885 | ||
886 | The iodevstats.stp script measures the amount of data successfully | |
887 | read and written by all the executables for each io device on the | |
888 | system. The output is sorted from greatest sum of bytes read and | |
889 | written to a device by an executable to the least. The output | |
890 | contains device major/minor number, the count of operations (reads | |
891 | and writes), the totals and averages for the number of bytes read and | |
892 | written. | |
893 | ||
1f115be7 | 894 | # stap iodevstats.stp -c "sleep 1" |
6a51196c | 895 | |
a4f3198f | 896 | |
cf29c85e | 897 | io/iostat-scsi.stp - IO Statistics for SCSI Devices |
54ff5e0c FCE |
898 | keywords: io profiling scsi |
899 | ||
900 | The iostat-scsi.stp script provides a breakdown of the number of blks | |
ad7e33d7 | 901 | read and written on the machine's various SCSI devices. The script |
54ff5e0c FCE |
902 | takes one argument which is the number of seconds between reports. |
903 | ||
1f115be7 | 904 | # stap -g iostat-scsi.stp 1 -c "sleep 1" |
6a51196c | 905 | |
54ff5e0c | 906 | |
3e4444ed WC |
907 | io/iostats.stp - List Executables Reading and Writing the Most Data |
908 | keywords: io profiling | |
909 | ||
910 | The iostat.stp script measures the amount of data successfully read | |
911 | and written by all the executables on the system. The output is | |
912 | sorted from most greatest sum of bytes read and written by an | |
913 | executable to the least. The output contains the count of operations | |
914 | (opens, reads, and writes), the totals and averages for the number of | |
915 | bytes read and written. | |
916 | ||
1f115be7 | 917 | # stap iostats.stp -c "sleep 1" |
6a51196c | 918 | |
3e4444ed | 919 | |
210ff7bf | 920 | io/iotime.stp - Trace Time Spent in Read and Write for Files |
cf29c85e | 921 | keywords: profiling syscall io file |
210ff7bf FCE |
922 | |
923 | The script watches each open, close, read, and write syscalls on the | |
924 | system. For each file the scripts observes opened it accumulates the | |
f3c4da44 | 925 | amount of wall clock time spent in read and write operations and the |
210ff7bf FCE |
926 | number of bytes read and written. When a file is closed the script |
927 | prints out a pair of lines for the file. Both lines begin with a | |
928 | timestamp in microseconds, the PID number, and the executable name in | |
ad7e33d7 | 929 | parentheses. The first line with the "access" keyword lists the file |
210ff7bf FCE |
930 | name, the attempted number of bytes for the read and write |
931 | operations. The second line with the "iotime" keyword list the file | |
932 | name and the number of microseconds accumulated in the read and write | |
933 | syscalls. | |
934 | ||
1f115be7 | 935 | # stap iotime.stp -c "sleep 1" |
6a51196c | 936 | |
210ff7bf | 937 | |
cf29c85e | 938 | io/iotop.stp - Periodically Print IO Activity by Process Name |
09a98ae0 | 939 | keywords: io |
210ff7bf FCE |
940 | |
941 | Every five seconds print out the top ten executables generating I/O | |
942 | traffic during that interval sorted in descending order. | |
943 | ||
1f115be7 | 944 | # stap iotop.stp -c "sleep 1" |
6a51196c | 945 | |
210ff7bf | 946 | |
cf29c85e | 947 | io/mbrwatch.stp - Monitor Read/Write of the Boot Sector Area of Block Devices |
74e5c5cf | 948 | keywords: io monitoring disk |
1beb5089 FCE |
949 | |
950 | The mbrwatch.stp script reports any attempted reads/writes of the | |
951 | first few sectors of a raw block device. | |
952 | ||
6a51196c | 953 | # stap mbrwatch.stp -c "dd of=/dev/null count=1 if=/dev/`grep -v major \ |
199197b8 FCE |
954 | /proc/partitions | grep . | grep -v 'sr[0-9]' | awk '{print $4}' | \ |
955 | head -1`" | |
6a51196c | 956 | |
1beb5089 | 957 | |
111dd9ac WC |
958 | io/nfs_func_users.stp - Tally the Number of NFS Functions Used by Each Process |
959 | keywords: io profiling | |
960 | ||
961 | The nfs_func_users.stp script counts the uses of NFS functions in the | |
962 | kernel on a per process bases. The output is sorted from the process | |
963 | with the greatest number of NFS functions called to the least. The | |
964 | output contains the executable name, the process number, and the | |
965 | total number of NFS functions called by the process. | |
966 | ||
1f115be7 | 967 | # stap nfs_func_users.stp -c "sleep 1" |
6a51196c | 968 | |
111dd9ac | 969 | |
a11f34b0 FCE |
970 | io/slowvfs.stp - Trace slow vfs opens. |
971 | keywords: io | |
972 | ||
973 | This script prints a line for every kernel vfs_open operation that | |
974 | takes longer than a configurable number of microseconds. Highly | |
975 | contended or remote filesystems are likelier to hit this. | |
976 | ||
977 | # stap slowvfs.stp -G sloth=10 -c 'find /proc >/dev/null' | |
978 | ||
979 | ||
980 | io/switchfile.stp - Switch log files | |
981 | keywords: io | |
982 | ||
983 | Every second print a log message and switch log files every 5 | |
984 | seconds. | |
985 | ||
986 | # stap -o switchfile.stp.out switchfile.stp -c "sleep 8" | |
987 | ||
988 | ||
cf29c85e | 989 | io/traceio.stp - Track Cumulative IO Activity by Process Name |
09a98ae0 | 990 | keywords: io |
210ff7bf FCE |
991 | |
992 | Every second print out the top ten executables sorted in descending | |
993 | order based on cumulative I/O traffic observed. | |
994 | ||
1f115be7 | 995 | # stap traceio.stp -c "sleep 1" |
6a51196c | 996 | |
210ff7bf | 997 | |
cf29c85e | 998 | io/traceio2.stp - Watch IO Activity on a Particular Device |
09a98ae0 | 999 | keywords: io |
210ff7bf FCE |
1000 | |
1001 | Print out the executable name and process number as reads and writes | |
1002 | to the specified device occur. | |
1003 | ||
1f115be7 | 1004 | # stap traceio2.stp 0x0801 -c "sleep 1" |
6a51196c | 1005 | |
210ff7bf | 1006 | |
cf29c85e | 1007 | io/ttyspy.stp - Monitor TTY Typing |
1ca36a99 | 1008 | keywords: io tty monitoring guru |
b7f6cfc5 FCE |
1009 | |
1010 | The ttyspy.stp script uses tty_audit hooks to monitor recent typing | |
1011 | activity on the system, printing a scrolling record of recent | |
1012 | keystrokes, on a per-tty basis. | |
1013 | ||
6a51196c FCE |
1014 | # stap --skip-badvars -g ttyspy.stp -c "sleep 1" |
1015 | ||
b7f6cfc5 | 1016 | |
0e81b7f5 FCE |
1017 | lwtools/biolatency-nd.stp - Measure block I/O latency distribution (non-debuginfo) |
1018 | keywords: io | |
1019 | ||
1020 | This measures block I/O latency (storage I/O, ie, disk I/O), and | |
1021 | shows the distribution as a histogram. This can be useful to identify | |
1022 | the characteristics of I/O latency, beyond the averages shown by | |
1023 | iostat(1). For example, to study I/O latency outliers, or multi-modal | |
1024 | distributions. | |
1025 | ||
1026 | # stap biolatency-nd.stp 1 1 | |
1027 | ||
1028 | ||
1029 | lwtools/bitesize-nd.stp - Measure block I/O size distribution (non-debuginfo) | |
1030 | keywords: io | |
1031 | ||
1032 | This uses the kernel tracepoint block_rq_insert to read the size of | |
1033 | I/O. The output includes the name of the process or thread that was | |
1034 | on-CPU when the I/O request was inserted on the issue queue. | |
1035 | ||
1036 | # stap bitesize-nd.stp -c "sleep 1" | |
1037 | ||
1038 | ||
1039 | lwtools/execsnoop-nd.stp - Trace process exec() with command line argument details (non-debuginfo) | |
1040 | keywords: io | |
1041 | ||
1042 | This can identify if CPU is consumed by short-lived processes, by | |
1043 | tracing new process execution. It works by tracing exec() from the | |
1044 | fork()->exec() sequence, which means it will not catch new processes | |
1045 | that only fork(). It will also show every exec(), including those if | |
1046 | a process re-execs. | |
1047 | ||
1048 | # stap execsnoop-nd.stp -c "sleep 1" | |
1049 | ||
1050 | ||
1051 | lwtools/fslatency-nd.stp - Measure the distribution of file system synchronous read and write latency (non-debuginfo) | |
1052 | keywords: io filesystem | |
1053 | ||
1054 | This dynamically traces two common file system functions: | |
1055 | do_sync_read() and do_sync_write(), and reports a histogram | |
1056 | distribution of latency. Many, but not all, file systems and | |
1057 | workloads use these functions. Tracing their time provides one view | |
1058 | of suffered file system latency. | |
1059 | ||
1060 | # stap fslatency-nd.stp 1 1 | |
1061 | ||
1062 | ||
1063 | lwtools/fsslower-nd.stp - Trace slow file system synchronous reads and writes (non-debuginfo) | |
1064 | keywords: io filesystem | |
1065 | ||
1066 | This dynamically traces two common file system functions: | |
1067 | do_sync_read() and do_sync_write(), and shows details of each call | |
1068 | that is slower than a threshold. Many, but not all, file systems and | |
1069 | workloads use these functions. Tracing their time provides one view | |
1070 | of suffered file system latency. | |
1071 | ||
1072 | # stap fsslower-nd.stp -c "sleep 1" | |
1073 | ||
1074 | ||
1075 | lwtools/killsnoop-nd.stp - Trace kill() signals showing process and signal details (non-debuginfo) | |
1076 | keywords: io | |
1077 | ||
1078 | This traces signals system-wide, including those sent by the kill(1) | |
1079 | command, and shows various details. | |
1080 | ||
1081 | # stap killsnoop-nd.stp -c "sleep 1" | |
1082 | ||
1083 | ||
1084 | lwtools/opensnoop-nd.stp - Trace open() syscalls showing filenames (non-debuginfo) | |
1085 | keywords: io | |
1086 | ||
1087 | This traces the open() syscall system-wide, to show which files are | |
1088 | being opened, and by who. | |
1089 | ||
1090 | # stap opensnoop-nd.stp -c "sleep 1" | |
1091 | ||
1092 | ||
1093 | lwtools/rwtime-nd.stp - Summarize read() and write() syscall latency (non-debuginfo) | |
1094 | keywords: io | |
1095 | ||
1096 | This traces read() and write() syscalls, producing a histogram | |
1097 | summary of their durations (aka latencies). | |
1098 | ||
1099 | # stap rwtime-nd.stp -c "sleep 1" | |
1100 | ||
1101 | ||
1102 | lwtools/syscallbypid-nd.stp - Count syscalls with process details (non-debuginfo) | |
1103 | keywords: io | |
1104 | ||
1105 | This traces syscalls system-wide, and produces a summary report | |
1106 | showing their counts by process ID, process name, and syscall types. | |
1107 | ||
1108 | # stap syscallbypid-nd.stp -c "sleep 1" | |
1109 | ||
1110 | ||
cf29c85e | 1111 | process/sleepingBeauties.stp - Generate Backtraces of Threads Waiting for IO Operations |
09a98ae0 | 1112 | keywords: io scheduler backtrace |
210ff7bf | 1113 | |
f3c4da44 | 1114 | The script monitors the time that threads spend in waiting for IO |
cae71dd3 FCE |
1115 | operations (in "D" state) in the wait_for_completion function. If a |
1116 | thread spends over 10ms, its name and backtrace is printed, and later | |
1117 | so is the total delay. | |
210ff7bf | 1118 | |
1f115be7 | 1119 | # stap sleepingBeauties.stp -c "sleep 1" |
6a51196c | 1120 | |
210ff7bf | 1121 | |
cf29c85e | 1122 | virtualization/qemu_io.stp - Tally the Number of User-Space QEMU IO on Each IO Port |
8c6bb289 WC |
1123 | keywords: virtualization qemu kvm io |
1124 | ||
1125 | The qemu_io.stp script tallies the number of times each of the IO | |
1126 | port on the guest virtual machines is touched by a input or output | |
1127 | operation. When the script exits, it prints a count of the number of | |
1128 | times each IO port read and written. | |
1129 | ||
1f115be7 | 1130 | # stap qemu_io.stp -c "sleep 1" |
8c6bb289 WC |
1131 | |
1132 | ||
a89c2e98 FL |
1133 | = JSON = |
1134 | ||
1135 | network/net_xmit_json.stp - Tracks time between packet queue and transmit. | |
1136 | keywords: network statistics json | |
1137 | ||
1138 | This script tracks time between packet queue and transmit. The | |
1139 | information is provided to userspace via procfs in JSON format. | |
1140 | ||
1141 | # stap net_xmit_json.stp -c "sleep 1" | |
1142 | ||
1143 | ||
1144 | network/netfilter_summary_json.stp - System-Wide Count of Network Packets by IPs | |
1145 | keywords: _best network traffic json | |
1146 | ||
1147 | The script watches all IPv4 network traffic on the system. The data | |
1148 | is output in JSON format and includes the number of packets sent | |
1149 | along source IP address / destination IP address pair encountered, | |
1150 | and the total number of bytes sent among the pair. | |
1151 | ||
1152 | # stap netfilter_summary_json.stp -c "sleep 1" | |
1153 | ||
1154 | ||
8c6bb289 WC |
1155 | = KVM = |
1156 | ||
cf29c85e | 1157 | virtualization/kvm_service_time.stp - Time Statistics on KVM Exit Reasons |
b9ae0bc4 | 1158 | keywords: _best virtualization kvm |
98ec0359 FCE |
1159 | |
1160 | The kvm_service_time.stp script tracks the statistics about the | |
1161 | amount of time that the processor left the guest virtual machine for | |
1162 | each exit reason (for example fixing up a page table or handling an | |
1163 | IO operation). When the script exits it prints out the number of | |
1164 | times each exit reason was encountered, the total duration of time it | |
1165 | left the guest VM, the minimum time, the average time, and the | |
1166 | maximum time in microseconds for that exit reason. On Linux 2.6.38 | |
1167 | and newer kernel the script can automatically determine whether it is | |
1168 | running on Intel or AMD processors. For older kernels with a | |
1169 | kernel.trace("kvm_exit") tracepoint that does not have the $isa | |
1170 | parameter you can explicitly state the kvm type with a "-G kvm=intel" | |
1171 | or "-G kvm=amd" on the command line. | |
1172 | ||
1f115be7 | 1173 | # stap kvm_service_time.stp -c "sleep 1" |
98ec0359 FCE |
1174 | |
1175 | ||
cf29c85e | 1176 | virtualization/qemu_count.stp - Tally the Number of User-Space QEMU Events |
8c6bb289 WC |
1177 | keywords: virtualization qemu kvm |
1178 | ||
1179 | The qemu_count.stp script tallies the number of times each of the | |
1180 | user-space qemu probepoints is encountered. When the script exits, it | |
1181 | prints a list of the number of times each user-space qemu probepoint | |
1182 | is encountered. | |
1183 | ||
1f115be7 | 1184 | # stap qemu_count.stp -c "sleep 1" |
8c6bb289 WC |
1185 | |
1186 | ||
cf29c85e | 1187 | virtualization/qemu_io.stp - Tally the Number of User-Space QEMU IO on Each IO Port |
8c6bb289 WC |
1188 | keywords: virtualization qemu kvm io |
1189 | ||
1190 | The qemu_io.stp script tallies the number of times each of the IO | |
1191 | port on the guest virtual machines is touched by a input or output | |
1192 | operation. When the script exits, it prints a count of the number of | |
1193 | times each IO port read and written. | |
1194 | ||
1f115be7 | 1195 | # stap qemu_io.stp -c "sleep 1" |
8c6bb289 WC |
1196 | |
1197 | ||
cf29c85e FCE |
1198 | = LIMITS = |
1199 | ||
1200 | memory/overcommit.stp - Log Failed Process Memory Allocation Due to Overcommit Limits | |
1201 | keywords: memory limits | |
1202 | ||
1203 | The overcommit.stp script prints a line each time the kernel refuses | |
1204 | a memory allocation request from a process because of | |
1205 | /proc/sys/vm/overcommit* limits. | |
1206 | ||
1f115be7 FCE |
1207 | # stap overcommit.stp -c "sleep 1" |
1208 | ||
1209 | ||
