]>
Commit | Line | Data |
---|---|---|
210ff7bf | 1 | SYSTEMTAP EXAMPLES INDEX BY KEYWORD |
09a98ae0 | 2 | (see also index.txt) |
210ff7bf | 3 | |
42c55668 MW |
4 | = ALLOCATOR = |
5 | ||
6 | memory/vm.tracepoints.stp - Collect slab allocation statistics | |
7 | keywords: memory slab allocator | |
8 | ||
9 | The script will probe all memory slab/slub allocations and collects | |
10 | information about the size of the object (bytes requested) and | |
11 | user-space process in execution. When run over a period of time, it | |
12 | helps to correlate kernel-space memory consumption owing to | |
13 | user-space processes. | |
14 | ||
15 | ||
8b88e771 FCE |
16 | = AUTOFS = |
17 | ||
18 | network/autofs4.stp - Watch autofs4 operations | |
19 | keywords: network autofs nfs | |
20 | ||
21 | Trace key autofs4 operations such as mounting or unmounting remote | |
22 | filesystems. | |
23 | ||
24 | ||
210ff7bf FCE |
25 | = BACKTRACE = |
26 | ||
1cc8a4c7 WC |
27 | interrupt/scf.stp - Tally Backtraces for Inter-Processor Interrupt (IPI) |
28 | keywords: interrupt backtrace | |
29 | ||
30 | The Linux kernel function smp_call_function causes expensive | |
31 | inter-processor interrupts (IPIs). The scf.stp script tallies the | |
32 | processes and backtraces causing the interprocessor interrupts to | |
33 | identify the cause of the expensive IPI. On exit the script prints | |
34 | the tallies in descending frequency. | |
35 | ||
36 | ||
210ff7bf | 37 | io/io_submit.stp - Tally Reschedule Reason During AIO io_submit Call |
09a98ae0 | 38 | keywords: io backtrace |
210ff7bf FCE |
39 | |
40 | When a reschedule occurs during an AIO io_submit call, accumulate the | |
41 | traceback in a histogram. When the script exits prints out a sorted | |
42 | list from most common to least common backtrace. | |
43 | ||
44 | ||
42d42e06 JS |
45 | process/dumpstack.stp - Print the kernel stack of a hung task |
46 | keywords: process backtrace | |
47 | ||
48 | The script prints the kernel stack of any non-running pid in the | |
49 | system. This is useful for diagnosing the reason that a task is | |
50 | hung. | |
51 | ||
52 | ||
cae71dd3 | 53 | process/sleepingBeauties.stp - Generating Backtraces of Threads Waiting for IO Operations |
09a98ae0 | 54 | keywords: io scheduler backtrace |
cae71dd3 | 55 | |
f3c4da44 | 56 | The script monitors the time that threads spend in waiting for IO |
cae71dd3 FCE |
57 | operations (in "D" state) in the wait_for_completion function. If a |
58 | thread spends over 10ms, its name and backtrace is printed, and later | |
59 | so is the total delay. | |
60 | ||
61 | ||
0e4901b0 WC |
62 | = BUFFER = |
63 | ||
64 | network/dropwatch.stp - Watch Where Socket Buffers are Freed in the Kernel | |
65 | keywords: network tracepoint buffer free | |
66 | ||
67 | Every five seconds the dropwatch.stp script lists the number of | |
68 | socket buffers freed at locations in the kernel. | |
69 | ||
70 | ||
905728a0 WC |
71 | network/sk_stream_wait_memory.stp - Track Start and Stop of Processes Due to Network Buffer Space |
72 | keywords: network tcp buffer memory | |
73 | ||
74 | The sk_stream-wait_memory.stp prints a time stamp, executable, and | |
75 | pid each time a process blocks due to the send buffer being full. A | |
76 | similar entry is printed each time a process continues because there | |
77 | is room in the buffer. | |
78 | ||
79 | ||
210ff7bf FCE |
80 | = CALLGRAPH = |
81 | ||
aa15b9f0 | 82 | general/para-callgraph.stp - Callgraph tracing with arguments |
09a98ae0 | 83 | keywords: trace callgraph |
210ff7bf | 84 | |
aa15b9f0 FCE |
85 | Print a timed per-thread callgraph, complete with function parameters |
86 | and return values. The first parameter names the function probe | |
87 | points to trace. The optional second parameter names the probe | |
88 | points for trigger functions, which acts to enable tracing for only | |
89 | those functions that occur while the current thread is nested within | |
90 | the trigger. | |
210ff7bf FCE |
91 | |
92 | ||
93 | = CPU = | |
94 | ||
95 | general/graphs.stp - Graphing Disk and CPU Utilization | |
09a98ae0 | 96 | keywords: disk cpu use graph |
210ff7bf FCE |
97 | |
98 | The script tracks the disk and CPU utilization. The resulting output | |
99 | of the script can be piped into gnuplot to generate a graph of disk | |
100 | and CPU USE. | |
101 | ||
102 | ||
53e5699f JS |
103 | = DEVICE = |
104 | ||
105 | network/netdev.stp - Trace Activity on Network Devices | |
106 | keywords: network device traffic | |
107 | ||
108 | The netdev.stp script traces configuration and transmit/receive | |
109 | activity on network devices. | |
110 | ||
111 | ||
210ff7bf FCE |
112 | = DISK = |
113 | ||
114 | general/graphs.stp - Graphing Disk and CPU Utilization | |
09a98ae0 | 115 | keywords: disk cpu use graph |
210ff7bf FCE |
116 | |
117 | The script tracks the disk and CPU utilization. The resulting output | |
118 | of the script can be piped into gnuplot to generate a graph of disk | |
119 | and CPU USE. | |
120 | ||
121 | ||
122 | io/disktop.stp - Summarize Disk Read/Write Traffic | |
09a98ae0 | 123 | keywords: disk |
210ff7bf FCE |
124 | |
125 | Get the status of reading/writing disk every 5 seconds, output top | |
126 | ten entries during that period. | |
127 | ||
128 | ||
ecf33ff4 ET |
129 | = FILES = |
130 | ||
131 | process/pfiles.stp - print process file descriptors | |
132 | keywords: process files | |
133 | ||
134 | Run pfiles.stp to produce a human-readable summary of all open file | |
135 | descriptors of a given process. Specify the process-id as -x PID for | |
136 | fastest performance. | |
137 | ||
138 | ||
ac505f97 JS |
139 | = FILESYSTEM = |
140 | ||
141 | general/badname.stp - Bad Filename Filter | |
142 | keywords: filesystem hack | |
143 | ||
144 | The badname.stp script shows how one could prevent the creation of | |
6287a9e6 | 145 | files with undesirable names using guru mode. |
ac505f97 JS |
146 | |
147 | ||
0e0b566a WC |
148 | = FORMAT = |
149 | ||
150 | general/ansi_colors.stp - Color Table for ansi_set_color2() and ansi_set_color3() | |
151 | keywords: format | |
152 | ||
153 | The script prints a table showing the available color combinations | |
154 | for the ansi_set_color2() and ans_set_color3() functions in the | |