1210 | process/rlimit_nofile.stp - Trace processes running out of file descriptors | |
1211 | keywords: limits | |
1212 | ||
1213 | This script watches processes being scheduled and which try to | |
1214 | allocate a file descriptor without luck. | |
1215 | ||
1216 | # stap rlimit_nofile.stp -c "sleep 1" | |
cf29c85e FCE |
1217 | |
1218 | ||
210ff7bf FCE |
1219 | = LOCKING = |
1220 | ||
cf29c85e | 1221 | locks/bkl.stp - Tracing Contention on Big Kernel Lock |
cf5023fb WC |
1222 | keywords: locking |
1223 | ||
1224 | The bkl.stp script can help determine whether the Big Kernel Lock | |
1225 | (BKL) is causing serialization on a multiprocessor system due to | |
a11f34b0 FCE |
1226 | excessive contention of the BKL. The bkl.stp script takes two |
1227 | arguments. The first one is optional, and used to enable backtraces, | |
1228 | and print them once a process has been holding the BKL for a user | |
1229 | specified number of nseconds is reached. The second option is | |
1230 | compulsory and is the number of processes waiting for the Big Kernel | |
cf5023fb WC |
1231 | Lock (BKL). When the number of processes waiting for the BKL is |
1232 | reached or exceeded, the script will print a time stamp, the number | |
1233 | of processes waiting for the BKL, the holder of the BKL, and the | |
a11f34b0 FCE |
1234 | amount of time the BKL was held. If backtraces are enabled, a |
1235 | backtrace will be printed as well. | |
cf5023fb | 1236 | |
1f115be7 | 1237 | # stap bkl.stp -c "sleep 1" 1 |
6a51196c | 1238 | |
cf5023fb | 1239 | |
cf29c85e | 1240 | locks/bkl_stats.stp - Per Process Statistics on Big Kernel Lock Use |
cf5023fb WC |
1241 | keywords: locking |
1242 | ||
1243 | The bkl_stats.stp script can indicate which processes have excessive | |
1244 | waits for the Big Kernel Lock (BKL) and which processes are taking | |
1245 | the BKL for long periods of time. The bkl_stats.stp script prints | |
1246 | lists of all the processes that require the BKL. Every five seconds | |
1247 | two tables are printed out. The first table lists the processes that | |
1248 | waited for the BKL followed by the number of times that the process | |
1249 | waited, the minimum time of the wait, the average and the maximum | |
1250 | time waited. The second table lists has similar information for the | |
f3c4da44 | 1251 | time spent in holding the lock for each of the processes. |
cf5023fb | 1252 | |
1f115be7 | 1253 | # stap bkl_stats.stp -c "sleep 1" |
6a51196c | 1254 | |
cf5023fb | 1255 | |
210ff7bf | 1256 | process/futexes.stp - System-Wide Futex Contention |
09a98ae0 | 1257 | keywords: syscall locking futex |
210ff7bf FCE |
1258 | |
1259 | The script watches the futex syscall on the system. On exit the | |
0fb74e68 | 1260 | futex's address, the number of contentions, and the average time for |
210ff7bf FCE |
1261 | each contention on the futex are printed from lowest pid number to |
1262 | highest. | |
1263 | ||
1f115be7 | 1264 | # stap futexes.stp -c "sleep 1" |
6a51196c | 1265 | |
210ff7bf | 1266 | |
0fb74e68 JS |
1267 | process/futexes2.stp - System-Wide Shared Futex Contention |
1268 | keywords: syscall locking futex | |
1269 | ||
1270 | The script watches just shared futex syscalls on the system. On exit | |
1271 | the futex's key, the number of contentions, and the average time for | |
1272 | each contention on the futex are printed from lowest pid number to | |
1273 | highest. | |
1274 | ||
1f115be7 | 1275 | # stap futexes2.stp -c "sleep 1" |
0fb74e68 JS |
1276 | |
1277 | ||
5a224324 FCE |
1278 | process/mutex-contention.stp - pthread mutex contention analysis |
1279 | keywords: locking | |
1280 | ||
1281 | Tracks pthread-mutex initialization/use and underlying futex | |
1282 | operations, to identify (with backtraces/symbol-names) the mutexes | |
f275b3f7 FCE |
1283 | suffering most contention. Invoke with "-d SHLIB --ldd", perhaps |
1284 | with -DMAXMAPENTRIES=NNNN for some large NNNN, if the arrays overflow | |
1285 | due to heavy activity. | |
5a224324 | 1286 | |
1f115be7 | 1287 | # stap mutex-contention.stp -c "sleep 1" |
5a224324 FCE |
1288 | |
1289 | ||
5cf50309 FCE |
1290 | process/semop-watch.stp - Watch semop(2)/semtimedop(2) operations |
1291 | keywords: process locking | |
1292 | ||
1293 | Prints a timed trace of semop(2)/semtimedop(2) syscalls | |
1294 | ||
1295 | # stap semop-watch.stp -c 'sleep 2' | |
1296 | ||
1297 | ||
22f971e8 WC |
1298 | = MEMORY = |
1299 | ||
cf29c85e FCE |
1300 | general/sizeof.stp - Print the Size of a C Type |
1301 | keywords: statistics memory | |
3cfd512b FCE |
1302 | |
1303 | This script prints the size of a type, based on dwarf debuginfo for | |
1304 | any kernel or userspace module, or trial-compilation of a given | |
1305 | header file name. | |
1306 | ||
6a51196c FCE |
1307 | # stap sizeof.stp FILE '</usr/include/stdio.h>' |
1308 | ||
3cfd512b | 1309 | |
c4abda95 SP |
1310 | memory/glibc-malloc.stp - Overview glibc malloc internal operations |
1311 | keywords: memory process | |
1312 | ||
1313 | This script reports on internal statistics of the glibc malloc | |
1314 | implementation, as used by a process restricted by stap -x/-c | |
1315 | ||
1316 | # stap glibc-malloc.stp -c 'stap --dump-functions' | |
1317 | ||
1318 | ||
cf29c85e | 1319 | memory/hw_watch_addr.stp - Watch a Kernel Address Using Breakpoint Hardware |
54d84647 WC |
1320 | keywords: memory watchpoint |
1321 | ||
1322 | The script will watch accesses to a single kernel address and prints | |
1323 | a traceback each time the address is accessed. This script needs to | |
1324 | be run as root to allow access to the breakpoint hardware. | |
1325 | ||
23063de1 | 1326 | # stap --all-modules hw_watch_addr.stp 0x`grep "vm_dirty_ratio" \ |
0a9d3bc8 | 1327 | /proc/kallsyms | awk '{print $1}'` -c "sleep 5" |
54d84647 WC |
1328 | |
1329 | ||
cf29c85e | 1330 | memory/hw_watch_sym.stp - Watch a Kernel Symbol Using Breakpoint Hardware |
54d84647 WC |
1331 | keywords: memory watchpoint |
1332 | ||
1333 | The script will watch accesses to the starting address of a single | |
1334 | kernel symbol and prints a traceback each time the symbol is | |
1335 | accessed. This script needs to be run as root to allow access to the | |
1336 | breakpoint hardware. | |
1337 | ||
23063de1 | 1338 | # stap --all-modules hw_watch_sym.stp vm_dirty_ratio -c "sleep 5" |
54d84647 WC |
1339 | |
1340 | ||
cf29c85e | 1341 | memory/kmalloc-top - Show Paths to Kernel Malloc Invocations |
22f971e8 WC |
1342 | keywords: memory |
1343 | ||
1344 | The kmalloc-top perl program runs a small systemtap script to collect | |
1345 | stack traces for each call to the kmalloc function and counts the | |
1346 | time that each stack trace is observed. When kmalloc-top exits it | |
f3c4da44 MW |
1347 | prints out sorted list. The output can be filtered to print only the |
1348 | first N stack traces (-t), stack traces with a minimum counts (-m), | |
1349 | or exclude certain stack traces (-e). | |
22f971e8 | 1350 | |
1f115be7 | 1351 | # ./kmalloc-top -c "sleep 1" |
6a51196c | 1352 | |
22f971e8 | 1353 | |
f70a0bc5 FCE |
1354 | memory/last_100_frees.stp - Log recent free(3) calls. |
1355 | keywords: memory process backtrace | |
1356 | ||
1357 | This script reports on the last few free(3) libc calls done by | |
1358 | processes (possibly restricted by stap -x/-c), along with a userspace | |
1359 | backtrace at those moments. | |
1360 | ||
1361 | # stap last_100_frees.stp -c "stap -V" -d `which stap` --ldd | |
1362 | ||
1363 | ||
0dc23d1d WC |
1364 | memory/mmanonpage.stp - Track Virtual Memory System Actions on Anonymous Pages |
1365 | keywords: memory | |
1366 | ||
1367 | The mmanonpage.stp script uses the virtual memory tracepoints | |
1368 | available in some kernels to track the number of faults, user space | |
1369 | frees, page ins, copy on writes and unmaps for anonymous pages. When | |
1370 | the script is terminated the counts are printed for each process that | |
1371 | allocated pages while the script was running. This script displays | |
1372 | the anonymous page statistics for each process that ran while the | |
f3c4da44 | 1373 | script is active. It's useful in debugging leaks in the anonymous |
0dc23d1d WC |
1374 | regions of a process. |
1375 | ||
1f115be7 | 1376 | # stap mmanonpage.stp -c "sleep 1" |
6a51196c | 1377 | |
0dc23d1d WC |
1378 | |
1379 | memory/mmfilepage.stp - Track Virtual Memory System Actions on File Backed Pages | |
1380 | keywords: memory | |
1381 | ||
1382 | The mmfilepage.stp script uses the virtual memory tracepoints | |
1383 | available in some kernels to track the number of faults, copy on | |
1384 | writes mapping, and unmapping operations for file backed pages. When | |
1385 | the script is terminated the counts are printed for each process that | |
1386 | allocated pages while the script was running. The mmfilepage.stp | |
1387 | script is useful in debugging leaks in the mapped file regions of a | |
1388 | process. | |
1389 | ||
1f115be7 | 1390 | # stap mmfilepage.stp -c "sleep 1" |
6a51196c | 1391 | |
0dc23d1d WC |
1392 | |
1393 | memory/mmreclaim.stp - Track Virtual Memory System Page Reclamation | |
1394 | keywords: memory | |
1395 | ||
1396 | The mmreclaim.stp script uses the virtual memory tracepoints | |
ad7e33d7 | 1397 | available in some kernels to track page reclaim activity that |
f3c4da44 | 1398 | occurred while the script was running. It's useful in debugging |
ad7e33d7 | 1399 | performance problems that occur due to page reclamation. |
0dc23d1d | 1400 | |
1f115be7 | 1401 | # stap mmreclaim.stp -c "sleep 1" |
6a51196c | 1402 | |
0dc23d1d WC |
1403 | |
1404 | memory/mmwriteback.stp - Track Virtual Memory System Writing to Disk | |
1405 | keywords: memory | |
1406 | ||
1407 | The mmwriteback.stp script uses the virtual memory tracepoints | |
1408 | available in some kernels to report all of the file writebacks that | |
1409 | occur form kupdate, pdflush and kjournald while the script is | |
f3c4da44 MW |
1410 | running. It's useful in determining where writes are coming from on |
1411 | a supposedly idle system that is experiencing unexpected IO. | |
0dc23d1d | 1412 | |
1f115be7 | 1413 | # stap mmwriteback.stp -c "sleep 1" |
6a51196c | 1414 | |
0dc23d1d | 1415 | |
c728b7da WC |
1416 | memory/numa_faults.stp - Summarize Process Misses across NUMA Nodes |
1417 | keywords: memory numa | |
1418 | ||
1419 | The numa_faults.stp script tracks the read and write pages faults for | |
1420 | each process. When the script exits it prints out the total read and | |
ad7e33d7 | 1421 | write pages faults for each process. The script also provide a break |
c728b7da WC |
1422 | down of page faults per node for each process. This script is useful |
1423 | for determining whether the program has good locality (page faults | |
1424 | limited to a single node) on a NUMA computer. | |
1425 | ||
1f115be7 | 1426 | # stap numa_faults.stp -c "sleep 1" |
6a51196c | 1427 | |
c728b7da | 1428 | |
cf29c85e FCE |
1429 | memory/overcommit.stp - Log Failed Process Memory Allocation Due to Overcommit Limits |
1430 | keywords: memory limits | |
1ff1a65d FCE |
1431 | |
1432 | The overcommit.stp script prints a line each time the kernel refuses | |
1433 | a memory allocation request from a process because of | |
1434 | /proc/sys/vm/overcommit* limits. | |
1435 | ||
1f115be7 | 1436 | # stap overcommit.stp -c "sleep 1" |
6a51196c | 1437 | |
1ff1a65d | 1438 | |
413996e0 WC |
1439 | memory/pfaults.stp - Generate Log of Major and Minor Page Faults |
1440 | keywords: memory | |
1441 | ||
1442 | The pfaults.stp script generates a simple log for each major and | |
1443 | minor page fault that occurs on the system. Each line contains a | |
1444 | timestamp (in microseconds) when the page fault servicing was | |
1445 | completed, the pid of the process, the address of the page fault, the | |
1446 | type of access (read or write), the type of fault (major or minor), | |
1447 | and the elapsed time for page fault. This log can be examined to | |
ad7e33d7 | 1448 | determine where the page faults are occurring. |
413996e0 | 1449 | |
1f115be7 | 1450 | # stap pfaults.stp -c "sleep 1" |
6a51196c | 1451 | |
413996e0 | 1452 | |
cf29c85e FCE |
1453 | memory/vm.tracepoints.stp - Collect Slab Allocation Statistics |
1454 | keywords: memory slab statistics | |
42c55668 MW |
1455 | |
1456 | The script will probe all memory slab/slub allocations and collects | |
1457 | information about the size of the object (bytes requested) and | |
1458 | user-space process in execution. When run over a period of time, it | |
1459 | helps to correlate kernel-space memory consumption owing to | |
1460 | user-space processes. | |
1461 | ||
6a51196c FCE |
1462 | # stap vm.tracepoints.stp -c "sleep 10" |
1463 | ||
42c55668 | 1464 | |
14f0bb18 | 1465 | = MONITORING = |
b7f6cfc5 | 1466 | |
cf29c85e | 1467 | general/varwatch.stp - Watch a Variable Changing Value in a Thread |
b9ae0bc4 | 1468 | keywords: _best monitoring |
b7f6cfc5 | 1469 | |
14f0bb18 FCE |
1470 | This script places a set of probes (specified by $1), each of which |
1471 | monitors the state of some context $variable expression (specified by | |
1472 | $2). Whenever the value changes, with respect to the active thread, | |
1473 | the event is traced. | |
b7f6cfc5 | 1474 | |
6a51196c | 1475 | # stap -w varwatch.stp 'kernel.statement("do_sys_open@fs/open.c:*")' \ |
1f115be7 | 1476 | '$$vars' -c "sleep 1" |
6a51196c | 1477 | |
1beb5089 | 1478 | |
75ed3b3c FCE |
1479 | general/whythefail.stp - Why did the function fail? |
1480 | keywords: speculation monitoring function trace _best | |
1481 | ||
1482 | The whythefail.stp script prints a statement-execution trace for a | |
1483 | given function, but only for those runs of the function that ended up | |
1484 | with a (configurable) post-return condition. | |
1485 | ||
1486 | # stap whythefail.stp kernel sys_open '$return < 0' -c 'cat \ | |
1487 | /root/no-such-file || true' | |
1488 | ||
1489 | ||
cf29c85e | 1490 | io/mbrwatch.stp - Monitor Read/Write of the Boot Sector Area of Block Devices |
74e5c5cf | 1491 | keywords: io monitoring disk |
1beb5089 FCE |
1492 | |
1493 | The mbrwatch.stp script reports any attempted reads/writes of the | |
1494 | first few sectors of a raw block device. | |
1495 | ||
6a51196c | 1496 | # stap mbrwatch.stp -c "dd of=/dev/null count=1 if=/dev/`grep -v major \ |
199197b8 FCE |
1497 | /proc/partitions | grep . | grep -v 'sr[0-9]' | awk '{print $4}' | \ |
1498 | head -1`" | |
6a51196c | 1499 | |
1beb5089 | 1500 | |
cf29c85e | 1501 | io/ttyspy.stp - Monitor TTY Typing |
1ca36a99 | 1502 | keywords: io tty monitoring guru |
14f0bb18 FCE |
1503 | |
1504 | The ttyspy.stp script uses tty_audit hooks to monitor recent typing | |
1505 | activity on the system, printing a scrolling record of recent | |
1506 | keystrokes, on a per-tty basis. | |
1507 | ||
6a51196c FCE |
1508 | # stap --skip-badvars -g ttyspy.stp -c "sleep 1" |
1509 | ||
14f0bb18 | 1510 | |
7080b0c3 | 1511 | process/auditbt.stp - Generate backtraces for kernel audit events |
a8a7b9f4 FCE |
1512 | keywords: monitoring security audit backtrace |
1513 | ||
7080b0c3 FCE |
1514 | Attaches to the kernel audit-log paths (also used by libaudit), and |
1515 | log every record being sent, along with a user-space backtrace of the | |
1516 | process that caused it. | |
a8a7b9f4 | 1517 | |
54a385da | 1518 | # stap auditbt.stp -d /usr/bin/sudo --ldd -c "sudo true" |
a8a7b9f4 FCE |
1519 | |
1520 | ||
677b471e JL |
1521 | process/procmod_watcher.stp - Monitor process creation/termination and module [un]loading |
1522 | keywords: process monitoring syscall tracepoint | |
1523 | ||
1524 | The procmod_watcher.stp script monitors calls to fork(), exec(), | |
1525 | exit(), init_module(), and delete_module(). Event-specific details | |
1526 | are also printed out (e.g. for exec(), the file being exec'ed). This | |
1527 | script does not require debuginfo. | |
1528 | ||
1f115be7 | 1529 | # stap procmod_watcher.stp -c "sleep 1" |
677b471e JL |
1530 | |
1531 | ||
cf29c85e FCE |
1532 | = NANOSLEEP = |
1533 | ||
1534 | process/sleeptime.stp - Trace Time Spent in Nanosleep Syscalls | |
1535 | keywords: syscall nanosleep | |
1536 | ||
1537 | The script watches each nanosleep syscall on the system. At the end | |
1538 | of each nanosleep syscall the script prints out a line with a | |
1539 | timestamp in microseconds, the pid, the executable name in | |
1540 | parentheses, the "nanosleep:" key, and the duration of the sleep in | |
1541 | microseconds. | |
1542 | ||
1f115be7 | 1543 | # stap sleeptime.stp -c "sleep 1" |
cf29c85e FCE |
1544 | |
1545 | ||
0e81b7f5 FCE |
1546 | = NET = |
1547 | ||
1548 | lwtools/accept2close-nd.stp - Show socket lifespan, from accept() to close() (non-debuginfo) | |
1549 | keywords: net socket | |
1550 | ||
1551 | This traces socket duration from the accept() syscall to close(), and | |
1552 | provides details on the lifespan of these passive connections, | |
1553 | showing the distribution as a histogram. | |
1554 | ||
1555 | # stap accept2close-nd.stp -c "sleep 1" | |
1556 | ||
1557 | ||
210ff7bf FCE |
1558 | = NETWORK = |
1559 | ||
cf29c85e | 1560 | network/autofs4.stp - Watch autofs4 Operations |
8b88e771 FCE |
1561 | keywords: network autofs nfs |
1562 | ||
1563 | Trace key autofs4 operations such as mounting or unmounting remote | |
1564 | filesystems. | |
1565 | ||
6a51196c FCE |
1566 | # stap autofs4.stp -c "sleep 1" |
1567 | ||
8b88e771 | 1568 | |
9e749e50 JS |
1569 | network/connect_stat.stp - Show Process Ancestry for IP Connections |
1570 | keywords: network socket process | |
1571 | ||
1572 | The connect_stat.stp script prints a task's entire ancestry (parent | |
1573 | process name/uid/gid) whenever it attempts an outgoing socket | |
1574 | connection to a given IP address. | |
1575 | ||
1f115be7 | 1576 | # stap connect_stat.stp 127.0.0.1 -c "sleep 1" |
9e749e50 JS |
1577 | |
1578 | ||
cf29c85e FCE |
1579 | network/dropwatch.stp - Watch Where Socket Buffers Are Freed in the Kernel |
1580 | keywords: network tracepoint socket | |
0e4901b0 WC |
1581 | |
1582 | Every five seconds the dropwatch.stp script lists the number of | |
1583 | socket buffers freed at locations in the kernel. | |
1584 | ||
1f115be7 | 1585 | # stap dropwatch.stp -c "sleep 1" |
6a51196c | 1586 | |
0e4901b0 | 1587 | |
a89c2e98 FL |
1588 | network/net_xmit_json.stp - Tracks time between packet queue and transmit. |
1589 | keywords: network statistics json | |
1590 | ||
1591 | This script tracks time between packet queue and transmit. The | |
1592 | information is provided to userspace via procfs in JSON format. | |
1593 | ||
1594 | # stap net_xmit_json.stp -c "sleep 1" | |
1595 | ||
1596 | ||
53e5699f JS |
1597 | network/netdev.stp - Trace Activity on Network Devices |
1598 | keywords: network device traffic | |
1599 | ||
1600 | The netdev.stp script traces configuration and transmit/receive | |
1601 | activity on network devices. | |
1602 | ||
1f115be7 | 1603 | # stap netdev.stp -c "sleep 1" |
6a51196c | 1604 | |
53e5699f | 1605 | |
f1c6c6ed | 1606 | network/netfilter_drop.stp - System-Wide Network Packet Dropping Tool |
1ca36a99 | 1607 | keywords: network packets guru |
f1c6c6ed MW |
1608 | |
1609 | The script drops the specified number of packets of the specified | |
1610 | protocol. Valid protocols are TCP, UDP, or ALL. If ALL is specified, | |
1611 | all incoming packets are dropped. The number of packets to drop can | |
1612 | be specified with a positive integer. A value of 0 indicates that | |
1613 | packets should be dropped until the user manually exits. | |
1614 | ||
1615 | # stap -g netfilter_drop.stp TCP 1 -c "sleep 2" | |
1616 | ||
1617 | ||
57db0e6f | 1618 | network/netfilter_summary.stp - System-Wide Count of Network Packets by IPs |
b9ae0bc4 | 1619 | keywords: _best network traffic |
57db0e6f MW |
1620 | |
1621 | The script watches all IPv4 network traffic on the system. On exit | |
1622 | the script prints a list showing the number of packets sent along | |
1623 | source IP address / destination IP address pair encountered, and the | |
1624 | total number of bytes sent among the pair. The list is ordered from | |
1625 | greatest to least number of packets seen among the source/destination | |
1626 | pairs. | |
1627 | ||
1f115be7 | 1628 | # stap netfilter_summary.stp -c "sleep 1" |
57db0e6f MW |
1629 | |
1630 | ||
a89c2e98 FL |
1631 | network/netfilter_summary_json.stp - System-Wide Count of Network Packets by IPs |
1632 | keywords: _best network traffic json | |
1633 | ||
1634 | The script watches all IPv4 network traffic on the system. The data | |
1635 | is output in JSON format and includes the number of packets sent | |
1636 | along source IP address / destination IP address pair encountered, | |
1637 | and the total number of bytes sent among the pair. | |
1638 | ||
1639 | # stap netfilter_summary_json.stp -c "sleep 1" | |
1640 | ||
1641 | ||
210ff7bf | 1642 | network/nettop.stp - Periodic Listing of Processes Using Network Interfaces |
74e5c5cf | 1643 | keywords: network traffic |
210ff7bf FCE |
1644 | |
1645 | Every five seconds the nettop.stp script prints out a list of | |
1646 | processed (PID and command) with the number of packets sent/received | |
1647 | and the amount of data sent/received by the process during that | |
1648 | interval. | |
1649 | ||
1f115be7 | 1650 | # stap nettop.stp -c "sleep 1" |
6a51196c | 1651 | |
210ff7bf | 1652 | |
905728a0 | 1653 | network/sk_stream_wait_memory.stp - Track Start and Stop of Processes Due to Network Buffer Space |
cf29c85e | 1654 | keywords: network tcp process |
905728a0 WC |
1655 | |
1656 | The sk_stream-wait_memory.stp prints a time stamp, executable, and | |
1657 | pid each time a process blocks due to the send buffer being full. A | |
1658 | similar entry is printed each time a process continues because there | |
1659 | is room in the buffer. | |
1660 | ||
1f115be7 | 1661 | # stap sk_stream_wait_memory.stp -c "sleep 1" |
6a51196c | 1662 | |
905728a0 | 1663 | |
cf29c85e | 1664 | network/socket-trace.stp - Trace Functions Called in Network Socket Code |
09a98ae0 | 1665 | keywords: network socket |
210ff7bf | 1666 | |
f3c4da44 MW |
1667 | The script instruments each of the functions in the Linux kernel's |
1668 | net/socket.c file. The script prints out trace data. The first | |
1669 | element of a line is time delta in microseconds from the previous | |
1670 | entry. This is followed by the command name and the PID. The "->" and | |
1671 | "<-" indicates function entry and function exit, respectively. The | |
1672 | last element of the line is the function name. | |
210ff7bf | 1673 | |
1f115be7 | 1674 | # stap socket-trace.stp -c "sleep 1" |
6a51196c | 1675 | |
210ff7bf | 1676 | |
9141644d WC |
1677 | network/socktop - Periodically Summarize Socket Activity on the System |
1678 | keywords: network socket | |
1679 | ||
1680 | The socktop script periodically prints out a list of the processes | |
1681 | with the highest socket activity. Command line options for the | |
1682 | script allow filtering to focus on particular types of sockets. The | |
1683 | "-h" option lists socktop script's filtering options. | |
1684 | ||
6a51196c FCE |
1685 | # ./socktop -c 1 |
1686 | ||
9141644d | 1687 | |
a89c2e98 FL |
1688 | network/stp_dump.stp - Dump of STP packets |
1689 | keywords: network traffic | |
1690 | ||
1691 | The stp_dump.stp prints out the packet contents. Each block contains | |
1692 | the STP protocol ID, version ID, flags, root and bridge MAC | |
1693 | addresses, and various times. | |
1694 | ||
9e6206fd | 1695 | # stap stp_dump.stp -c "sleep 5" |
a89c2e98 FL |
1696 | |
1697 | ||
492d227f WC |
1698 | network/tcp_connections.stp - Track Creation of Incoming TCP Connections |
1699 | keywords: network tcp socket | |
1700 | ||
1701 | The tcp_connections.stp script prints information for each new | |
1702 | incoming TCP connection accepted by the computer. The information | |
1703 | includes the UID, the command accepting the connection, the PID of | |
1704 | the command, the port the connection is on, and the IP address of the | |
1705 | originator of the request. | |
1706 | ||
1f115be7 | 1707 | # stap tcp_connections.stp -c "sleep 1" |
6a51196c | 1708 | |
492d227f | 1709 | |
cf29c85e | 1710 | network/tcp_init_cwnd.stp - Increase Initial TCP Congestion Window to 10 |
1ca36a99 | 1711 | keywords: network tcp socket guru |
65bdbf09 FCE |
1712 | |
1713 | Run the tcp_init_cwnd.stp script in the background to override a | |
1714 | kernel's default tcp cwnd value to 10, which has been found to | |
1715 | improve latency for web server type workloads. The script prints a | |
1716 | count of cwnd value changes when it is stopped. | |
1717 | ||
1f115be7 | 1718 | # stap -g tcp_init_cwnd.stp -c "sleep 1" |
65bdbf09 FCE |
1719 | |
1720 | ||
cf29c85e | 1721 | network/tcp_trace.stp - TCP Connection Tracing Utility |
2e251678 DW |
1722 | keywords: network trace |
1723 | ||
cf29c85e | 1724 | This scripts traces a given TCP connection based on the filter |
2e251678 DW |
1725 | parameters given by the user. The indexing is done by the 4 tuples |
1726 | local address, remote address, local port, remote port. | |
1727 | ||
6a51196c FCE |
1728 | # stap tcp_trace.stp 127.0.0.1:*-127.0.0.1:* timeout=1 |
1729 | ||
2e251678 | 1730 | |
5cf50309 | 1731 | network/tcpdumplike.stp - Dump of Received UDP/TCP Packets |
7a51212c WC |
1732 | keywords: network traffic |
1733 | ||
5cf50309 FCE |
1734 | The tcpdumplike.stp prints out a line for each TCP & UDP packet |
1735 | received. Each line includes the source and destination IP addresses, | |
1736 | the source and destination ports, and flags. | |
7a51212c | 1737 | |
1f115be7 | 1738 | # stap tcpdumplike.stp -c "sleep 1" |
6a51196c | 1739 | |
7a51212c | 1740 | |
cf29c85e | 1741 | network/tcpipstat.stp - Display Network Statistics for Individual TCP Sockets |
4bb6522c WC |
1742 | keywords: network statistics |
1743 | ||
cf29c85e FCE |
1744 | The tcpipstat script collects and displays network statistics related |
1745 | to individual TCP sockets or groups of sockets. The statistics that | |
1746 | are collected are simular to that of the command netstat -s, only | |
1747 | sorted and grouped by individual sockets. | |
4bb6522c | 1748 | |
6a51196c FCE |
1749 | # stap tcpipstat.stp timeout=1 |
1750 | ||
4bb6522c | 1751 | |
8b88e771 FCE |
1752 | = NFS = |
1753 | ||
cf29c85e | 1754 | network/autofs4.stp - Watch autofs4 Operations |
8b88e771 FCE |
1755 | keywords: network autofs nfs |
1756 | ||
1757 | Trace key autofs4 operations such as mounting or unmounting remote | |
1758 | filesystems. | |
1759 | ||
6a51196c FCE |
1760 | # stap autofs4.stp -c "sleep 1" |
1761 | ||
8b88e771 | 1762 | |
d12c1a86 FCE |
1763 | network/nfsd-recent.stp - Keep track of NFS server statistics |
1764 | keywords: nfs statistics | |
1765 | ||
1766 | This script tracks all nfsd server operations by client_ip address, | |
1767 | and periodically lists those clients that have made recent requests. | |
1768 | It's a way of finding out which nfs clients might be considered still | |
1769 | connected. | |
1770 | ||
1f115be7 | 1771 | # stap nfsd-recent.stp -c "sleep 1" |
d12c1a86 FCE |
1772 | |
1773 | ||
cf29c85e | 1774 | network/nfsd_unlink.stp - Find Which Client Is Removing NFS Files on Server |
b7edd338 WC |
1775 | keywords: nfs disk |
1776 | ||
1777 | The nfsd_unlink.stp script lists the ip address and file name each | |
1778 | time time a file is being removed or unlinked by the nfsd. This | |
1779 | script is run on the nfs server. | |
1780 | ||
1f115be7 | 1781 | # stap nfsd_unlink.stp -c "sleep 1" |
b7edd338 WC |
1782 | |
1783 | ||
5882f170 DS |
1784 | network/nfsdtop.stp - Keep track of NFS server statistics |
1785 | keywords: nfs statistics | |
1786 | ||
1787 | The nfsdtop.stp script gathers and displays NFS lookups, | |
1788 | ||
3b33d8c4 | 1789 | # stap nfsdtop.stp -c "sleep 1" |
5882f170 DS |
1790 | |
1791 | ||
c728b7da WC |
1792 | = NUMA = |
1793 | ||
1794 | memory/numa_faults.stp - Summarize Process Misses across NUMA Nodes | |
1795 | keywords: memory numa | |
1796 | ||
1797 | The numa_faults.stp script tracks the read and write pages faults for | |
1798 | each process. When the script exits it prints out the total read and | |
ad7e33d7 | 1799 | write pages faults for each process. The script also provide a break |
c728b7da WC |
1800 | down of page faults per node for each process. This script is useful |
1801 | for determining whether the program has good locality (page faults | |
1802 | limited to a single node) on a NUMA computer. | |
1803 | ||
1f115be7 | 1804 | # stap numa_faults.stp -c "sleep 1" |
6a51196c | 1805 | |
c728b7da | 1806 | |
f1c6c6ed MW |
1807 | = PACKETS = |
1808 | ||
1809 | network/netfilter_drop.stp - System-Wide Network Packet Dropping Tool | |
1ca36a99 | 1810 | keywords: network packets guru |
f1c6c6ed MW |
1811 | |
1812 | The script drops the specified number of packets of the specified | |
1813 | protocol. Valid protocols are TCP, UDP, or ALL. If ALL is specified, | |
1814 | all incoming packets are dropped. The number of packets to drop can | |
1815 | be specified with a positive integer. A value of 0 indicates that | |
1816 | packets should be dropped until the user manually exits. | |
1817 | ||
1818 | # stap -g netfilter_drop.stp TCP 1 -c "sleep 2" | |
1819 | ||
1820 | ||
cf29c85e | 1821 | = PROCESS = |
db5bfb14 | 1822 | |
cf29c85e | 1823 | general/eventcount.stp - Count Specified Events |
b9ae0bc4 | 1824 | keywords: _best statistics thread process |
db5bfb14 | 1825 | |
875e1b27 FCE |
1826 | The script periodically prints a count of specified events and their |
1827 | related tid's over the course of execution. Numerous configuration | |
1828 | options exist to control filtering / reporting, see the script | |
1829 | source. | |
db5bfb14 | 1830 | |
1f115be7 | 1831 | # stap eventcount.stp syscall.* -c 'sleep 1' |
db5bfb14 FCE |
1832 | |
1833 | ||
c4abda95 SP |
1834 | memory/glibc-malloc.stp - Overview glibc malloc internal operations |
1835 | keywords: memory process | |
1836 | ||
1837 | This script reports on internal statistics of the glibc malloc | |
1838 | implementation, as used by a process restricted by stap -x/-c | |
1839 | ||
1840 | # stap glibc-malloc.stp -c 'stap --dump-functions' | |
1841 | ||