155 | ansi.stp tapset. | |
156 | ||
157 | ||
158 | general/ansi_colors2.stp - Show Attribues in Table for ansi_set_color3() | |
159 | keywords: format | |
160 | ||
161 | The script prints a table showing the available attributes (bold, | |
162 | underline, and inverse) with color combinations for the | |
163 | ans_set_color3() function in the ansi.stp tapset. | |
164 | ||
165 | ||
0e4901b0 WC |
166 | = FREE = |
167 | ||
168 | network/dropwatch.stp - Watch Where Socket Buffers are Freed in the Kernel | |
169 | keywords: network tracepoint buffer free | |
170 | ||
171 | Every five seconds the dropwatch.stp script lists the number of | |
172 | socket buffers freed at locations in the kernel. | |
173 | ||
174 | ||
210ff7bf FCE |
175 | = FUNCTIONS = |
176 | ||
177 | profiling/functioncallcount.stp - Count Times Functions Called | |
09a98ae0 | 178 | keywords: profiling functions |
210ff7bf FCE |
179 | |
180 | The functioncallcount.stp script takes one argument, a list of | |
181 | functions to probe. The script will run and count the number of times | |
182 | that each of the functions on the list is called. On exit the script | |
183 | will print a sorted list from most frequently to least frequently | |
184 | called function. | |
185 | ||
186 | ||
0449af03 JS |
187 | profiling/sched_switch.stp - Display the task switches happening in the scheduler |
188 | keywords: profiling functions | |
189 | ||
190 | The sched_switch.stp script takes two arguments, first argument can | |
191 | be "pid" or "name" to indicate what is being passed as second | |
192 | argument. The script will trace the process based on pid/name and | |
193 | print the scheduler switches happening with the process. If no | |
194 | arguments are passed, it displays all the scheduler switches. This | |
195 | can be used to understand which tasks schedule out the current | |
196 | process being traced, and when it gets scheduled in again. | |
197 | ||
198 | ||
210ff7bf FCE |
199 | = FUTEX = |
200 | ||
201 | process/futexes.stp - System-Wide Futex Contention | |
09a98ae0 | 202 | keywords: syscall locking futex |
210ff7bf FCE |
203 | |
204 | The script watches the futex syscall on the system. On exit the | |
205 | futexes address, the number of contentions, and the average time for | |
206 | each contention on the futex are printed from lowest pid number to | |
207 | highest. | |
208 | ||
209 | ||
210 | = GRAPH = | |
211 | ||
212 | general/graphs.stp - Graphing Disk and CPU Utilization | |
09a98ae0 | 213 | keywords: disk cpu use graph |
210ff7bf FCE |
214 | |
215 | The script tracks the disk and CPU utilization. The resulting output | |
216 | of the script can be piped into gnuplot to generate a graph of disk | |
217 | and CPU USE. | |
218 | ||
219 | ||
ac505f97 JS |
220 | = HACK = |
221 | ||
222 | general/badname.stp - Bad Filename Filter | |
223 | keywords: filesystem hack | |
224 | ||
225 | The badname.stp script shows how one could prevent the creation of | |
6287a9e6 | 226 | files with undesirable names using guru mode. |
ac505f97 JS |
227 | |
228 | ||
1cc8a4c7 WC |
229 | = INTERRUPT = |
230 | ||
6b95efe9 JS |
231 | interrupt/interrupts-by-dev.stp - Record interrupts on a per-device basis. |
232 | keywords: interrupt | |
233 | ||
234 | The interrupts-by-dev.stp script profiles interrupts received by each | |
235 | device per 100 ms. | |
236 | ||
237 | ||
1cc8a4c7 WC |
238 | interrupt/scf.stp - Tally Backtraces for Inter-Processor Interrupt (IPI) |
239 | keywords: interrupt backtrace | |
240 | ||
241 | The Linux kernel function smp_call_function causes expensive | |
242 | inter-processor interrupts (IPIs). The scf.stp script tallies the | |
243 | processes and backtraces causing the interprocessor interrupts to | |
244 | identify the cause of the expensive IPI. On exit the script prints | |
245 | the tallies in descending frequency. | |
246 | ||
247 | ||
e01bc08e WC |
248 | process/cycle_thief.stp - Track IRQs and Other Processes Stealing Cycles from a Task |
249 | keywords: process scheduler time tracepoint interrupt | |
250 | ||
251 | The cycle_thief.stp script instruments the scheduler and IRQ handler | |
252 | to determine which processes and interrupts are competing with the | |
253 | specified task for the cpu cycles. This script uses the '-c' or '-x' | |
254 | options to focus on a specific task. The script output the number of | |
255 | times the task migrates between processors, histograms showing the | |
256 | length of time on and off processor, lists of processes running while | |
257 | the task is off the processor, and the interrupts that occurred while | |
258 | the task was running. | |
259 | ||
260 | ||
210ff7bf FCE |
261 | = IO = |
262 | ||
263 | io/io_submit.stp - Tally Reschedule Reason During AIO io_submit Call | |
09a98ae0 | 264 | keywords: io backtrace |
210ff7bf FCE |
265 | |
266 | When a reschedule occurs during an AIO io_submit call, accumulate the | |
267 | traceback in a histogram. When the script exits prints out a sorted | |
268 | list from most common to least common backtrace. | |
269 | ||
270 | ||
67f8611b WC |
271 | io/ioblktime.stp - Average Time Block IO Requests Spend in Queue |
272 | keywords: io | |
273 | ||
274 | The ioblktime.stp script tracks the amount of time that each block IO | |
cc20d853 | 275 | requests spend waiting for completion. The script computes the |
f3c4da44 MW |
276 | average waiting time for block IO per device and prints list every 10 |
277 | seconds. In some cases there can be too many outstanding block IO | |
278 | operations and the script may exceed the default number of | |
67f8611b WC |
279 | MAXMAPENTRIES allowed. In this case the allowed number can be |
280 | increased with "-DMAXMAPENTRIES=10000" option on the stap command | |
281 | line. | |
282 | ||
283 | ||
a4f3198f WC |
284 | io/iodevstats.stp - List Executables Reading and Writing the Most Data by Device |
285 | keywords: io profiling | |
286 | ||
287 | The iodevstats.stp script measures the amount of data successfully | |
288 | read and written by all the executables for each io device on the | |
289 | system. The output is sorted from greatest sum of bytes read and | |
290 | written to a device by an executable to the least. The output | |