1842 | ||
f70a0bc5 FCE |
1843 | memory/last_100_frees.stp - Log recent free(3) calls. |
1844 | keywords: memory process backtrace | |
1845 | ||
1846 | This script reports on the last few free(3) libc calls done by | |
1847 | processes (possibly restricted by stap -x/-c), along with a userspace | |
1848 | backtrace at those moments. | |
1849 | ||
1850 | # stap last_100_frees.stp -c "stap -V" -d `which stap` --ldd | |
1851 | ||
1852 | ||
9e749e50 JS |
1853 | network/connect_stat.stp - Show Process Ancestry for IP Connections |
1854 | keywords: network socket process | |
1855 | ||
1856 | The connect_stat.stp script prints a task's entire ancestry (parent | |
1857 | process name/uid/gid) whenever it attempts an outgoing socket | |
1858 | connection to a given IP address. | |
1859 | ||
1f115be7 | 1860 | # stap connect_stat.stp 127.0.0.1 -c "sleep 1" |
9e749e50 JS |
1861 | |
1862 | ||
cf29c85e FCE |
1863 | network/sk_stream_wait_memory.stp - Track Start and Stop of Processes Due to Network Buffer Space |
1864 | keywords: network tcp process | |
1ff1a65d | 1865 | |
cf29c85e FCE |
1866 | The sk_stream-wait_memory.stp prints a time stamp, executable, and |
1867 | pid each time a process blocks due to the send buffer being full. A | |
1868 | similar entry is printed each time a process continues because there | |
1869 | is room in the buffer. | |
1ff1a65d | 1870 | |
1f115be7 | 1871 | # stap sk_stream_wait_memory.stp -c "sleep 1" |
6a51196c | 1872 | |
1ff1a65d | 1873 | |
cf29c85e | 1874 | process/cycle_thief.stp - Track IRQ's and Other Processes Stealing Cycles from a Task |
b9ae0bc4 | 1875 | keywords: _best process scheduler time tracepoint interrupt |
e01bc08e WC |
1876 | |
1877 | The cycle_thief.stp script instruments the scheduler and IRQ handler | |
1878 | to determine which processes and interrupts are competing with the | |
1879 | specified task for the cpu cycles. This script uses the '-c' or '-x' | |
1880 | options to focus on a specific task. The script output the number of | |
1881 | times the task migrates between processors, histograms showing the | |
1882 | length of time on and off processor, lists of processes running while | |
1883 | the task is off the processor, and the interrupts that occurred while | |
1884 | the task was running. | |
1885 | ||
1f115be7 | 1886 | # stap cycle_thief.stp -c "sleep 1" |
6a51196c | 1887 | |
e01bc08e | 1888 | |
cf29c85e | 1889 | process/errsnoop.stp - Tabulate System Call Errors |
cc20d853 ET |
1890 | keywords: process syscall |
1891 | ||
cf29c85e FCE |
1892 | Prints a periodic tabular report about failing system calls, by |
1893 | process and by syscall failure. The first optional argument | |
1894 | specifies the reporting interval (in seconds, default 5); the second | |
1895 | optional argument gives a screen height (number of lines in the | |
1896 | report, default 20). | |
cc20d853 | 1897 | |
6a51196c FCE |
1898 | # stap errsnoop.stp 1 10 -c "sleep 1" |
1899 | ||
cc20d853 | 1900 | |
e6b653c8 WC |
1901 | process/forktracker.stp - Trace Creation of Processes |
1902 | keywords: process scheduler | |
1903 | ||
1904 | The forktracker.stp script prints out a time-stamped entry showing | |
f3c4da44 | 1905 | each fork and exec operation on the machine. This can be useful to |
e6b653c8 WC |
1906 | determine what process is creating a flurry of short-lived processes. |
1907 | ||
1f115be7 | 1908 | # stap forktracker.stp -c "sleep 1" |
6a51196c | 1909 | |
e6b653c8 | 1910 | |
abb4cfbb FCE |
1911 | process/ltrace.stp - uprobes-based ltrace |
1912 | keywords: process | |
1913 | ||
1914 | The ltrace.stp script lists calls that the designated process makes | |
1915 | through PLTs (procedure linkage tables), generally into shared | |
1916 | libraries. | |
1917 | ||
1918 | # stap ltrace.stp -c ls || echo PR14738 | |
1919 | ||
1920 | ||
cf29c85e | 1921 | process/noptrace.stp - Disable ptrace from Hierarchies of Processes |
1ca36a99 | 1922 | keywords: process security guru |
5481d677 | 1923 | |
cf29c85e FCE |
1924 | Blocks ptrace(2) attempts from processes identified by stap -c/-x, as |
1925 | also specifiable from /proc/systemtap/stap_XXX/ control files. | |
1926 | Processes may be added or removed from the blocked list. | |
5481d677 | 1927 | |
15ecb1fe | 1928 | # stap -g noptrace.stp -c 'strace ls || true' |
6a51196c | 1929 | |
5481d677 | 1930 | |
cf29c85e FCE |
1931 | process/pfiles.stp - Print Process File Descriptors |
1932 | keywords: process file | |
ecf33ff4 ET |
1933 | |
1934 | Run pfiles.stp to produce a human-readable summary of all open file | |
1935 | descriptors of a given process. Specify the process-id as -x PID for | |
1936 | fastest performance. | |
1937 | ||
6a51196c FCE |
1938 | # stap -g pfiles.stp -x $$ |
1939 | ||
ecf33ff4 | 1940 | |
cf29c85e | 1941 | process/plimit.stp - Print Resource Limits of Process |
5b8642a2 FCE |
1942 | keywords: process |
1943 | ||
1944 | The script prints a variety of resource limits for a given pid, like | |
1945 | /proc/$$/limits on recent kernels. | |
1946 | ||
6a51196c FCE |
1947 | # stap -g plimit.stp $$ |
1948 | ||
5b8642a2 | 1949 | |
677b471e JL |
1950 | process/procmod_watcher.stp - Monitor process creation/termination and module [un]loading |
1951 | keywords: process monitoring syscall tracepoint | |
1952 | ||
1953 | The procmod_watcher.stp script monitors calls to fork(), exec(), | |
1954 | exit(), init_module(), and delete_module(). Event-specific details | |
1955 | are also printed out (e.g. for exec(), the file being exec'ed). This | |
1956 | script does not require debuginfo. | |
1957 | ||
1f115be7 | 1958 | # stap procmod_watcher.stp -c "sleep 1" |
677b471e JL |
1959 | |
1960 | ||
944d282f AJ |
1961 | process/proctop.stp - Periodically Print Process Information With History |
1962 | keywords: process scheduler _best | |
1963 | ||
1964 | Every 5 seconds, print out a list of 25 processes that took the most | |
1965 | system time with information about the processes. Includes | |
1966 | information on processes that may have exited while the script was | |
1967 | running. The script contains configuration options listed in the | |
1968 | script source. | |
1969 | ||
1970 | # stap proctop.stp -c "sleep 1" | |
1971 | ||
1972 | ||
f1c6c6ed | 1973 | process/psig.stp - Print Process File Descriptors |
1ca36a99 | 1974 | keywords: process signals |
f1c6c6ed MW |
1975 | |
1976 | Run psig.stp to produce a human-readable summary of the signal | |
1977 | handling configuration of a given process. Specify the process-id as | |
1978 | -x PID for fastest performance. | |
1979 | ||
1980 | # stap -DMAXACTION=10000 -g psig.stp -x $$ | |
1981 | ||
1982 | ||
04c36a84 MW |
1983 | process/pstrace_exec.stp - Print trace of process ancestors for matching exec commands |
1984 | keywords: process backtrace | |
1985 | ||
1986 | The pstrace_exec.stp script watches each exec operation. If the exec | |
1987 | contains a substring that matches the script's command-line argument, | |
1988 | it prints out that process and all of its ancestors. | |
1989 | ||
1f115be7 | 1990 | # stap pstrace_exec.stp -c "sleep 1" bash |
04c36a84 MW |
1991 | |
1992 | ||
9e749e50 JS |
1993 | process/pstree.stp - Generates a process diagram in DOT form. |
1994 | keywords: process diagram | |
1995 | ||
1996 | The pstree.stp script generates a process diagram in DOT form. For | |
1997 | instance, it may be useful on a 'make' command to see all the | |
1998 | processes that are started. | |
1999 | ||
1f115be7 | 2000 | # stap pstree.stp -c "sleep 1" |
9e749e50 JS |
2001 | |
2002 | ||
cf29c85e | 2003 | process/schedtimes.stp - Track Time Processes Spend in Various States Using Tracepoints |
34029cd3 WC |
2004 | keywords: process scheduler time tracepoint |
2005 | ||
2006 | The schedtimes.stp script instruments the scheduler to track the | |
f3c4da44 MW |
2007 | amount of time that each process spends in running, sleeping, |
2008 | queuing, and waiting for io. On exit the script prints out the | |
2009 | accumulated time for each state of processes observed. Optionally, | |
2010 | this script can be used with the '-c' or '-x' options to focus on a | |
4cba4e80 | 2011 | specific PID and its children. |
34029cd3 | 2012 | |
1f115be7 | 2013 | # stap schedtimes.stp -c "sleep 1" |
6a51196c | 2014 | |
34029cd3 | 2015 | |
5cf50309 FCE |
2016 | process/semop-watch.stp - Watch semop(2)/semtimedop(2) operations |
2017 | keywords: process locking | |
2018 | ||
2019 | Prints a timed trace of semop(2)/semtimedop(2) syscalls | |
2020 | ||
2021 | # stap semop-watch.stp -c 'sleep 2' | |
2022 | ||
2023 | ||
b9ae0bc4 FCE |
2024 | process/spawn_seeker.stp - Track Creation of Processes by process and execname |
2025 | keywords: process scheduler | |
2026 | ||
2027 | The spawn_seeker.stp script every minute (and on exit) prints out the | |
2028 | local time and sorted lists of which processes and executables | |
2029 | spawned tasks during the previous minute. This can be useful to | |
2030 | determine what process is creating a flurry of short-lived processes. | |
2031 | When a process exits its count of tasks created is added to its | |
2032 | parent's count to better account for the indirect task creation by | |
2033 | children processes. For more detailed examination of task creation | |
2034 | consider using forktracker.stp. | |
2035 | ||
2036 | # stap spawn_seeker.stp -c "sleep 1" | |
2037 | ||
2038 | ||
5cf50309 | 2039 | process/strace.stp - Trace system calls |
b9ae0bc4 | 2040 | keywords: _best process syscall |
5cf50309 FCE |
2041 | |
2042 | The script loosely emulates strace, when applied to individual | |
2043 | processes or hierarchies (via -c/-x), or the entire system (without | |
2044 | -c/-x). A few output configuration parameters may be set with -G. | |
2045 | ||
1f115be7 | 2046 | # stap strace.stp -c "sleep 1" |
5cf50309 FCE |
2047 | |
2048 | ||
c29c6f83 | 2049 | process/thread-business.stp - monitor syscall history |
b9ae0bc4 | 2050 | keywords: _best process syscall |
c29c6f83 FCE |
2051 | |
2052 | Prints a periodic tabular report about the counts of syscall activity | |
2053 | of all threads on the system, along with a textual | |
2054 | recent-syscall-history for each | |
2055 | ||
2056 | # stap thread-business.stp -c "sleep 10" | |
2057 | ||
2058 | ||
74e5c5cf FCE |
2059 | process/wait4time.stp - Trace Time Spent in wait4 Syscalls |
2060 | keywords: syscall process | |
2061 | ||
2062 | The script watches each wait4 syscall on the system. At the end of | |
2063 | each wait4 syscall the script prints out a line with a timestamp in | |
2064 | microseconds, the pid, the executable name in parentheses, the | |
2065 | "wait4:" key, the duration of the wait and the PID that the wait4 was | |
2066 | waiting for. If the waited for PID is not specified , it is "-1". | |
2067 | ||
1f115be7 | 2068 | # stap wait4time.stp -c "sleep 1" |
74e5c5cf FCE |
2069 | |
2070 | ||
210ff7bf FCE |
2071 | = PROFILING = |
2072 | ||
a4f3198f WC |
2073 | io/iodevstats.stp - List Executables Reading and Writing the Most Data by Device |
2074 | keywords: io profiling | |
2075 | ||
2076 | The iodevstats.stp script measures the amount of data successfully | |
2077 | read and written by all the executables for each io device on the | |
2078 | system. The output is sorted from greatest sum of bytes read and | |
2079 | written to a device by an executable to the least. The output | |
2080 | contains device major/minor number, the count of operations (reads | |
2081 | and writes), the totals and averages for the number of bytes read and | |
2082 | written. | |
2083 | ||
1f115be7 | 2084 | # stap iodevstats.stp -c "sleep 1" |
6a51196c | 2085 | |
a4f3198f | 2086 | |
cf29c85e | 2087 | io/iostat-scsi.stp - IO Statistics for SCSI Devices |
54ff5e0c FCE |
2088 | keywords: io profiling scsi |
2089 | ||
2090 | The iostat-scsi.stp script provides a breakdown of the number of blks | |
ad7e33d7 | 2091 | read and written on the machine's various SCSI devices. The script |
54ff5e0c FCE |
2092 | takes one argument which is the number of seconds between reports. |
2093 | ||
1f115be7 | 2094 | # stap -g iostat-scsi.stp 1 -c "sleep 1" |
6a51196c | 2095 | |
54ff5e0c | 2096 | |
3e4444ed WC |
2097 | io/iostats.stp - List Executables Reading and Writing the Most Data |
2098 | keywords: io profiling | |
2099 | ||
2100 | The iostat.stp script measures the amount of data successfully read | |
2101 | and written by all the executables on the system. The output is | |
2102 | sorted from most greatest sum of bytes read and written by an | |
2103 | executable to the least. The output contains the count of operations | |
2104 | (opens, reads, and writes), the totals and averages for the number of | |
2105 | bytes read and written. | |
2106 | ||
1f115be7 | 2107 | # stap iostats.stp -c "sleep 1" |
6a51196c | 2108 | |
3e4444ed | 2109 | |
cf29c85e FCE |
2110 | io/iotime.stp - Trace Time Spent in Read and Write for Files |
2111 | keywords: profiling syscall io file | |
2112 | ||
2113 | The script watches each open, close, read, and write syscalls on the | |
2114 | system. For each file the scripts observes opened it accumulates the | |
2115 | amount of wall clock time spent in read and write operations and the | |
2116 | number of bytes read and written. When a file is closed the script | |
2117 | prints out a pair of lines for the file. Both lines begin with a | |
2118 | timestamp in microseconds, the PID number, and the executable name in | |
2119 | parentheses. The first line with the "access" keyword lists the file | |
2120 | name, the attempted number of bytes for the read and write | |
2121 | operations. The second line with the "iotime" keyword list the file | |
2122 | name and the number of microseconds accumulated in the read and write | |
2123 | syscalls. | |
2124 | ||
1f115be7 | 2125 | # stap iotime.stp -c "sleep 1" |
cf29c85e FCE |
2126 | |
2127 | ||
111dd9ac WC |
2128 | io/nfs_func_users.stp - Tally the Number of NFS Functions Used by Each Process |
2129 | keywords: io profiling | |
2130 | ||
2131 | The nfs_func_users.stp script counts the uses of NFS functions in the | |
2132 | kernel on a per process bases. The output is sorted from the process | |
2133 | with the greatest number of NFS functions called to the least. The | |
2134 | output contains the executable name, the process number, and the | |
2135 | total number of NFS functions called by the process. | |
2136 | ||
1f115be7 | 2137 | # stap nfs_func_users.stp -c "sleep 1" |
6a51196c | 2138 | |
111dd9ac | 2139 | |
b96bcce8 WC |
2140 | profiling/errno.stp - Show Which Processes and System Calls Return Errors Most Frequently |
2141 | keywords: profiling | |
2142 | ||
2143 | On exit the errno.stp script provides a sorted list showing which | |
2144 | combination of PID, system call, and error occur most frequently. | |
2145 | ||
1f115be7 | 2146 | # stap errno.stp -c "sleep 1" |
6a51196c | 2147 | |
b96bcce8 | 2148 | |
0a9d3bc8 FCE |
2149 | profiling/fileline-profile.stp - Profile Kernel/User Functions |
2150 | keywords: profiling | |
2151 | ||
2152 | The fileline-profile.stp script ends by printing out a sorted list of | |
2153 | the top twenty kernel and/or user processes providing file:line | |
2154 | information, if available, from the samples addresses gathered over | |
2155 | the time period the script is run. Use any of --ldd, --all-modules, | |
2156 | -d MODULE, -d /PATH/TO/EXEC to add more symbolic info. To include the | |
2157 | symbol name in the output, specify guru mode (-g) and add | |
2158 | symbolname="yes" to the stap command. | |
2159 | ||
2160 | # stap fileline-profile.stp -c "sleep 6" --all-modules --ldd | |
2161 | ||
2162 | ||
cf29c85e | 2163 | profiling/fntimes.stp - Show Functions Taking Longer Than Usual |
b9ae0bc4 | 2164 | keywords: _best profiling |
f503d3c0 FCE |
2165 | |
2166 | The fntimes.stp script monitors the execution time history of a given | |
2167 | function family (assumed non-recursive). Each time (beyond a warmup | |
2168 | interval) is then compared to the historical maximum. If it exceeds | |
2169 | a certain threshold (250%), a message is printed. | |
2170 | ||
6a51196c FCE |
2171 | # stap fntimes.stp 'kernel.function("sys_*")' -c "sleep 7" |
2172 | ||
f503d3c0 | 2173 | |
cf29c85e FCE |
2174 | profiling/functioncallcount.stp - Count Times Functions Are Called |
2175 | keywords: profiling function | |
210ff7bf FCE |
2176 | |
2177 | The functioncallcount.stp script takes one argument, a list of | |
2178 | functions to probe. The script will run and count the number of times | |
2179 | that each of the functions on the list is called. On exit the script | |
2180 | will print a sorted list from most frequently to least frequently | |
2181 | called function. | |
2182 | ||
ca5d5a88 | 2183 | # stap -w functioncallcount.stp "*@mm/*.c" -c "sleep 1" |
a4072787 WC |
2184 | |
2185 | ||
cf29c85e | 2186 | profiling/latencytap.stp - Show Reasons and Durations for Processes Sleeping |
b9ae0bc4 | 2187 | keywords: _best profiling |
a4072787 WC |
2188 | |
2189 | The latencytap.stp script collects data on the intervals processes | |
2190 | are deactivated (sleeping). The script categorizes the reasons for | |
2191 | the sleeps by analyzing the backtraces and displays a sorted list of | |
2192 | the top 20 causes from largest total sum time sleeping to smallest. | |
2193 | The output is updated every 30 seconds. The script needs to be | |
2194 | compiled with the '--all-modules' option to produce reasons for | |
2195 | sleeps caused by modules. Optionally, this script can be used with | |
2196 | the '-c' or '-x' options to focus on a specific PID. | |
2197 | ||
1f115be7 | 2198 | # stap latencytap.stp --all-modules -c "sleep 1" |
6a51196c | 2199 | |
210ff7bf | 2200 | |
cf29c85e | 2201 | profiling/linetimes.stp - Show Time Spent on Each Line of a Function |
0a9d3bc8 | 2202 | keywords: profiling _best |
e985df18 WC |
2203 | |
2204 | The linetimes.stp script takes two arguments: where to find the | |
2205 | function and the function name. linetimes.stp will instrument each | |
2206 | line in the function. It will print out the number of times that the | |
2207 | function is called, a table with the average and maximum time each | |
2208 | line takes, and control flow information when the script exits. | |
2209 | ||
1f115be7 | 2210 | # stap linetimes.stp kernel sys_nanosleep -c "sleep 1" |
6a51196c | 2211 | |
e985df18 | 2212 | |
eb45f1f9 FCE |
2213 | profiling/perf.stp - Show performance ratios using perf.counter to access performance counters |
2214 | keywords: profiling | |
2215 | ||
2216 | On exit the perf.stp script provides a sorted list showing cycles per | |
2217 | insn, branches per insn, and cache refs per insn | |
2218 | ||
70f3005e | 2219 | # stap -w perf.stp -c "find /usr/bin -name \"l*\" -printf \"%h/%f %s %Cx \ |
eb45f1f9 FCE |
2220 | %Ck%CM %Y\n\"" |
2221 | ||
2222 | ||
cf29c85e | 2223 | profiling/periodic.stp - Show the Period of the Various Timers on the System |
7bec2ae9 WC |
2224 | keywords: profiling |
2225 | ||
2226 | The periodic.stp script uses the kernel.trace("timer_expire_entry") | |
cf29c85e | 2227 | tracepoint to collect data on period and frequency of the various |
7bec2ae9 WC |
2228 | timers on the system. The script displays a sorted list of the |
2229 | timers observed on the system from most frequent to least frequent. | |
2230 | The script needs to be compiled with the '--all-modules' option to | |
2231 | produce list the function names. Optionally, this script can be used | |
2232 | with a numerical argument to indicate the interval in seconds between | |
2233 | printing output. | |
2234 | ||
1f115be7 | 2235 | # stap periodic.stp --all-modules -c "sleep 1" |
7bec2ae9 WC |
2236 | |
2237 | ||
9ebb5a4e FCE |
2238 | profiling/pf2.stp - Profile Kernel Functions |
2239 | keywords: profiling | |
2240 | ||
2241 | The pf2.stp script sets up time-based sampling. Every five seconds it | |
2242 | prints out a sorted list with the top ten kernel functions with | |
2243 | samples. | |
2244 | ||
1f115be7 | 2245 | # stap pf2.stp -c "sleep 1" |
9ebb5a4e FCE |
2246 | |
2247 | ||
d7dd78f0 | 2248 | profiling/pf3.stp - Profile Kernel/User Functions |
9ebb5a4e FCE |
2249 | keywords: profiling |
2250 | ||
2251 | The pf3.stp script sets up time-based sampling. Every five seconds it | |
2252 | prints out a sorted list with the top twenty kernel and/or user | |
2253 | functions with samples. Use any of --ldd, --all-modules, -d MODULE, | |
2254 | -d /PATH/TO/EXEC to add more symbolic info. | |
2255 | ||
2256 | # stap pf3.stp -c "sleep 6" --all-modules --ldd | |
2257 | ||
2258 | ||
16fc2650 | 2259 | profiling/pf4.stp - Profile Kernel/User Backtraces |
14a364c1 | 2260 | keywords: _best profiling backtrace |
16fc2650 FCE |
2261 | |
2262 | The pf4.stp script sets up time-based sampling. Every five seconds it | |
2263 | prints out a sorted list with the top twenty kernel and/or user stack | |
2264 | backtraces (on a per-cpu basis). Use any of --ldd, --all-modules, -d | |
2265 | MODULE, -d /PATH/TO/EXEC to add more symbolic info. | |
2266 | ||
2267 | # stap pf4.stp -c "sleep 6" --all-modules --ldd | |
2268 | ||
2269 | ||
cf29c85e FCE |
2270 | profiling/sched_switch.stp - Display the Task Switches Happening in the Scheduler |
2271 | keywords: profiling function | |
0449af03 JS |
2272 | |
2273 | The sched_switch.stp script takes two arguments, first argument can | |
2274 | be "pid" or "name" to indicate what is being passed as second | |
2275 | argument. The script will trace the process based on pid/name and | |
2276 | print the scheduler switches happening with the process. If no | |
2277 | arguments are passed, it displays all the scheduler switches. This | |
2278 | can be used to understand which tasks schedule out the current | |
2279 | process being traced, and when it gets scheduled in again. | |
2280 | ||
6a51196c FCE |
2281 | # stap sched_switch.stp -c "sleep 1" |
2282 | ||
0449af03 | 2283 | |
cf29c85e | 2284 | profiling/thread-times.stp - Profile Kernel Functions |
96ef4c2a | 2285 | keywords: _best profiling |
210ff7bf | 2286 | |
1ae72757 JS |
2287 | The thread-times.stp script sets up time-based sampling. Every five |
2288 | seconds it prints out a sorted list with the top twenty threads | |
2289 | occupying the CPUs, broken down as a percentage of user and kernel | |
2290 | time. | |
210ff7bf | 2291 | |
1f115be7 | 2292 | # stap thread-times.stp -c "sleep 1" |
6a51196c | 2293 | |
210ff7bf | 2294 | |
ff90b297 WC |
2295 | profiling/timeout.stp - Show Processes Doing Polling Operations |
2296 | keywords: profiling | |
2297 | ||
2298 | The timeout.stp script is based on a blog entry | |
2299 | (http://udrepper.livejournal.com/19041.html) mentioning a need for a | |
2300 | tool to help developers find applications that are polling. The | |
2301 | timeout.stp script monitors systemcall used for polling and records | |
2302 | the systemcalls that timed out rather than returned because some | |
2303 | action occurred. The script updates the screen once a second with the | |
2304 | top twenty processes. | |
2305 | ||
1f115be7 | 2306 | # stap timeout.stp -c "sleep 1" |
6a51196c | 2307 | |
ff90b297 | 2308 | |
1bf72dfe WC |
2309 | profiling/topsys.stp - Show Processes Doing Polling Operations |
2310 | keywords: profiling | |
2311 | ||
2312 | The topsys.stp script lists out the top twenty systemcalls for the | |
2313 | previous 5 seconds. The output is sorted from most frequent to least | |
2314 | frequent. | |
2315 | ||
1f115be7 | 2316 | # stap topsys.stp -c "sleep 1" |
6a51196c | 2317 | |
1bf72dfe | 2318 | |
8c6bb289 WC |
2319 | = QEMU = |
2320 | ||
cf29c85e | 2321 | virtualization/qemu_count.stp - Tally the Number of User-Space QEMU Events |
8c6bb289 WC |
2322 | keywords: virtualization qemu kvm |
2323 | ||
2324 | The qemu_count.stp script tallies the number of times each of the | |
2325 | user-space qemu probepoints is encountered. When the script exits, it | |
2326 | prints a list of the number of times each user-space qemu probepoint | |
2327 | is encountered. | |
2328 | ||
1f115be7 | 2329 | # stap qemu_count.stp -c "sleep 1" |
8c6bb289 WC |
2330 | |
2331 | ||
cf29c85e | 2332 | virtualization/qemu_io.stp - Tally the Number of User-Space QEMU IO on Each IO Port |
8c6bb289 WC |
2333 | keywords: virtualization qemu kvm io |
2334 | ||
2335 | The qemu_io.stp script tallies the number of times each of the IO | |
2336 | port on the guest virtual machines is touched by a input or output | |
2337 | operation. When the script exits, it prints a count of the number of | |
2338 | times each IO port read and written. | |
2339 | ||
1f115be7 | 2340 | # stap qemu_io.stp -c "sleep 1" |
8c6bb289 WC |
2341 | |
2342 | ||
fefcef82 FCE |
2343 | = REGEX = |
2344 | ||
2345 | general/regex.stp - Report opened files whose names match a given regex | |
2346 | keywords: regex | |
2347 | ||
2348 | Uses the regex functionality to detect opened files whose names match | |
2349 | a pattern given on the command line. If no command line parameter is | |
2350 | given, demonstrate by filtering for files that end with an extension | |
2351 | showing them to be an archive. | |
2352 | ||
1f115be7 | 2353 | # stap regex.stp -c "sleep 1" |
fefcef82 FCE |
2354 | |
2355 | ||
210ff7bf FCE |
2356 | = SCHEDULER = |
2357 | ||
deb63545 WC |
2358 | process/chng_cpu.stp - Monitor Changes in Processor Executing a Task |
2359 | keywords: scheduler | |
2360 | ||
2361 | The chng_cpu.stp script takes an argument which is the executable | |
2362 | name of the task it should monitor. Each time a task with that | |
2363 | executable name is found running on a different processor, the script | |
2364 | prints out the thread id (tid), the executable name, the processor | |
2365 | now running the task, the thread state, and a backtrace showing the | |
2366 | kernel functions that triggered the running of the task on the | |
2367 | processor. | |
2368 | ||
1f115be7 | 2369 | # stap chng_cpu.stp -c "sleep 1" bash |
6a51196c | 2370 | |
deb63545 | 2371 | |
cf29c85e | 2372 | process/cycle_thief.stp - Track IRQ's and Other Processes Stealing Cycles from a Task |
b9ae0bc4 | 2373 | keywords: _best process scheduler time tracepoint interrupt |
e01bc08e WC |
2374 | |
2375 | The cycle_thief.stp script instruments the scheduler and IRQ handler | |
2376 | to determine which processes and interrupts are competing with the | |
2377 | specified task for the cpu cycles. This script uses the '-c' or '-x' | |
2378 | options to focus on a specific task. The script output the number of | |
2379 | times the task migrates between processors, histograms showing the | |
2380 | length of time on and off processor, lists of processes running while | |
2381 | the task is off the processor, and the interrupts that occurred while | |
2382 | the task was running. | |
2383 | ||
1f115be7 | 2384 | # stap cycle_thief.stp -c "sleep 1" |
6a51196c | 2385 | |
e01bc08e | 2386 | |
e6b653c8 WC |
2387 | process/forktracker.stp - Trace Creation of Processes |
2388 | keywords: process scheduler | |
2389 | ||
2390 | The forktracker.stp script prints out a time-stamped entry showing | |
f3c4da44 | 2391 | each fork and exec operation on the machine. This can be useful to |
e6b653c8 WC |
2392 | determine what process is creating a flurry of short-lived processes. |
2393 | ||
1f115be7 | 2394 | # stap forktracker.stp -c "sleep 1" |
6a51196c | 2395 | |
e6b653c8 | 2396 | |
deb63545 WC |
2397 | process/migrate.stp - Track the Migration of Specific Executables |
2398 | keywords: scheduler | |
2399 | ||
2400 | The migrate.stp script takes an argument which is the executable name | |
2401 | of the task it should monitor. Each time a task with that executable | |
2402 | name migrates between processors an entry is printed with the process | |
2403 | id (pid), the executable name, the processor off loading the task, | |
2404 | and the process taking the task. Note that the task may or may not be | |
2405 | executing at the time of the migration. | |
2406 | ||
1f115be7 | 2407 | # stap migrate.stp -c "sleep 1" bash |
6a51196c | 2408 | |
deb63545 | 2409 | |
944d282f AJ |
2410 | process/proctop.stp - Periodically Print Process Information With History |
2411 | keywords: process scheduler _best | |
2412 | ||
2413 | Every 5 seconds, print out a list of 25 processes that took the most | |
2414 | system time with information about the processes. Includes | |
2415 | information on processes that may have exited while the script was | |
2416 | running. The script contains configuration options listed in the | |
2417 | script source. | |
2418 | ||
2419 | # stap proctop.stp -c "sleep 1" | |
2420 | ||
2421 | ||
cf29c85e | 2422 | process/schedtimes.stp - Track Time Processes Spend in Various States Using Tracepoints |
34029cd3 WC |
2423 | keywords: process scheduler time tracepoint |
2424 | ||
2425 | The schedtimes.stp script instruments the scheduler to track the | |
f3c4da44 MW |
2426 | amount of time that each process spends in running, sleeping, |
2427 | queuing, and waiting for io. On exit the script prints out the | |
2428 | accumulated time for each state of processes observed. Optionally, | |
2429 | this script can be used with the '-c' or '-x' options to focus on a | |
4cba4e80 | 2430 | specific PID and its children. |
34029cd3 | 2431 | |
1f115be7 | 2432 | # stap schedtimes.stp -c "sleep 1" |
6a51196c | 2433 | |
34029cd3 | 2434 | |
cf29c85e | 2435 | process/sleepingBeauties.stp - Generate Backtraces of Threads Waiting for IO Operations |
09a98ae0 | 2436 | keywords: io scheduler backtrace |
cae71dd3 | 2437 | |
f3c4da44 | 2438 | The script monitors the time that threads spend in waiting for IO |
cae71dd3 FCE |
2439 | operations (in "D" state) in the wait_for_completion function. If a |
2440 | thread spends over 10ms, its name and backtrace is printed, and later | |
2441 | so is the total delay. | |
210ff7bf | 2442 | |
1f115be7 | 2443 | # stap sleepingBeauties.stp -c "sleep 1" |
6a51196c | 2444 | |
210ff7bf | 2445 | |
b9ae0bc4 FCE |
2446 | process/spawn_seeker.stp - Track Creation of Processes by process and execname |
2447 | keywords: process scheduler | |
2448 | ||
2449 | The spawn_seeker.stp script every minute (and on exit) prints out the | |
2450 | local time and sorted lists of which processes and executables | |