291 | contains device major/minor number, the count of operations (reads | |
292 | and writes), the totals and averages for the number of bytes read and | |
293 | written. | |
294 | ||
295 | ||
54ff5e0c FCE |
296 | io/iostat-scsi.stp - iostat for SCSI Devices |
297 | keywords: io profiling scsi | |
298 | ||
299 | The iostat-scsi.stp script provides a breakdown of the number of blks | |
ad7e33d7 | 300 | read and written on the machine's various SCSI devices. The script |
54ff5e0c FCE |
301 | takes one argument which is the number of seconds between reports. |
302 | ||
303 | ||
3e4444ed WC |
304 | io/iostats.stp - List Executables Reading and Writing the Most Data |
305 | keywords: io profiling | |
306 | ||
307 | The iostat.stp script measures the amount of data successfully read | |
308 | and written by all the executables on the system. The output is | |
309 | sorted from most greatest sum of bytes read and written by an | |
310 | executable to the least. The output contains the count of operations | |
311 | (opens, reads, and writes), the totals and averages for the number of | |
312 | bytes read and written. | |
313 | ||
314 | ||
210ff7bf | 315 | io/iotime.stp - Trace Time Spent in Read and Write for Files |
09a98ae0 | 316 | keywords: syscall read write time io |
210ff7bf FCE |
317 | |
318 | The script watches each open, close, read, and write syscalls on the | |
319 | system. For each file the scripts observes opened it accumulates the | |
f3c4da44 | 320 | amount of wall clock time spent in read and write operations and the |
210ff7bf FCE |
321 | number of bytes read and written. When a file is closed the script |
322 | prints out a pair of lines for the file. Both lines begin with a | |
323 | timestamp in microseconds, the PID number, and the executable name in | |
ad7e33d7 | 324 | parentheses. The first line with the "access" keyword lists the file |
210ff7bf FCE |
325 | name, the attempted number of bytes for the read and write |
326 | operations. The second line with the "iotime" keyword list the file | |
327 | name and the number of microseconds accumulated in the read and write | |
328 | syscalls. | |
329 | ||
330 | ||
331 | io/iotop.stp - Periodically Print I/O Activity by Process Name | |
09a98ae0 | 332 | keywords: io |
210ff7bf FCE |
333 | |
334 | Every five seconds print out the top ten executables generating I/O | |
335 | traffic during that interval sorted in descending order. | |
336 | ||
337 | ||
1beb5089 FCE |
338 | io/mbrwatch.stp - Monitor read/write of MBR (boot sector) area of block devices |
339 | keywords: io monitoring | |
340 | ||
341 | The mbrwatch.stp script reports any attempted reads/writes of the | |
342 | first few sectors of a raw block device. | |
343 | ||
344 | ||
111dd9ac WC |
345 | io/nfs_func_users.stp - Tally the Number of NFS Functions Used by Each Process |
346 | keywords: io profiling | |
347 | ||
348 | The nfs_func_users.stp script counts the uses of NFS functions in the | |
349 | kernel on a per process bases. The output is sorted from the process | |
350 | with the greatest number of NFS functions called to the least. The | |
351 | output contains the executable name, the process number, and the | |
352 | total number of NFS functions called by the process. | |
353 | ||
354 | ||
210ff7bf | 355 | io/traceio.stp - Track Cumulative I/O Activity by Process Name |
09a98ae0 | 356 | keywords: io |
210ff7bf FCE |
357 | |
358 | Every second print out the top ten executables sorted in descending | |
359 | order based on cumulative I/O traffic observed. | |
360 | ||
361 | ||
362 | io/traceio2.stp - Watch I/O Activity on a Particular Device | |
09a98ae0 | 363 | keywords: io |
210ff7bf FCE |
364 | |
365 | Print out the executable name and process number as reads and writes | |
366 | to the specified device occur. | |
367 | ||
368 | ||
b7f6cfc5 | 369 | io/ttyspy.stp - Monitor tty typing. |
14f0bb18 | 370 | keywords: io tty per-process monitoring |
b7f6cfc5 FCE |
371 | |
372 | The ttyspy.stp script uses tty_audit hooks to monitor recent typing | |
373 | activity on the system, printing a scrolling record of recent | |
374 | keystrokes, on a per-tty basis. | |
375 | ||
376 | ||
210ff7bf | 377 | process/sleepingBeauties.stp - Generating Backtraces of Threads Waiting for IO Operations |
09a98ae0 | 378 | keywords: io scheduler backtrace |
210ff7bf | 379 | |
f3c4da44 | 380 | The script monitors the time that threads spend in waiting for IO |
cae71dd3 FCE |
381 | operations (in "D" state) in the wait_for_completion function. If a |
382 | thread spends over 10ms, its name and backtrace is printed, and later | |
383 | so is the total delay. | |
210ff7bf FCE |
384 | |
385 | ||
386 | = LOCKING = | |
387 | ||
cf5023fb WC |
388 | locks/bkl.stp - Tracing Contention on Big Kernel Lock (BKL) |
389 | keywords: locking | |
390 | ||
391 | The bkl.stp script can help determine whether the Big Kernel Lock | |
392 | (BKL) is causing serialization on a multiprocessor system due to | |
393 | excessive contention of the BKL. The bkl.stp script takes one | |
394 | argument which is the number of processes waiting for the Big Kernel | |
395 | Lock (BKL). When the number of processes waiting for the BKL is | |
396 | reached or exceeded, the script will print a time stamp, the number | |
397 | of processes waiting for the BKL, the holder of the BKL, and the | |
398 | amount of time the BKL was held. | |
399 | ||
400 | ||
401 | locks/bkl_stats.stp - Per Process Statistics on Big Kernel Lock (BKL) Use | |
402 | keywords: locking | |
403 | ||
404 | The bkl_stats.stp script can indicate which processes have excessive | |
405 | waits for the Big Kernel Lock (BKL) and which processes are taking | |
406 | the BKL for long periods of time. The bkl_stats.stp script prints | |
407 | lists of all the processes that require the BKL. Every five seconds | |
408 | two tables are printed out. The first table lists the processes that | |
409 | waited for the BKL followed by the number of times that the process | |
410 | waited, the minimum time of the wait, the average and the maximum | |
411 | time waited. The second table lists has similar information for the | |
f3c4da44 | 412 | time spent in holding the lock for each of the processes. |
cf5023fb WC |
413 | |
414 | ||
210ff7bf | 415 | process/futexes.stp - System-Wide Futex Contention |
09a98ae0 | 416 | keywords: syscall locking futex |
210ff7bf FCE |
417 | |
418 | The script watches the futex syscall on the system. On exit the | |
419 | futexes address, the number of contentions, and the average time for | |
420 | each contention on the futex are printed from lowest pid number to | |
421 | highest. | |
422 | ||
423 | ||
22f971e8 WC |
424 | = MEMORY = |
425 | ||
426 | memory/kmalloc-top - Show Paths to Kernel Malloc (kmalloc) Invocations | |
427 | keywords: memory | |
428 | ||
429 | The kmalloc-top perl program runs a small systemtap script to collect | |
430 | stack traces for each call to the kmalloc function and counts the | |
431 | time that each stack trace is observed. When kmalloc-top exits it | |
f3c4da44 MW |
432 | prints out sorted list. The output can be filtered to print only the |
433 | first N stack traces (-t), stack traces with a minimum counts (-m), | |
434 | or exclude certain stack traces (-e). | |
22f971e8 WC |
435 | |
436 | ||
0dc23d1d WC |
437 | memory/mmanonpage.stp - Track Virtual Memory System Actions on Anonymous Pages |
438 | keywords: memory | |
439 | ||
440 | The mmanonpage.stp script uses the virtual memory tracepoints | |
441 | available in some kernels to track the number of faults, user space | |
442 | frees, page ins, copy on writes and unmaps for anonymous pages. When | |
443 | the script is terminated the counts are printed for each process that | |
444 | allocated pages while the script was running. This script displays | |
445 | the anonymous page statistics for each process that ran while the | |
f3c4da44 | 446 | script is active. It's useful in debugging leaks in the anonymous |
0dc23d1d WC |
447 | regions of a process. |
448 | ||
449 | ||
450 | memory/mmfilepage.stp - Track Virtual Memory System Actions on File Backed Pages | |
451 | keywords: memory | |
452 | ||
453 | The mmfilepage.stp script uses the virtual memory tracepoints | |
454 | available in some kernels to track the number of faults, copy on | |
455 | writes mapping, and unmapping operations for file backed pages. When | |
456 | the script is terminated the counts are printed for each process that | |
457 | allocated pages while the script was running. The mmfilepage.stp | |
458 | script is useful in debugging leaks in the mapped file regions of a | |
459 | process. | |
460 | ||
461 | ||
462 | memory/mmreclaim.stp - Track Virtual Memory System Page Reclamation | |
463 | keywords: memory | |
464 | ||
465 | The mmreclaim.stp script uses the virtual memory tracepoints | |
ad7e33d7 | 466 | available in some kernels to track page reclaim activity that |
f3c4da44 | 467 | occurred while the script was running. It's useful in debugging |
ad7e33d7 | 468 | performance problems that occur due to page reclamation. |
0dc23d1d WC |
469 | |
470 | ||
471 | memory/mmwriteback.stp - Track Virtual Memory System Writing to Disk | |
472 | keywords: memory | |
473 | ||
474 | The mmwriteback.stp script uses the virtual memory tracepoints | |
475 | available in some kernels to report all of the file writebacks that | |
476 | occur form kupdate, pdflush and kjournald while the script is | |
f3c4da44 MW |
477 | running. It's useful in determining where writes are coming from on |
478 | a supposedly idle system that is experiencing unexpected IO. | |
0dc23d1d WC |
479 | |
480 | ||
c728b7da WC |
481 | memory/numa_faults.stp - Summarize Process Misses across NUMA Nodes |
482 | keywords: memory numa | |
483 | ||
484 | The numa_faults.stp script tracks the read and write pages faults for | |
485 | each process. When the script exits it prints out the total read and | |
ad7e33d7 | 486 | write pages faults for each process. The script also provide a break |
c728b7da WC |
487 | down of page faults per node for each process. This script is useful |
488 | for determining whether the program has good locality (page faults | |
489 | limited to a single node) on a NUMA computer. | |
490 | ||
491 | ||
1ff1a65d FCE |
492 | memory/overcommit.stp - Log failed process memory allocation due to overcommit limits |
493 | keywords: memory process | |
494 | ||
495 | The overcommit.stp script prints a line each time the kernel refuses | |
496 | a memory allocation request from a process because of | |
497 | /proc/sys/vm/overcommit* limits. | |
498 | ||
499 | ||
413996e0 WC |
500 | memory/pfaults.stp - Generate Log of Major and Minor Page Faults |
501 | keywords: memory | |
502 | ||
503 | The pfaults.stp script generates a simple log for each major and | |
504 | minor page fault that occurs on the system. Each line contains a | |
505 | timestamp (in microseconds) when the page fault servicing was | |
506 | completed, the pid of the process, the address of the page fault, the | |
507 | type of access (read or write), the type of fault (major or minor), | |
508 | and the elapsed time for page fault. This log can be examined to | |
ad7e33d7 | 509 | determine where the page faults are occurring. |
413996e0 WC |
510 | |
511 | ||
42c55668 MW |
512 | memory/vm.tracepoints.stp - Collect slab allocation statistics |
513 | keywords: memory slab allocator | |
514 | ||
515 | The script will probe all memory slab/slub allocations and collects | |
516 | information about the size of the object (bytes requested) and | |
517 | user-space process in execution. When run over a period of time, it | |
518 | helps to correlate kernel-space memory consumption owing to | |
519 | user-space processes. | |
520 | ||
521 | ||
905728a0 WC |
522 | network/sk_stream_wait_memory.stp - Track Start and Stop of Processes Due to Network Buffer Space |
523 | keywords: network tcp buffer memory | |
524 | ||
525 | The sk_stream-wait_memory.stp prints a time stamp, executable, and | |
526 | pid each time a process blocks due to the send buffer being full. A | |
527 | similar entry is printed each time a process continues because there | |
528 | is room in the buffer. | |
529 | ||
530 | ||
14f0bb18 | 531 | = MONITORING = |
b7f6cfc5 | 532 | |
14f0bb18 FCE |
533 | general/varwatch.stp - Watch a variable changing value in a thread. |
534 | keywords: monitoring | |
b7f6cfc5 | 535 | |
14f0bb18 FCE |
536 | This script places a set of probes (specified by $1), each of which |