2451 | spawned tasks during the previous minute. This can be useful to | |
2452 | determine what process is creating a flurry of short-lived processes. | |
2453 | When a process exits its count of tasks created is added to its | |
2454 | parent's count to better account for the indirect task creation by | |
2455 | children processes. For more detailed examination of task creation | |
2456 | consider using forktracker.stp. | |
2457 | ||
2458 | # stap spawn_seeker.stp -c "sleep 1" | |
2459 | ||
2460 | ||
54ff5e0c FCE |
2461 | = SCSI = |
2462 | ||
cf29c85e | 2463 | io/iostat-scsi.stp - IO Statistics for SCSI Devices |
54ff5e0c FCE |
2464 | keywords: io profiling scsi |
2465 | ||
2466 | The iostat-scsi.stp script provides a breakdown of the number of blks | |
ad7e33d7 | 2467 | read and written on the machine's various SCSI devices. The script |
54ff5e0c FCE |
2468 | takes one argument which is the number of seconds between reports. |
2469 | ||
1f115be7 | 2470 | # stap -g iostat-scsi.stp 1 -c "sleep 1" |
6a51196c | 2471 | |
54ff5e0c | 2472 | |
5481d677 FCE |
2473 | = SECURITY = |
2474 | ||
7080b0c3 | 2475 | process/auditbt.stp - Generate backtraces for kernel audit events |
a8a7b9f4 FCE |
2476 | keywords: monitoring security audit backtrace |
2477 | ||
7080b0c3 FCE |
2478 | Attaches to the kernel audit-log paths (also used by libaudit), and |
2479 | log every record being sent, along with a user-space backtrace of the | |
2480 | process that caused it. | |
a8a7b9f4 | 2481 | |
54a385da | 2482 | # stap auditbt.stp -d /usr/bin/sudo --ldd -c "sudo true" |
a8a7b9f4 FCE |
2483 | |
2484 | ||
cf29c85e | 2485 | process/noptrace.stp - Disable ptrace from Hierarchies of Processes |
1ca36a99 | 2486 | keywords: process security guru |
5481d677 | 2487 | |
cf29c85e FCE |
2488 | Blocks ptrace(2) attempts from processes identified by stap -c/-x, as |
2489 | also specifiable from /proc/systemtap/stap_XXX/ control files. | |
2490 | Processes may be added or removed from the blocked list. | |
5481d677 | 2491 | |
15ecb1fe | 2492 | # stap -g noptrace.stp -c 'strace ls || true' |
6a51196c | 2493 | |
5481d677 | 2494 | |
0c0aaff5 FCE |
2495 | security-band-aids/cve-2008-0600.stp - cve-2008-0600 security band-aid |
2496 | keywords: security guru | |
2497 | ||
2498 | historical emergency security band-aid, for reference/education only | |
2499 | ||
0c0aaff5 FCE |
2500 | |
2501 | security-band-aids/cve-2012-0056.stp - cve-2012-0056 security band-aid | |
2502 | keywords: security guru | |
2503 | ||
2504 | historical emergency security band-aid, for reference/education only | |
2505 | ||
0c0aaff5 FCE |
2506 | |
2507 | security-band-aids/cve-2013-2094.stp - cve-2013-2094 security band-aid | |
2508 | keywords: security guru | |
2509 | ||
2510 | historical emergency security band-aid, for reference/education only | |
2511 | ||
0c0aaff5 FCE |
2512 | |
2513 | security-band-aids/cve-2014-7169.stp - cve-2014-7169 security band-aid | |
2514 | keywords: security guru | |
2515 | ||
2516 | historical emergency security band-aid, for reference/education only | |
2517 | ||
0c0aaff5 FCE |
2518 | |
2519 | security-band-aids/cve-2015-0235.stp - cve-2015-0235 security band-aid | |
2520 | keywords: security guru | |
2521 | ||
2522 | historical emergency security band-aid, for reference/education only | |
2523 | ||
0c0aaff5 FCE |
2524 | |
2525 | security-band-aids/cve-2015-3456.stp - cve-2015-3456 security band-aid | |
2526 | keywords: security guru | |
2527 | ||
2528 | historical emergency security band-aid, for reference/education only | |
6a3b8027 FCE |
2529 | |
2530 | ||
2531 | security-band-aids/cve-2015-7547.stp - cve-2015-7547 security band-aid | |
2532 | keywords: security guru | |
2533 | ||
2534 | historical emergency security band-aid, for reference/education only | |
0c0aaff5 | 2535 | |
0c0aaff5 FCE |
2536 | |
2537 | security-band-aids/cve-2016-0728.stp - cve-2016-0728 security band-aid | |
2538 | keywords: security guru | |
2539 | ||
2540 | historical emergency security band-aid, for reference/education only | |
2541 | ||
0c0aaff5 | 2542 | |
1ca36a99 | 2543 | = SIGNALS = |
f1c6c6ed MW |
2544 | |
2545 | process/psig.stp - Print Process File Descriptors | |
1ca36a99 | 2546 | keywords: process signals |
f1c6c6ed MW |
2547 | |
2548 | Run psig.stp to produce a human-readable summary of the signal | |
2549 | handling configuration of a given process. Specify the process-id as | |
2550 | -x PID for fastest performance. | |
2551 | ||
2552 | # stap -DMAXACTION=10000 -g psig.stp -x $$ | |
2553 | ||
2554 | ||
210ff7bf | 2555 | process/sig_by_pid.stp - Signal Counts by Process ID |
09a98ae0 | 2556 | keywords: signals |
210ff7bf FCE |
2557 | |
2558 | Print signal counts by process ID in descending order. | |
2559 | ||
1f115be7 | 2560 | # stap sig_by_pid.stp -c "sleep 1" |
6a51196c | 2561 | |
210ff7bf FCE |
2562 | |
2563 | process/sig_by_proc.stp - Signal Counts by Process Name | |
09a98ae0 | 2564 | keywords: signals |
210ff7bf FCE |
2565 | |
2566 | Print signal counts by process name in descending order. | |
2567 | ||
1f115be7 | 2568 | # stap sig_by_proc.stp -c "sleep 1" |
6a51196c | 2569 | |
210ff7bf FCE |
2570 | |
2571 | process/sigkill.stp - Track SIGKILL Signals | |
09a98ae0 | 2572 | keywords: signals |
210ff7bf FCE |
2573 | |
2574 | The script traces any SIGKILL signals. When that SIGKILL signal is | |
2575 | sent to a process, the script prints out the signal name, the | |
f3c4da44 MW |
2576 | destination executable and process ID, the executable name and user |
2577 | ID that sents the signal. | |
210ff7bf | 2578 | |
1f115be7 | 2579 | # stap sigkill.stp -c "sleep 1" |
6a51196c | 2580 | |
210ff7bf | 2581 | |
cf29c85e | 2582 | process/sigmon.stp - Track a Particular Signal to a Specific Process |
09a98ae0 | 2583 | keywords: signals |
210ff7bf FCE |
2584 | |
2585 | The script watches for a particular signal sent to a specific | |
2586 | process. When that signal is sent to the specified process, the | |
2587 | script prints out the PID and executable of the process sending the | |
2588 | signal, the PID and executable name of the process receiving the | |
2589 | signal, and the signal number and name. | |
2590 | ||
1f115be7 | 2591 | # stap sigmon.stp -c "sleep 1" SIGKILL |
6a51196c | 2592 | |
210ff7bf FCE |
2593 | |
2594 | = SIMPLE = | |
2595 | ||
81a1a9e8 FCE |
2596 | general/callgraph.stp - Callgraph Tracing |
2597 | keywords: simple trace callgraph | |
2598 | ||
2599 | Print a timed per-thread microsecond-timed nested callgraph. The | |
2600 | first parameter names the function probe points to trace. | |
2601 | ||
2602 | # stap callgraph.stp 'kernel.function("*@fs/proc*.c")' -c "cat \ | |
2603 | /proc/sys/vm/* || true" | |
2604 | ||
2605 | ||
210ff7bf | 2606 | general/helloworld.stp - SystemTap "Hello World" Program |
b9ae0bc4 | 2607 | keywords: _best simple |
210ff7bf FCE |
2608 | |
2609 | A basic "Hello World" program implemented in SystemTap script. It | |
2610 | prints out "hello world" message and then immediately exits. | |
2611 | ||
6a51196c FCE |
2612 | # stap helloworld.stp |
2613 | ||
210ff7bf | 2614 | |
7955f6fd FCE |
2615 | general/py2example.stp - SystemTap python 2 support tapset |
2616 | keywords: simple | |
2617 | ||
2618 | A python support tapset that displays backtraces and variable values | |
2619 | ||
2620 | # stap -I tapset -c '/usr/bin/python2 pyexample.py 35' py2example.stp | |
2621 | ||
2622 | ||
2623 | general/py3example.stp - SystemTap python 3 support tapset | |
2624 | keywords: simple | |
2625 | ||
2626 | A python support tapset that displays backtraces and variable values | |
2627 | ||
2628 | # stap -g --suppress-time-limits -I tapset -c '/usr/bin/python3 \ | |
2629 | pyexample.py 35' py3example.stp | |
2630 | ||
2631 | ||
47300c64 | 2632 | io/eatmydata.stp - disable fsync |
1ca36a99 FCE |
2633 | keywords: io guru simple |
2634 | ||
2635 | Suppresses fsync() syscalls from processes identified by stap -c/-x | |
00b943ad FCE |
2636 | by turning them into presumed-faster fsync() on some dummy or other |
2637 | file descriptor | |
1ca36a99 FCE |
2638 | |
2639 | # stap -g eatmydata.stp -c 'strace ls || true' | |
2640 | ||
2641 | ||
42c55668 MW |
2642 | = SLAB = |
2643 | ||
cf29c85e FCE |
2644 | memory/vm.tracepoints.stp - Collect Slab Allocation Statistics |
2645 | keywords: memory slab statistics | |
42c55668 MW |
2646 | |
2647 | The script will probe all memory slab/slub allocations and collects | |
2648 | information about the size of the object (bytes requested) and | |
2649 | user-space process in execution. When run over a period of time, it | |
2650 | helps to correlate kernel-space memory consumption owing to | |
2651 | user-space processes. | |
2652 | ||
6a51196c FCE |
2653 | # stap vm.tracepoints.stp -c "sleep 10" |
2654 | ||
42c55668 | 2655 | |
cf29c85e | 2656 | = SOCKET = |
210ff7bf | 2657 | |
0e81b7f5 FCE |
2658 | lwtools/accept2close-nd.stp - Show socket lifespan, from accept() to close() (non-debuginfo) |
2659 | keywords: net socket | |
2660 | ||
2661 | This traces socket duration from the accept() syscall to close(), and | |
2662 | provides details on the lifespan of these passive connections, | |
2663 | showing the distribution as a histogram. | |
2664 | ||
2665 | # stap accept2close-nd.stp -c "sleep 1" | |
2666 | ||
2667 | ||
9e749e50 JS |
2668 | network/connect_stat.stp - Show Process Ancestry for IP Connections |
2669 | keywords: network socket process | |
2670 | ||
2671 | The connect_stat.stp script prints a task's entire ancestry (parent | |
2672 | process name/uid/gid) whenever it attempts an outgoing socket | |
2673 | connection to a given IP address. | |
2674 | ||
1f115be7 | 2675 | # stap connect_stat.stp 127.0.0.1 -c "sleep 1" |
9e749e50 JS |
2676 | |
2677 | ||
cf29c85e FCE |
2678 | network/dropwatch.stp - Watch Where Socket Buffers Are Freed in the Kernel |
2679 | keywords: network tracepoint socket | |
210ff7bf | 2680 | |
cf29c85e FCE |
2681 | Every five seconds the dropwatch.stp script lists the number of |
2682 | socket buffers freed at locations in the kernel. | |
6a51196c | 2683 | |
1f115be7 | 2684 | # stap dropwatch.stp -c "sleep 1" |
210ff7bf | 2685 | |
210ff7bf | 2686 | |
cf29c85e | 2687 | network/socket-trace.stp - Trace Functions Called in Network Socket Code |
09a98ae0 | 2688 | keywords: network socket |
210ff7bf | 2689 | |
f3c4da44 MW |
2690 | The script instruments each of the functions in the Linux kernel's |
2691 | net/socket.c file. The script prints out trace data. The first | |
2692 | element of a line is time delta in microseconds from the previous | |
2693 | entry. This is followed by the command name and the PID. The "->" and | |
2694 | "<-" indicates function entry and function exit, respectively. The | |
2695 | last element of the line is the function name. | |
210ff7bf | 2696 | |
1f115be7 | 2697 | # stap socket-trace.stp -c "sleep 1" |
6a51196c | 2698 | |
210ff7bf | 2699 | |
9141644d WC |
2700 | network/socktop - Periodically Summarize Socket Activity on the System |
2701 | keywords: network socket | |
2702 | ||
2703 | The socktop script periodically prints out a list of the processes | |
2704 | with the highest socket activity. Command line options for the | |
2705 | script allow filtering to focus on particular types of sockets. The | |
2706 | "-h" option lists socktop script's filtering options. | |
2707 | ||
6a51196c FCE |
2708 | # ./socktop -c 1 |
2709 | ||
9141644d | 2710 | |
492d227f WC |
2711 | network/tcp_connections.stp - Track Creation of Incoming TCP Connections |
2712 | keywords: network tcp socket | |
2713 | ||
2714 | The tcp_connections.stp script prints information for each new | |
2715 | incoming TCP connection accepted by the computer. The information | |
2716 | includes the UID, the command accepting the connection, the PID of | |
2717 | the command, the port the connection is on, and the IP address of the | |
2718 | originator of the request. | |
2719 | ||
1f115be7 | 2720 | # stap tcp_connections.stp -c "sleep 1" |
6a51196c | 2721 | |
492d227f | 2722 | |
cf29c85e | 2723 | network/tcp_init_cwnd.stp - Increase Initial TCP Congestion Window to 10 |
1ca36a99 | 2724 | keywords: network tcp socket guru |
65bdbf09 FCE |
2725 | |
2726 | Run the tcp_init_cwnd.stp script in the background to override a | |
2727 | kernel's default tcp cwnd value to 10, which has been found to | |
2728 | improve latency for web server type workloads. The script prints a | |
2729 | count of cwnd value changes when it is stopped. | |
2730 | ||
1f115be7 | 2731 | # stap -g tcp_init_cwnd.stp -c "sleep 1" |
65bdbf09 FCE |
2732 | |
2733 | ||
75ed3b3c FCE |
2734 | = SPECULATION = |
2735 | ||
2736 | general/whythefail.stp - Why did the function fail? | |
2737 | keywords: speculation monitoring function trace _best | |
2738 | ||
2739 | The whythefail.stp script prints a statement-execution trace for a | |
2740 | given function, but only for those runs of the function that ended up | |
2741 | with a (configurable) post-return condition. | |
2742 | ||
2743 | # stap whythefail.stp kernel sys_open '$return < 0' -c 'cat \ | |
2744 | /root/no-such-file || true' | |
2745 | ||
2746 | ||
875e1b27 FCE |
2747 | = STAPGAMES = |
2748 | ||
7955f6fd | 2749 | stapgames/2048.stp - 2048 |
b9ae0bc4 | 2750 | keywords: _best stapgames |
7955f6fd FCE |
2751 | |
2752 | The modern classic 2048 sliding-tiles game, using local keyboard and | |
2753 | ansi animation. | |
2754 | ||
2755 | # stap -p4 2048.stp | |
2756 | ||
2757 | ||
875e1b27 FCE |
2758 | stapgames/block.stp - block breaker game |
2759 | keywords: stapgames | |
2760 | ||
2761 | A block game where you progressively break the ceiling blocks until | |
2762 | clearing the level | |
2763 | ||
2764 | # stap -p4 -Itapset/ block.stp | |
2765 | ||
2766 | ||
2767 | stapgames/eater.stp - eater game | |
2768 | keywords: stapgames | |
2769 | ||
2770 | walk through a maze, eat stuff | |
2771 | ||
2772 | # stap -p4 -Itapset/ eater.stp | |
2773 | ||
2774 | ||
2775 | stapgames/lifegame.stp - life game | |
2776 | keywords: stapgames | |
2777 | ||
2778 | watch as your creation morphes into different forms | |
2779 | ||
2780 | # stap -p4 -Itapset/ lifegame.stp | |
2781 | ||
2782 | ||
2783 | stapgames/pingpong.stp - pingpong game | |
2784 | keywords: stapgames | |
2785 | ||
2786 | A simulated ball bounces around the terminal reflecting at the edges | |
2787 | ||
2788 | # stap -p4 -Itapset/ pingpong.stp | |
2789 | ||
2790 | ||
4bb6522c WC |
2791 | = STATISTICS = |
2792 | ||
beb59e38 FCE |
2793 | general/alias_suffixes.stp - Count I/O Syscalls using Alias Suffixes |
2794 | keywords: io statistics | |
2795 | ||
2796 | alias_suffixes.stp is a demonstration of how alias suffixes in the | |
2797 | systemtap language might be used. The script tracks the wall clock | |
2798 | time for each invocation of the system calls open, close, read, and | |
2799 | write. When the script exists it prints out the minimum, average, and | |
2800 | maximum times in microseconds for each system call, followed by a | |
2801 | count of times that each syscall was invoked and a histogram showing | |
2802 | the distributions of times. | |
2803 | ||
1f115be7 | 2804 | # stap alias_suffixes.stp -c "sleep 1" |
beb59e38 FCE |
2805 | |
2806 | ||
cf29c85e | 2807 | general/eventcount.stp - Count Specified Events |
b9ae0bc4 | 2808 | keywords: _best statistics thread process |
cf29c85e | 2809 | |
875e1b27 FCE |
2810 | The script periodically prints a count of specified events and their |
2811 | related tid's over the course of execution. Numerous configuration | |
2812 | options exist to control filtering / reporting, see the script | |
2813 | source. | |
cf29c85e | 2814 | |
1f115be7 | 2815 | # stap eventcount.stp syscall.* -c 'sleep 1' |
cf29c85e FCE |
2816 | |
2817 | ||
2818 | general/func_time_stats.stp - Function Time Statistics | |
2819 | keywords: function statistics | |
2820 | ||
2821 | The func_time_stats.stp script tracks the wall clock time for each | |
2822 | invocation of the function probe listed as the first command line | |
2823 | argument. When the script exits it prints out the minimum, average, | |
2824 | and maximum times in microseconds followed by a count of times that | |
2825 | the function was called and a histogram showing the distributions of | |
2826 | times. | |
2827 | ||
1f115be7 | 2828 | # stap func_time_stats.stp 'syscall.nanosleep' -c "sleep 1" |
cf29c85e FCE |
2829 | |
2830 | ||
2831 | general/sizeof.stp - Print the Size of a C Type | |
2832 | keywords: statistics memory | |
3cfd512b FCE |
2833 | |
2834 | This script prints the size of a type, based on dwarf debuginfo for | |
2835 | any kernel or userspace module, or trial-compilation of a given | |
2836 | header file name. | |
2837 | ||
6a51196c FCE |
2838 | # stap sizeof.stp FILE '</usr/include/stdio.h>' |
2839 | ||
3cfd512b | 2840 | |
cf29c85e FCE |
2841 | memory/vm.tracepoints.stp - Collect Slab Allocation Statistics |
2842 | keywords: memory slab statistics | |
2843 | ||
2844 | The script will probe all memory slab/slub allocations and collects | |
2845 | information about the size of the object (bytes requested) and | |
2846 | user-space process in execution. When run over a period of time, it | |
2847 | helps to correlate kernel-space memory consumption owing to | |
2848 | user-space processes. | |
2849 | ||
2850 | # stap vm.tracepoints.stp -c "sleep 10" | |
2851 | ||
2852 | ||
a89c2e98 FL |
2853 | network/net_xmit_json.stp - Tracks time between packet queue and transmit. |
2854 | keywords: network statistics json | |
2855 | ||
2856 | This script tracks time between packet queue and transmit. The | |
2857 | information is provided to userspace via procfs in JSON format. | |
2858 | ||
2859 | # stap net_xmit_json.stp -c "sleep 1" | |
2860 | ||
2861 | ||
d12c1a86 FCE |
2862 | network/nfsd-recent.stp - Keep track of NFS server statistics |
2863 | keywords: nfs statistics | |
2864 | ||
2865 | This script tracks all nfsd server operations by client_ip address, | |
2866 | and periodically lists those clients that have made recent requests. | |
2867 | It's a way of finding out which nfs clients might be considered still | |
2868 | connected. | |
2869 | ||
1f115be7 | 2870 | # stap nfsd-recent.stp -c "sleep 1" |
d12c1a86 FCE |
2871 | |
2872 | ||
5882f170 DS |
2873 | network/nfsdtop.stp - Keep track of NFS server statistics |
2874 | keywords: nfs statistics | |
2875 | ||
2876 | The nfsdtop.stp script gathers and displays NFS lookups, | |
2877 | ||
3b33d8c4 | 2878 | # stap nfsdtop.stp -c "sleep 1" |
5882f170 DS |
2879 | |
2880 | ||
cf29c85e | 2881 | network/tcpipstat.stp - Display Network Statistics for Individual TCP Sockets |
4bb6522c WC |
2882 | keywords: network statistics |
2883 | ||
cf29c85e FCE |
2884 | The tcpipstat script collects and displays network statistics related |
2885 | to individual TCP sockets or groups of sockets. The statistics that | |
2886 | are collected are simular to that of the command netstat -s, only | |
2887 | sorted and grouped by individual sockets. | |
4bb6522c | 2888 | |
6a51196c FCE |
2889 | # stap tcpipstat.stp timeout=1 |
2890 | ||
4bb6522c | 2891 | |
210ff7bf FCE |
2892 | = SYSCALL = |
2893 | ||
2894 | io/iotime.stp - Trace Time Spent in Read and Write for Files | |
cf29c85e | 2895 | keywords: profiling syscall io file |
210ff7bf FCE |
2896 | |
2897 | The script watches each open, close, read, and write syscalls on the | |
2898 | system. For each file the scripts observes opened it accumulates the | |
f3c4da44 | 2899 | amount of wall clock time spent in read and write operations and the |
210ff7bf FCE |
2900 | number of bytes read and written. When a file is closed the script |
2901 | prints out a pair of lines for the file. Both lines begin with a | |
2902 | timestamp in microseconds, the PID number, and the executable name in | |
ad7e33d7 | 2903 | parentheses. The first line with the "access" keyword lists the file |
210ff7bf FCE |
2904 | name, the attempted number of bytes for the read and write |
2905 | operations. The second line with the "iotime" keyword list the file | |
2906 | name and the number of microseconds accumulated in the read and write | |
2907 | syscalls. | |
2908 | ||
1f115be7 | 2909 | # stap iotime.stp -c "sleep 1" |
6a51196c | 2910 | |
210ff7bf | 2911 | |
cf29c85e | 2912 | process/errsnoop.stp - Tabulate System Call Errors |
cc20d853 ET |
2913 | keywords: process syscall |
2914 | ||
cf29c85e FCE |
2915 | Prints a periodic tabular report about failing system calls, by |
2916 | process and by syscall failure. The first optional argument | |
2917 | specifies the reporting interval (in seconds, default 5); the second | |
2918 | optional argument gives a screen height (number of lines in the | |
2919 | report, default 20). | |
cc20d853 | 2920 | |
6a51196c FCE |
2921 | # stap errsnoop.stp 1 10 -c "sleep 1" |
2922 | ||
cc20d853 | 2923 | |
210ff7bf | 2924 | process/futexes.stp - System-Wide Futex Contention |
09a98ae0 | 2925 | keywords: syscall locking futex |
210ff7bf FCE |
2926 | |
2927 | The script watches the futex syscall on the system. On exit the | |
0fb74e68 | 2928 | futex's address, the number of contentions, and the average time for |
210ff7bf FCE |
2929 | each contention on the futex are printed from lowest pid number to |
2930 | highest. | |
2931 | ||
1f115be7 | 2932 | # stap futexes.stp -c "sleep 1" |
6a51196c | 2933 | |
210ff7bf | 2934 | |
0fb74e68 JS |
2935 | process/futexes2.stp - System-Wide Shared Futex Contention |
2936 | keywords: syscall locking futex | |
2937 | ||
2938 | The script watches just shared futex syscalls on the system. On exit | |
2939 | the futex's key, the number of contentions, and the average time for | |
2940 | each contention on the futex are printed from lowest pid number to | |
2941 | highest. | |
2942 | ||
1f115be7 | 2943 | # stap futexes2.stp -c "sleep 1" |
0fb74e68 JS |
2944 | |
2945 | ||
677b471e JL |
2946 | process/procmod_watcher.stp - Monitor process creation/termination and module [un]loading |
2947 | keywords: process monitoring syscall tracepoint | |
2948 | ||
2949 | The procmod_watcher.stp script monitors calls to fork(), exec(), | |
2950 | exit(), init_module(), and delete_module(). Event-specific details | |
2951 | are also printed out (e.g. for exec(), the file being exec'ed). This | |
2952 | script does not require debuginfo. | |
2953 | ||
1f115be7 | 2954 | # stap procmod_watcher.stp -c "sleep 1" |
677b471e JL |
2955 | |
2956 | ||
cf29c85e FCE |
2957 | process/sleeptime.stp - Trace Time Spent in Nanosleep Syscalls |
2958 | keywords: syscall nanosleep | |
210ff7bf FCE |
2959 | |
2960 | The script watches each nanosleep syscall on the system. At the end | |
2961 | of each nanosleep syscall the script prints out a line with a | |
2962 | timestamp in microseconds, the pid, the executable name in | |
ad7e33d7 | 2963 | parentheses, the "nanosleep:" key, and the duration of the sleep in |
210ff7bf FCE |
2964 | microseconds. |
2965 | ||
1f115be7 | 2966 | # stap sleeptime.stp -c "sleep 1" |
6a51196c | 2967 | |
210ff7bf | 2968 | |
cbaf758e | 2969 | process/strace.stp - Trace system calls |
b9ae0bc4 | 2970 | keywords: _best process syscall |
cbaf758e FCE |
2971 | |
2972 | The script loosely emulates strace, when applied to individual | |
2973 | processes or hierarchies (via -c/-x), or the entire system (without | |
2974 | -c/-x). A few output configuration parameters may be set with -G. | |
2975 | ||
2976 | # stap strace.stp -c "sleep 1" | |
2977 | ||
2978 | ||
210ff7bf | 2979 | process/syscalls_by_pid.stp - System-Wide Count of Syscalls by PID |
09a98ae0 | 2980 | keywords: syscall |
210ff7bf FCE |
2981 | |
2982 | The script watches all syscall on the system. On exit the script | |
2983 | prints a list showing the number of systemcalls executed by each PID | |
2984 | ordered from greatest to least number of syscalls. | |
2985 | ||
1f115be7 | 2986 | # stap syscalls_by_pid.stp -c "sleep 1" |
6a51196c | 2987 | |
210ff7bf FCE |
2988 | |
2989 | process/syscalls_by_proc.stp - System-Wide Count of Syscalls by Executable | |
09a98ae0 | 2990 | keywords: syscall |
210ff7bf FCE |
2991 | |
2992 | The script watches all syscall on the system. On exit the script | |
2993 | prints a list showing the number of systemcalls executed by each | |
ad7e33d7 | 2994 | executable ordered from greatest to least number of syscalls. |
210ff7bf | 2995 | |
1f115be7 | 2996 | # stap syscalls_by_proc.stp -c "sleep 1" |
6a51196c | 2997 | |
210ff7bf | 2998 | |
cf29c85e | 2999 | process/syscalltimes - System-Wide Syscall Statistics with Filtering |
04ae04b5 MW |
3000 | keywords: syscall |
3001 | ||
3002 | Combination shell/systemtap script to measure system call counts and | |
3003 | times. Can be filtered by process IDs, process names and users. | |
3004 | ||
1f115be7 | 3005 | # ./syscalltimes -c 'sleep 1' |
04ae04b5 MW |
3006 | |
3007 | ||
c29c6f83 | 3008 | process/thread-business.stp - monitor syscall history |
b9ae0bc4 | 3009 | keywords: _best process syscall |
c29c6f83 FCE |
3010 | |
3011 | Prints a periodic tabular report about the counts of syscall activity | |
3012 | of all threads on the system, along with a textual | |
3013 | recent-syscall-history for each | |
3014 | ||
3015 | # stap thread-business.stp -c "sleep 10" | |
3016 | ||
3017 | ||
210ff7bf | 3018 | process/wait4time.stp - Trace Time Spent in wait4 Syscalls |
74e5c5cf | 3019 | keywords: syscall process |
210ff7bf FCE |
3020 | |
3021 | The script watches each wait4 syscall on the system. At the end of | |
3022 | each wait4 syscall the script prints out a line with a timestamp in | |
ad7e33d7 | 3023 | microseconds, the pid, the executable name in parentheses, the |
210ff7bf FCE |
3024 | "wait4:" key, the duration of the wait and the PID that the wait4 was |
3025 | waiting for. If the waited for PID is not specified , it is "-1". | |
3026 | ||
1f115be7 | 3027 | # stap wait4time.stp -c "sleep 1" |
6a51196c | 3028 | |
210ff7bf | 3029 | |
492d227f WC |
3030 | = TCP = |
3031 | ||
905728a0 | 3032 | network/sk_stream_wait_memory.stp - Track Start and Stop of Processes Due to Network Buffer Space |
cf29c85e | 3033 | keywords: network tcp process |
905728a0 WC |
3034 | |
3035 | The sk_stream-wait_memory.stp prints a time stamp, executable, and | |
3036 | pid each time a process blocks due to the send buffer being full. A | |
3037 | similar entry is printed each time a process continues because there | |
3038 | is room in the buffer. | |
3039 | ||
1f115be7 | 3040 | # stap sk_stream_wait_memory.stp -c "sleep 1" |
6a51196c | 3041 | |
905728a0 | 3042 | |
492d227f WC |
3043 | network/tcp_connections.stp - Track Creation of Incoming TCP Connections |
3044 | keywords: network tcp socket | |
3045 | ||
3046 | The tcp_connections.stp script prints information for each new | |
3047 | incoming TCP connection accepted by the computer. The information | |
3048 | includes the UID, the command accepting the connection, the PID of | |
3049 | the command, the port the connection is on, and the IP address of the | |
3050 | originator of the request. | |
3051 | ||
1f115be7 | 3052 | # stap tcp_connections.stp -c "sleep 1" |
6a51196c | 3053 | |
492d227f | 3054 | |
cf29c85e | 3055 | network/tcp_init_cwnd.stp - Increase Initial TCP Congestion Window to 10 |
1ca36a99 | 3056 | keywords: network tcp socket guru |
65bdbf09 FCE |
3057 | |
3058 | Run the tcp_init_cwnd.stp script in the background to override a | |
3059 | kernel's default tcp cwnd value to 10, which has been found to | |
3060 | improve latency for web server type workloads. The script prints a | |
3061 | count of cwnd value changes when it is stopped. | |
3062 | ||
1f115be7 | 3063 | # stap -g tcp_init_cwnd.stp -c "sleep 1" |
65bdbf09 FCE |
3064 | |
3065 | ||
cf29c85e | 3066 | = THREAD = |
db5bfb14 | 3067 | |
cf29c85e | 3068 | general/eventcount.stp - Count Specified Events |
b9ae0bc4 | 3069 | keywords: _best statistics thread process |
db5bfb14 | 3070 | |
875e1b27 FCE |
3071 | The script periodically prints a count of specified events and their |
3072 | related tid's over the course of execution. Numerous configuration | |
3073 | options exist to control filtering / reporting, see the script | |
3074 | source. | |
db5bfb14 | 3075 | |
1f115be7 | 3076 | # stap eventcount.stp syscall.* -c 'sleep 1' |
db5bfb14 FCE |
3077 | |
3078 | ||
875e1b27 | 3079 | process/threadstacks.stp - Override default new-pthread stack sizes |
1ca36a99 | 3080 | keywords: thread guru |
875e1b27 FCE |
3081 | |
3082 | Overrides default NPTL pthread_create stack size for all new threads | |
3083 | created by target processes. Reports one line per process when the | |
3084 | related glibc variable __default_stacksize is updated. Moot for | |
3085 | glibc versions that support $LIBC_PTHREAD_DEFAULT_STACKSIZE_NP. | |
3086 | ||
f70a0bc5 | 3087 | # stap -g threadstacks.stp -Gsize=65536 -c "sleep 1" -d `which stap` |
875e1b27 FCE |
3088 | |
3089 | ||
210ff7bf FCE |
3090 | = TIME = |
3091 | ||
1345075d WC |
3092 | general/stopwatches.stp - See the amount of wall clock time a process spends in various states |
3093 | keywords: time | |
3094 | ||
3095 | The stopwatch.stp script illustrates how to use multiple stopwatches | |
3096 | record how much wallclock time a process spends in kernel- and | |
3097 | user-space. On exit the script prints out the time in seconds, | |
3098 | milliseconds, microseconds, and nanoseconds. Note that this output of | |
3099 | this script is not directly comparable to the time command because | |
3100 | time records the time that the process is actually active in kernel- | |
3101 | and user-space. | |
3102 | ||
1f115be7 | 3103 | # stap stopwatches.stp -c "sleep 1" |
1345075d WC |
3104 | |
3105 | ||
cf29c85e | 3106 | process/cycle_thief.stp - Track IRQ's and Other Processes Stealing Cycles from a Task |
b9ae0bc4 | 3107 | keywords: _best process scheduler time tracepoint interrupt |
e01bc08e WC |
3108 | |
3109 | The cycle_thief.stp script instruments the scheduler and IRQ handler | |
3110 | to determine which processes and interrupts are competing with the | |
3111 | specified task for the cpu cycles. This script uses the '-c' or '-x' | |
3112 | options to focus on a specific task. The script output the number of | |
3113 | times the task migrates between processors, histograms showing the | |
3114 | length of time on and off processor, lists of processes running while | |