537 | monitors the state of some context $variable expression (specified by | |
538 | $2). Whenever the value changes, with respect to the active thread, | |
539 | the event is traced. | |
b7f6cfc5 | 540 | |
1beb5089 FCE |
541 | |
542 | io/mbrwatch.stp - Monitor read/write of MBR (boot sector) area of block devices | |
543 | keywords: io monitoring | |
544 | ||
545 | The mbrwatch.stp script reports any attempted reads/writes of the | |
546 | first few sectors of a raw block device. | |
547 | ||
548 | ||
14f0bb18 FCE |
549 | io/ttyspy.stp - Monitor tty typing. |
550 | keywords: io tty per-process monitoring | |
551 | ||
552 | The ttyspy.stp script uses tty_audit hooks to monitor recent typing | |
553 | activity on the system, printing a scrolling record of recent | |
554 | keystrokes, on a per-tty basis. | |
555 | ||
556 | ||
210ff7bf FCE |
557 | = NETWORK = |
558 | ||
8b88e771 FCE |
559 | network/autofs4.stp - Watch autofs4 operations |
560 | keywords: network autofs nfs | |
561 | ||
562 | Trace key autofs4 operations such as mounting or unmounting remote | |
563 | filesystems. | |
564 | ||
565 | ||
0e4901b0 WC |
566 | network/dropwatch.stp - Watch Where Socket Buffers are Freed in the Kernel |
567 | keywords: network tracepoint buffer free | |
568 | ||
569 | Every five seconds the dropwatch.stp script lists the number of | |
570 | socket buffers freed at locations in the kernel. | |
571 | ||
572 | ||
53e5699f JS |
573 | network/netdev.stp - Trace Activity on Network Devices |
574 | keywords: network device traffic | |
575 | ||
576 | The netdev.stp script traces configuration and transmit/receive | |
577 | activity on network devices. | |
578 | ||
579 | ||
210ff7bf | 580 | network/nettop.stp - Periodic Listing of Processes Using Network Interfaces |
09a98ae0 | 581 | keywords: network traffic per-process |
210ff7bf FCE |
582 | |
583 | Every five seconds the nettop.stp script prints out a list of | |
584 | processed (PID and command) with the number of packets sent/received | |
585 | and the amount of data sent/received by the process during that | |
586 | interval. | |
587 | ||
588 | ||
905728a0 WC |
589 | network/sk_stream_wait_memory.stp - Track Start and Stop of Processes Due to Network Buffer Space |
590 | keywords: network tcp buffer memory | |
591 | ||
592 | The sk_stream-wait_memory.stp prints a time stamp, executable, and | |
593 | pid each time a process blocks due to the send buffer being full. A | |
594 | similar entry is printed each time a process continues because there | |
595 | is room in the buffer. | |
596 | ||
597 | ||
210ff7bf | 598 | network/socket-trace.stp - Trace Functions called in Network Socket Code |
09a98ae0 | 599 | keywords: network socket |
210ff7bf | 600 | |
f3c4da44 MW |
601 | The script instruments each of the functions in the Linux kernel's |
602 | net/socket.c file. The script prints out trace data. The first | |
603 | element of a line is time delta in microseconds from the previous | |
604 | entry. This is followed by the command name and the PID. The "->" and | |
605 | "<-" indicates function entry and function exit, respectively. The | |
606 | last element of the line is the function name. | |
210ff7bf FCE |
607 | |
608 | ||
492d227f WC |
609 | network/tcp_connections.stp - Track Creation of Incoming TCP Connections |
610 | keywords: network tcp socket | |
611 | ||
612 | The tcp_connections.stp script prints information for each new | |
613 | incoming TCP connection accepted by the computer. The information | |
614 | includes the UID, the command accepting the connection, the PID of | |
615 | the command, the port the connection is on, and the IP address of the | |
616 | originator of the request. | |
617 | ||
618 | ||
2e251678 DW |
619 | network/tcp_trace.stp - Tcp connection tracing utility. |
620 | keywords: network trace | |
621 | ||
622 | This scripts traces a given tcp connection based on the filter | |
623 | parameters given by the user. The indexing is done by the 4 tuples | |
624 | local address, remote address, local port, remote port. | |
625 | ||
626 | ||
7a51212c WC |
627 | network/tcpdumplike.stp - Dump of Received TCP Packets |
628 | keywords: network traffic | |
629 | ||
630 | The tcpdumplike.stp prints out a line for each TCP packet received. | |
631 | Each line includes the source and destination IP addresses, the | |
632 | source and destination ports, and flags. | |
633 | ||
634 | ||
4bb6522c WC |
635 | network/tcpipstat.stp - Display network statistics for individual TCP sockets. |
636 | keywords: network statistics | |
637 | ||
f3c4da44 | 638 | tcpipstat collects and displays network statistics related to |
4bb6522c | 639 | individual TCP sockets or groups of sockets. The statistics that are |
f3c4da44 | 640 | collected are simular to that of the command netstat -s, only sorted |
4bb6522c WC |
641 | and grouped by individual sockets. |
642 | ||
643 | ||
8b88e771 FCE |
644 | = NFS = |
645 | ||
646 | network/autofs4.stp - Watch autofs4 operations | |
647 | keywords: network autofs nfs | |
648 | ||
649 | Trace key autofs4 operations such as mounting or unmounting remote | |
650 | filesystems. | |
651 | ||
652 | ||
c728b7da WC |
653 | = NUMA = |
654 | ||
655 | memory/numa_faults.stp - Summarize Process Misses across NUMA Nodes | |
656 | keywords: memory numa | |
657 | ||
658 | The numa_faults.stp script tracks the read and write pages faults for | |
659 | each process. When the script exits it prints out the total read and | |
ad7e33d7 | 660 | write pages faults for each process. The script also provide a break |
c728b7da WC |
661 | down of page faults per node for each process. This script is useful |
662 | for determining whether the program has good locality (page faults | |
663 | limited to a single node) on a NUMA computer. | |
664 | ||
665 | ||
210ff7bf FCE |
666 | = PER-PROCESS = |
667 | ||
b7f6cfc5 | 668 | io/ttyspy.stp - Monitor tty typing. |
14f0bb18 | 669 | keywords: io tty per-process monitoring |
b7f6cfc5 FCE |
670 | |
671 | The ttyspy.stp script uses tty_audit hooks to monitor recent typing | |
672 | activity on the system, printing a scrolling record of recent | |
673 | keystrokes, on a per-tty basis. | |
674 | ||
675 | ||
210ff7bf | 676 | network/nettop.stp - Periodic Listing of Processes Using Network Interfaces |