3115 | the task is off the processor, and the interrupts that occurred while | |
3116 | the task was running. | |
3117 | ||
1f115be7 | 3118 | # stap cycle_thief.stp -c "sleep 1" |
6a51196c | 3119 | |
e01bc08e | 3120 | |
cf29c85e | 3121 | process/schedtimes.stp - Track Time Processes Spend in Various States Using Tracepoints |
34029cd3 WC |
3122 | keywords: process scheduler time tracepoint |
3123 | ||
3124 | The schedtimes.stp script instruments the scheduler to track the | |
f3c4da44 MW |
3125 | amount of time that each process spends in running, sleeping, |
3126 | queuing, and waiting for io. On exit the script prints out the | |
3127 | accumulated time for each state of processes observed. Optionally, | |
3128 | this script can be used with the '-c' or '-x' options to focus on a | |
4cba4e80 | 3129 | specific PID and its children. |
34029cd3 | 3130 | |
1f115be7 | 3131 | # stap schedtimes.stp -c "sleep 1" |
6a51196c | 3132 | |
34029cd3 | 3133 | |
210ff7bf FCE |
3134 | = TRACE = |
3135 | ||
81a1a9e8 FCE |
3136 | general/callgraph.stp - Callgraph Tracing |
3137 | keywords: simple trace callgraph | |
3138 | ||
3139 | Print a timed per-thread microsecond-timed nested callgraph. The | |
3140 | first parameter names the function probe points to trace. | |
3141 | ||
3142 | # stap callgraph.stp 'kernel.function("*@fs/proc*.c")' -c "cat \ | |
3143 | /proc/sys/vm/* || true" | |
3144 | ||
3145 | ||
cf29c85e | 3146 | general/para-callgraph-verbose.stp - Callgraph Tracing with Verbose Arguments |
2515d897 JS |
3147 | keywords: trace callgraph |
3148 | ||
03568589 FCE |
3149 | Print a timed per-thread microsecond-timed callgraph, complete with |
3150 | pretty-printed function parameters and return values. The first | |
3151 | parameter names the function probe points to trace. The optional | |
3152 | second parameter names the probe points for trigger functions, which | |
3153 | acts to enable tracing for only those functions that occur while the | |
3154 | current thread is nested within the trigger. | |
2515d897 | 3155 | |
6a51196c | 3156 | # stap para-callgraph-verbose.stp 'kernel.function("*@fs/proc*.c")' \ |
15ecb1fe | 3157 | 'kernel.function("vfs_read")' -c "cat /proc/sys/vm/* || true" |
6a51196c | 3158 | |
2515d897 | 3159 | |
cf29c85e | 3160 | general/para-callgraph.stp - Callgraph Tracing with Arguments |
b9ae0bc4 | 3161 | keywords: _best trace callgraph |
210ff7bf | 3162 | |
03568589 FCE |
3163 | Print a timed per-thread microsecond-timed callgraph, complete with |
3164 | function parameters and return values. The first parameter names the | |
3165 | function probe points to trace. The optional second parameter names | |
3166 | the probe points for trigger functions, which acts to enable tracing | |
3167 | for only those functions that occur while the current thread is | |
3168 | nested within the trigger. | |
210ff7bf | 3169 | |
6a51196c | 3170 | # stap para-callgraph.stp 'kernel.function("*@fs/proc*.c")' \ |
15ecb1fe | 3171 | 'kernel.function("vfs_read")' -c "cat /proc/sys/vm/* || true" |
6a51196c | 3172 | |
210ff7bf | 3173 | |
75ed3b3c FCE |
3174 | general/whythefail.stp - Why did the function fail? |
3175 | keywords: speculation monitoring function trace _best | |
3176 | ||
3177 | The whythefail.stp script prints a statement-execution trace for a | |
3178 | given function, but only for those runs of the function that ended up | |
3179 | with a (configurable) post-return condition. | |
3180 | ||
3181 | # stap whythefail.stp kernel sys_open '$return < 0' -c 'cat \ | |
3182 | /root/no-such-file || true' | |
3183 | ||
3184 | ||
cf29c85e | 3185 | network/tcp_trace.stp - TCP Connection Tracing Utility |
2e251678 DW |
3186 | keywords: network trace |
3187 | ||
cf29c85e | 3188 | This scripts traces a given TCP connection based on the filter |
2e251678 DW |
3189 | parameters given by the user. The indexing is done by the 4 tuples |
3190 | local address, remote address, local port, remote port. | |
3191 | ||
6a51196c FCE |
3192 | # stap tcp_trace.stp 127.0.0.1:*-127.0.0.1:* timeout=1 |
3193 | ||
2e251678 | 3194 | |
0e4901b0 WC |
3195 | = TRACEPOINT = |
3196 | ||
cf29c85e FCE |
3197 | network/dropwatch.stp - Watch Where Socket Buffers Are Freed in the Kernel |
3198 | keywords: network tracepoint socket | |
0e4901b0 WC |
3199 | |
3200 | Every five seconds the dropwatch.stp script lists the number of | |
3201 | socket buffers freed at locations in the kernel. | |
3202 | ||
1f115be7 | 3203 | # stap dropwatch.stp -c "sleep 1" |
6a51196c | 3204 | |
0e4901b0 | 3205 | |
cf29c85e | 3206 | process/cycle_thief.stp - Track IRQ's and Other Processes Stealing Cycles from a Task |
b9ae0bc4 | 3207 | keywords: _best process scheduler time tracepoint interrupt |
e01bc08e WC |
3208 | |
3209 | The cycle_thief.stp script instruments the scheduler and IRQ handler | |
3210 | to determine which processes and interrupts are competing with the | |
3211 | specified task for the cpu cycles. This script uses the '-c' or '-x' | |
3212 | options to focus on a specific task. The script output the number of | |
3213 | times the task migrates between processors, histograms showing the | |
3214 | length of time on and off processor, lists of processes running while | |
3215 | the task is off the processor, and the interrupts that occurred while | |
3216 | the task was running. | |
3217 | ||
1f115be7 | 3218 | # stap cycle_thief.stp -c "sleep 1" |
6a51196c | 3219 | |
e01bc08e | 3220 | |
677b471e JL |
3221 | process/procmod_watcher.stp - Monitor process creation/termination and module [un]loading |
3222 | keywords: process monitoring syscall tracepoint | |
3223 | ||
3224 | The procmod_watcher.stp script monitors calls to fork(), exec(), | |
3225 | exit(), init_module(), and delete_module(). Event-specific details | |
3226 | are also printed out (e.g. for exec(), the file being exec'ed). This | |
3227 | script does not require debuginfo. | |
3228 | ||
1f115be7 | 3229 | # stap procmod_watcher.stp -c "sleep 1" |
677b471e JL |
3230 | |
3231 | ||
cf29c85e | 3232 | process/schedtimes.stp - Track Time Processes Spend in Various States Using Tracepoints |
34029cd3 WC |
3233 | keywords: process scheduler time tracepoint |
3234 | ||
3235 | The schedtimes.stp script instruments the scheduler to track the | |
f3c4da44 MW |
3236 | amount of time that each process spends in running, sleeping, |
3237 | queuing, and waiting for io. On exit the script prints out the | |
3238 | accumulated time for each state of processes observed. Optionally, | |
3239 | this script can be used with the '-c' or '-x' options to focus on a | |
4cba4e80 | 3240 | specific PID and its children. |
34029cd3 | 3241 | |
1f115be7 | 3242 | # stap schedtimes.stp -c "sleep 1" |
6a51196c | 3243 | |
34029cd3 | 3244 | |
210ff7bf FCE |
3245 | = TRAFFIC = |
3246 | ||
53e5699f JS |
3247 | network/netdev.stp - Trace Activity on Network Devices |
3248 | keywords: network device traffic | |
3249 | ||
3250 | The netdev.stp script traces configuration and transmit/receive | |
3251 | activity on network devices. | |
3252 | ||
1f115be7 | 3253 | # stap netdev.stp -c "sleep 1" |
6a51196c | 3254 | |
53e5699f | 3255 | |
57db0e6f | 3256 | network/netfilter_summary.stp - System-Wide Count of Network Packets by IPs |
b9ae0bc4 | 3257 | keywords: _best network traffic |
57db0e6f MW |
3258 | |
3259 | The script watches all IPv4 network traffic on the system. On exit | |
3260 | the script prints a list showing the number of packets sent along | |
3261 | source IP address / destination IP address pair encountered, and the | |
3262 | total number of bytes sent among the pair. The list is ordered from | |
3263 | greatest to least number of packets seen among the source/destination | |
3264 | pairs. | |
3265 | ||
1f115be7 | 3266 | # stap netfilter_summary.stp -c "sleep 1" |
57db0e6f MW |
3267 | |
3268 | ||
a89c2e98 FL |
3269 | network/netfilter_summary_json.stp - System-Wide Count of Network Packets by IPs |
3270 | keywords: _best network traffic json | |
3271 | ||
3272 | The script watches all IPv4 network traffic on the system. The data | |
3273 | is output in JSON format and includes the number of packets sent | |
3274 | along source IP address / destination IP address pair encountered, | |
3275 | and the total number of bytes sent among the pair. | |
3276 | ||
3277 | # stap netfilter_summary_json.stp -c "sleep 1" | |
3278 | ||
3279 | ||
210ff7bf | 3280 | network/nettop.stp - Periodic Listing of Processes Using Network Interfaces |
74e5c5cf | 3281 | keywords: network traffic |
210ff7bf FCE |
3282 | |
3283 | Every five seconds the nettop.stp script prints out a list of | |
3284 | processed (PID and command) with the number of packets sent/received | |
3285 | and the amount of data sent/received by the process during that | |
3286 | interval. | |
3287 | ||
1f115be7 | 3288 | # stap nettop.stp -c "sleep 1" |
6a51196c | 3289 | |
210ff7bf | 3290 | |
a89c2e98 FL |
3291 | network/stp_dump.stp - Dump of STP packets |
3292 | keywords: network traffic | |
3293 | ||
3294 | The stp_dump.stp prints out the packet contents. Each block contains | |
3295 | the STP protocol ID, version ID, flags, root and bridge MAC | |
3296 | addresses, and various times. | |
3297 | ||
9e6206fd | 3298 | # stap stp_dump.stp -c "sleep 5" |
a89c2e98 FL |
3299 | |
3300 | ||
5cf50309 | 3301 | network/tcpdumplike.stp - Dump of Received UDP/TCP Packets |
7a51212c WC |
3302 | keywords: network traffic |
3303 | ||
5cf50309 FCE |
3304 | The tcpdumplike.stp prints out a line for each TCP & UDP packet |
3305 | received. Each line includes the source and destination IP addresses, | |
3306 | the source and destination ports, and flags. | |
7a51212c | 3307 | |
1f115be7 | 3308 | # stap tcpdumplike.stp -c "sleep 1" |
6a51196c | 3309 | |
7a51212c | 3310 | |
b7f6cfc5 FCE |
3311 | = TTY = |
3312 | ||
cf29c85e | 3313 | io/ttyspy.stp - Monitor TTY Typing |
1ca36a99 | 3314 | keywords: io tty monitoring guru |
b7f6cfc5 FCE |
3315 | |
3316 | The ttyspy.stp script uses tty_audit hooks to monitor recent typing | |
3317 | activity on the system, printing a scrolling record of recent | |
3318 | keystrokes, on a per-tty basis. | |
3319 | ||
6a51196c FCE |
3320 | # stap --skip-badvars -g ttyspy.stp -c "sleep 1" |
3321 | ||
b7f6cfc5 | 3322 | |
cf29c85e | 3323 | = UTILIZATION = |
210ff7bf FCE |
3324 | |
3325 | general/graphs.stp - Graphing Disk and CPU Utilization | |
cf29c85e | 3326 | keywords: disk cpu utilization |
210ff7bf FCE |
3327 | |
3328 | The script tracks the disk and CPU utilization. The resulting output | |
3329 | of the script can be piped into gnuplot to generate a graph of disk | |
3330 | and CPU USE. | |
3331 | ||
1f115be7 | 3332 | # stap graphs.stp -c "sleep 1" |
6a51196c | 3333 | |
210ff7bf | 3334 | |
8c6bb289 WC |
3335 | = VIRTUALIZATION = |
3336 | ||
cf29c85e | 3337 | virtualization/kvm_service_time.stp - Time Statistics on KVM Exit Reasons |
b9ae0bc4 | 3338 | keywords: _best virtualization kvm |
98ec0359 FCE |
3339 | |
3340 | The kvm_service_time.stp script tracks the statistics about the | |
3341 | amount of time that the processor left the guest virtual machine for | |
3342 | each exit reason (for example fixing up a page table or handling an | |
3343 | IO operation). When the script exits it prints out the number of | |
3344 | times each exit reason was encountered, the total duration of time it | |
3345 | left the guest VM, the minimum time, the average time, and the | |
3346 | maximum time in microseconds for that exit reason. On Linux 2.6.38 | |
3347 | and newer kernel the script can automatically determine whether it is | |
3348 | running on Intel or AMD processors. For older kernels with a | |
3349 | kernel.trace("kvm_exit") tracepoint that does not have the $isa | |
3350 | parameter you can explicitly state the kvm type with a "-G kvm=intel" | |
3351 | or "-G kvm=amd" on the command line. | |
3352 | ||
1f115be7 | 3353 | # stap kvm_service_time.stp -c "sleep 1" |
98ec0359 FCE |
3354 | |
3355 | ||
cf29c85e | 3356 | virtualization/qemu_count.stp - Tally the Number of User-Space QEMU Events |
8c6bb289 WC |
3357 | keywords: virtualization qemu kvm |
3358 | ||
3359 | The qemu_count.stp script tallies the number of times each of the | |
3360 | user-space qemu probepoints is encountered. When the script exits, it | |
3361 | prints a list of the number of times each user-space qemu probepoint | |
3362 | is encountered. | |
3363 | ||
1f115be7 | 3364 | # stap qemu_count.stp -c "sleep 1" |
8c6bb289 WC |
3365 | |
3366 | ||
cf29c85e | 3367 | virtualization/qemu_io.stp - Tally the Number of User-Space QEMU IO on Each IO Port |
8c6bb289 WC |
3368 | keywords: virtualization qemu kvm io |
3369 | ||
3370 | The qemu_io.stp script tallies the number of times each of the IO | |
3371 | port on the guest virtual machines is touched by a input or output | |
3372 | operation. When the script exits, it prints a count of the number of | |
3373 | times each IO port read and written. | |
3374 | ||
1f115be7 | 3375 | # stap qemu_io.stp -c "sleep 1" |
8c6bb289 WC |
3376 | |
3377 | ||
2dfeb3bf WC |
3378 | = WATCHDOG = |
3379 | ||
cf29c85e | 3380 | general/watchdog.stp - Watchdog Timer for Arbitrary Events |
2dfeb3bf WC |
3381 | keywords: watchdog backtrace |
3382 | ||
3383 | The watchdog.stp script provides a watchdog timer mechanism for | |
3384 | arbitrary events. The script takes three arguments: the events to | |
3385 | start watchdog timer, the event to stop the watchdog timer, and the | |
3386 | time in millseconds for the watchdog. If the watchdog timer is | |
3387 | exceed, the script will trigger a stack backtrace of the user-process | |
3388 | that timed out using pstack. This script can be used to diagnose what | |
3389 | the userspace application is doing when a slower than expected | |
3390 | operation occurs. | |
3391 | ||
3392 | # stap watchdog.stp 'syscall.nanosleep' 'syscall.nanosleep.return' 1000 \ | |
1f115be7 | 3393 | -c "sleep 1" |
2dfeb3bf WC |
3394 | |
3395 | ||
54d84647 WC |
3396 | = WATCHPOINT = |
3397 | ||
cf29c85e | 3398 | memory/hw_watch_addr.stp - Watch a Kernel Address Using Breakpoint Hardware |
54d84647 WC |
3399 | keywords: memory watchpoint |
3400 | ||
3401 | The script will watch accesses to a single kernel address and prints | |
3402 | a traceback each time the address is accessed. This script needs to | |
3403 | be run as root to allow access to the breakpoint hardware. | |
3404 | ||
23063de1 | 3405 | # stap --all-modules hw_watch_addr.stp 0x`grep "vm_dirty_ratio" \ |
0a9d3bc8 | 3406 | /proc/kallsyms | awk '{print $1}'` -c "sleep 5" |
54d84647 WC |
3407 | |
3408 | ||
cf29c85e | 3409 | memory/hw_watch_sym.stp - Watch a Kernel Symbol Using Breakpoint Hardware |
54d84647 WC |
3410 | keywords: memory watchpoint |
3411 | ||
3412 | The script will watch accesses to the starting address of a single | |
3413 | kernel symbol and prints a traceback each time the symbol is | |
3414 | accessed. This script needs to be run as root to allow access to the | |
3415 | breakpoint hardware. | |
3416 | ||
23063de1 | 3417 | # stap --all-modules hw_watch_sym.stp vm_dirty_ratio -c "sleep 5" |
54d84647 WC |
3418 | |
3419 |