09a98ae0 | 677 | keywords: network traffic per-process |
210ff7bf FCE |
678 | |
679 | Every five seconds the nettop.stp script prints out a list of | |
680 | processed (PID and command) with the number of packets sent/received | |
681 | and the amount of data sent/received by the process during that | |
682 | interval. | |
683 | ||
684 | ||
cc20d853 ET |
685 | = PROCESS = |
686 | ||
1ff1a65d FCE |
687 | memory/overcommit.stp - Log failed process memory allocation due to overcommit limits |
688 | keywords: memory process | |
689 | ||
690 | The overcommit.stp script prints a line each time the kernel refuses | |
691 | a memory allocation request from a process because of | |
692 | /proc/sys/vm/overcommit* limits. | |
693 | ||
694 | ||
e01bc08e WC |
695 | process/cycle_thief.stp - Track IRQs and Other Processes Stealing Cycles from a Task |
696 | keywords: process scheduler time tracepoint interrupt | |
697 | ||
698 | The cycle_thief.stp script instruments the scheduler and IRQ handler | |
699 | to determine which processes and interrupts are competing with the | |
700 | specified task for the cpu cycles. This script uses the '-c' or '-x' | |
701 | options to focus on a specific task. The script output the number of | |
702 | times the task migrates between processors, histograms showing the | |
703 | length of time on and off processor, lists of processes running while | |
704 | the task is off the processor, and the interrupts that occurred while | |
705 | the task was running. | |
706 | ||
707 | ||
42d42e06 JS |
708 | process/dumpstack.stp - Print the kernel stack of a hung task |
709 | keywords: process backtrace | |
710 | ||
711 | The script prints the kernel stack of any non-running pid in the | |
712 | system. This is useful for diagnosing the reason that a task is | |
713 | hung. | |
714 | ||
715 | ||
cc20d853 ET |
716 | process/errsnoop.stp - tabulate system call errors |
717 | keywords: process syscall | |
718 | ||
719 | The script prints a periodic tabular report about failing system | |
720 | calls, by process and by syscall failure. The first optional | |
721 | argument specifies the reporting interval (in seconds, default 5); | |
722 | the second optional argument gives a screen height (number of lines | |
723 | in the report, default 20). | |
724 | ||
725 | ||
e6b653c8 WC |
726 | process/forktracker.stp - Trace Creation of Processes |
727 | keywords: process scheduler | |
728 | ||
729 | The forktracker.stp script prints out a time-stamped entry showing | |
f3c4da44 | 730 | each fork and exec operation on the machine. This can be useful to |
e6b653c8 WC |
731 | determine what process is creating a flurry of short-lived processes. |
732 | ||
733 | ||
ecf33ff4 ET |
734 | process/pfiles.stp - print process file descriptors |
735 | keywords: process files | |
736 | ||
737 | Run pfiles.stp to produce a human-readable summary of all open file | |
738 | descriptors of a given process. Specify the process-id as -x PID for | |
739 | fastest performance. | |
740 | ||
741 | ||
5b8642a2 FCE |
742 | process/plimit.stp - print resource limits |
743 | keywords: process | |
744 | ||
745 | The script prints a variety of resource limits for a given pid, like | |
746 | /proc/$$/limits on recent kernels. | |
747 | ||
748 | ||
34029cd3 WC |
749 | process/schedtimes.stp - Track Time Processes Spend in Various States using Tracepoints |
750 | keywords: process scheduler time tracepoint | |
751 | ||
752 | The schedtimes.stp script instruments the scheduler to track the | |
f3c4da44 MW |
753 | amount of time that each process spends in running, sleeping, |
754 | queuing, and waiting for io. On exit the script prints out the | |
755 | accumulated time for each state of processes observed. Optionally, | |
756 | this script can be used with the '-c' or '-x' options to focus on a | |
757 | specific PID. | |
34029cd3 WC |
758 | |
759 | ||
210ff7bf FCE |
760 | = PROFILING = |
761 | ||
a4f3198f WC |
762 | io/iodevstats.stp - List Executables Reading and Writing the Most Data by Device |
763 | keywords: io profiling | |
764 | ||
765 | The iodevstats.stp script measures the amount of data successfully | |
766 | read and written by all the executables for each io device on the | |
767 | system. The output is sorted from greatest sum of bytes read and | |
768 | written to a device by an executable to the least. The output | |
769 | contains device major/minor number, the count of operations (reads | |
770 | and writes), the totals and averages for the number of bytes read and | |
771 | written. | |
772 | ||
773 | ||
54ff5e0c FCE |
774 | io/iostat-scsi.stp - iostat for SCSI Devices |
775 | keywords: io profiling scsi | |
776 | ||
777 | The iostat-scsi.stp script provides a breakdown of the number of blks | |
ad7e33d7 | 778 | read and written on the machine's various SCSI devices. The script |
54ff5e0c FCE |
779 | takes one argument which is the number of seconds between reports. |
780 | ||
781 | ||
3e4444ed WC |
782 | io/iostats.stp - List Executables Reading and Writing the Most Data |
783 | keywords: io profiling | |
784 | ||
785 | The iostat.stp script measures the amount of data successfully read | |
786 | and written by all the executables on the system. The output is | |
787 | sorted from most greatest sum of bytes read and written by an | |
788 | executable to the least. The output contains the count of operations | |
789 | (opens, reads, and writes), the totals and averages for the number of | |
790 | bytes read and written. | |
791 | ||
792 | ||
111dd9ac WC |
793 | io/nfs_func_users.stp - Tally the Number of NFS Functions Used by Each Process |
794 | keywords: io profiling | |
795 | ||
796 | The nfs_func_users.stp script counts the uses of NFS functions in the | |
797 | kernel on a per process bases. The output is sorted from the process | |
798 | with the greatest number of NFS functions called to the least. The | |
799 | output contains the executable name, the process number, and the | |
800 | total number of NFS functions called by the process. | |
801 | ||
802 | ||
210ff7bf | 803 | process/pf2.stp - Profile kernel functions |
09a98ae0 | 804 | keywords: profiling |
210ff7bf FCE |
805 | |
806 | The pf2.stp script sets up time-based sampling. Every five seconds it | |
807 | prints out a sorted list with the top ten kernel functions with | |
808 | samples. | |
809 | ||
810 | ||
f503d3c0 FCE |
811 | profiling/fntimes.stp - Show functions taking longer than usual |
812 | keywords: profiling | |
813 | ||
814 | The fntimes.stp script monitors the execution time history of a given | |
815 | function family (assumed non-recursive). Each time (beyond a warmup | |
816 | interval) is then compared to the historical maximum. If it exceeds | |
817 | a certain threshold (250%), a message is printed. | |
818 | ||
819 | ||
210ff7bf | 820 | profiling/functioncallcount.stp - Count Times Functions Called |
09a98ae0 | 821 | keywords: profiling functions |
210ff7bf FCE |
822 | |
823 | The functioncallcount.stp script takes one argument, a list of | |
824 | functions to probe. The script will run and count the number of times | |
825 | that each of the functions on the list is called. On exit the script | |
826 | will print a sorted list from most frequently to least frequently | |
827 | called function. | |
828 | ||
829 | ||
e985df18 WC |
830 | profiling/linetimes.stp - Show Time Spent on Each Line if a Function |
831 | keywords: profiling | |
832 | ||
833 | The linetimes.stp script takes two arguments: where to find the | |
834 | function and the function name. linetimes.stp will instrument each | |
835 | line in the function. It will print out the number of times that the | |
836 | function is called, a table with the average and maximum time each | |
837 | line takes, and control flow information when the script exits. | |
838 | ||
839 | ||
0449af03 JS |
840 | profiling/sched_switch.stp - Display the task switches happening in the scheduler |
841 | keywords: profiling functions | |
842 | ||
843 | The sched_switch.stp script takes two arguments, first argument can | |
844 | be "pid" or "name" to indicate what is being passed as second | |
845 | argument. The script will trace the process based on pid/name and | |
846 | print the scheduler switches happening with the process. If no | |
847 | arguments are passed, it displays all the scheduler switches. This | |
848 | can be used to understand which tasks schedule out the current | |
849 | process being traced, and when it gets scheduled in again. | |
850 | ||
851 | ||
210ff7bf | 852 | profiling/thread-times.stp - Profile kernel functions |
09a98ae0 | 853 | keywords: profiling |
210ff7bf | 854 | |
1ae72757 JS |
855 | The thread-times.stp script sets up time-based sampling. Every five |
856 | seconds it prints out a sorted list with the top twenty threads | |
857 | occupying the CPUs, broken down as a percentage of user and kernel | |
858 | time. | |
210ff7bf FCE |
859 | |
860 | ||
ff90b297 WC |
861 | profiling/timeout.stp - Show Processes Doing Polling Operations |
862 | keywords: profiling | |
863 | ||
864 | The timeout.stp script is based on a blog entry | |
865 | (http://udrepper.livejournal.com/19041.html) mentioning a need for a | |
866 | tool to help developers find applications that are polling. The | |
867 | timeout.stp script monitors systemcall used for polling and records | |
868 | the systemcalls that timed out rather than returned because some | |
869 | action occurred. The script updates the screen once a second with the | |
870 | top twenty processes. | |
871 | ||
872 | ||
1bf72dfe WC |
873 | profiling/topsys.stp - Show Processes Doing Polling Operations |
874 | keywords: profiling | |
875 | ||
876 | The topsys.stp script lists out the top twenty systemcalls for the | |
877 | previous 5 seconds. The output is sorted from most frequent to least | |
878 | frequent. | |
879 | ||
880 | ||
210ff7bf FCE |
881 | = READ = |
882 | ||
883 | io/iotime.stp - Trace Time Spent in Read and Write for Files | |
09a98ae0 | 884 | keywords: syscall read write time io |
210ff7bf FCE |
885 | |
886 | The script watches each open, close, read, and write syscalls on the | |
887 | system. For each file the scripts observes opened it accumulates the | |
f3c4da44 | 888 | amount of wall clock time spent in read and write operations and the |
210ff7bf FCE |
889 | number of bytes read and written. When a file is closed the script |
890 | prints out a pair of lines for the file. Both lines begin with a | |
891 | timestamp in microseconds, the PID number, and the executable name in | |
ad7e33d7 | 892 | parentheses. The first line with the "access" keyword lists the file |
210ff7bf FCE |
893 | name, the attempted number of bytes for the read and write |
894 | operations. The second line with the "iotime" keyword list the file | |
895 | name and the number of microseconds accumulated in the read and write | |
896 | syscalls. | |
897 | ||
898 | ||
899 | = SCHEDULER = | |
900 | ||
deb63545 WC |
901 | process/chng_cpu.stp - Monitor Changes in Processor Executing a Task |
902 | keywords: scheduler | |
903 | ||
904 | The chng_cpu.stp script takes an argument which is the executable | |
905 | name of the task it should monitor. Each time a task with that | |
906 | executable name is found running on a different processor, the script | |
907 | prints out the thread id (tid), the executable name, the processor | |
908 | now running the task, the thread state, and a backtrace showing the | |
909 | kernel functions that triggered the running of the task on the | |
910 | processor. | |
911 | ||
912 | ||
e01bc08e WC |
913 | process/cycle_thief.stp - Track IRQs and Other Processes Stealing Cycles from a Task |
914 | keywords: process scheduler time tracepoint interrupt | |
915 | ||
916 | The cycle_thief.stp script instruments the scheduler and IRQ handler | |
917 | to determine which processes and interrupts are competing with the | |
918 | specified task for the cpu cycles. This script uses the '-c' or '-x' | |
919 | options to focus on a specific task. The script output the number of | |
920 | times the task migrates between processors, histograms showing the | |
921 | length of time on and off processor, lists of processes running while | |
922 | the task is off the processor, and the interrupts that occurred while | |
923 | the task was running. | |
924 | ||
925 | ||
e6b653c8 WC |
926 | process/forktracker.stp - Trace Creation of Processes |
927 | keywords: process scheduler | |
928 | ||
929 | The forktracker.stp script prints out a time-stamped entry showing | |
f3c4da44 | 930 | each fork and exec operation on the machine. This can be useful to |
e6b653c8 WC |
931 | determine what process is creating a flurry of short-lived processes. |
932 | ||
933 | ||
deb63545 WC |
934 | process/migrate.stp - Track the Migration of Specific Executables |
935 | keywords: scheduler | |
936 | ||
937 | The migrate.stp script takes an argument which is the executable name | |
938 | of the task it should monitor. Each time a task with that executable | |
939 | name migrates between processors an entry is printed with the process | |
940 | id (pid), the executable name, the processor off loading the task, | |
941 | and the process taking the task. Note that the task may or may not be | |
942 | executing at the time of the migration. | |
943 | ||
944 | ||
34029cd3 WC |
945 | process/schedtimes.stp - Track Time Processes Spend in Various States using Tracepoints |
946 | keywords: process scheduler time tracepoint | |
947 | ||
948 | The schedtimes.stp script instruments the scheduler to track the | |
f3c4da44 MW |
949 | amount of time that each process spends in running, sleeping, |
950 | queuing, and waiting for io. On exit the script prints out the | |
951 | accumulated time for each state of processes observed. Optionally, | |
952 | this script can be used with the '-c' or '-x' options to focus on a | |
953 | specific PID. | |
34029cd3 WC |
954 | |
955 | ||
210ff7bf | 956 | process/sleepingBeauties.stp - Generating Backtraces of Threads Waiting for IO Operations |
09a98ae0 | 957 | keywords: io scheduler backtrace |
cae71dd3 | 958 | |
f3c4da44 | 959 | The script monitors the time that threads spend in waiting for IO |
cae71dd3 FCE |
960 | operations (in "D" state) in the wait_for_completion function. If a |
961 | thread spends over 10ms, its name and backtrace is printed, and later | |
962 | so is the total delay. | |
210ff7bf FCE |
963 | |
964 | ||
54ff5e0c FCE |
965 | = SCSI = |
966 | ||
967 | io/iostat-scsi.stp - iostat for SCSI Devices | |
968 | keywords: io profiling scsi | |
969 | ||
970 | The iostat-scsi.stp script provides a breakdown of the number of blks | |
ad7e33d7 | 971 | read and written on the machine's various SCSI devices. The script |
54ff5e0c FCE |
972 | takes one argument which is the number of seconds between reports. |
973 | ||
974 | ||
210ff7bf FCE |
975 | = SIGNALS = |
976 | ||
977 | process/sig_by_pid.stp - Signal Counts by Process ID | |
09a98ae0 | 978 | keywords: signals |
210ff7bf FCE |
979 | |
980 | Print signal counts by process ID in descending order. | |
981 | ||
982 | ||
983 | process/sig_by_proc.stp - Signal Counts by Process Name | |
09a98ae0 | 984 | keywords: signals |
210ff7bf FCE |
985 | |
986 | Print signal counts by process name in descending order. | |
987 | ||
988 | ||
989 | process/sigkill.stp - Track SIGKILL Signals | |
09a98ae0 | 990 | keywords: signals |
210ff7bf FCE |
991 | |
992 | The script traces any SIGKILL signals. When that SIGKILL signal is | |
993 | sent to a process, the script prints out the signal name, the | |
f3c4da44 MW |
994 | destination executable and process ID, the executable name and user |
995 | ID that sents the signal. | |
210ff7bf FCE |
996 | |
997 | ||
3a748561 | 998 | process/sigmon.stp - Track a particular signal to a specific process |
09a98ae0 | 999 | keywords: signals |
210ff7bf FCE |
1000 | |
1001 | The script watches for a particular signal sent to a specific | |
1002 | process. When that signal is sent to the specified process, the | |
1003 | script prints out the PID and executable of the process sending the | |
1004 | signal, the PID and executable name of the process receiving the | |
1005 | signal, and the signal number and name. | |
1006 | ||
1007 | ||
1008 | = SIMPLE = | |
1009 | ||
1010 | general/helloworld.stp - SystemTap "Hello World" Program | |
09a98ae0 | 1011 | keywords: simple |
210ff7bf FCE |
1012 | |
1013 | A basic "Hello World" program implemented in SystemTap script. It | |
1014 | prints out "hello world" message and then immediately exits. | |
1015 | ||
1016 | ||
42c55668 MW |
1017 | = SLAB = |
1018 | ||
1019 | memory/vm.tracepoints.stp - Collect slab allocation statistics | |
1020 | keywords: memory slab allocator | |
1021 | ||
1022 | The script will probe all memory slab/slub allocations and collects | |
1023 | information about the size of the object (bytes requested) and | |
1024 | user-space process in execution. When run over a period of time, it | |
1025 | helps to correlate kernel-space memory consumption owing to | |
1026 | user-space processes. | |
1027 | ||
1028 | ||
210ff7bf FCE |
1029 | = SLEEP = |
1030 | ||
1031 | process/sleeptime.stp - Trace Time Spent in nanosleep Syscalls | |
09a98ae0 | 1032 | keywords: syscall sleep |
210ff7bf FCE |
1033 | |
1034 | The script watches each nanosleep syscall on the system. At the end | |
1035 | of each nanosleep syscall the script prints out a line with a | |
1036 | timestamp in microseconds, the pid, the executable name in | |
ad7e33d7 | 1037 | parentheses, the "nanosleep:" key, and the duration of the sleep in |
210ff7bf FCE |
1038 | microseconds. |
1039 | ||
1040 | ||
1041 | = SOCKET = | |
1042 | ||
1043 | network/socket-trace.stp - Trace Functions called in Network Socket Code | |
09a98ae0 | 1044 | keywords: network socket |
210ff7bf | 1045 | |
f3c4da44 MW |
1046 | The script instruments each of the functions in the Linux kernel's |
1047 | net/socket.c file. The script prints out trace data. The first | |
1048 | element of a line is time delta in microseconds from the previous | |
1049 | entry. This is followed by the command name and the PID. The "->" and | |
1050 | "<-" indicates function entry and function exit, respectively. The | |
1051 | last element of the line is the function name. | |
210ff7bf FCE |
1052 | |
1053 | ||
492d227f WC |
1054 | network/tcp_connections.stp - Track Creation of Incoming TCP Connections |
1055 | keywords: network tcp socket | |
1056 | ||
1057 | The tcp_connections.stp script prints information for each new | |
1058 | incoming TCP connection accepted by the computer. The information | |
1059 | includes the UID, the command accepting the connection, the PID of | |
1060 | the command, the port the connection is on, and the IP address of the | |
1061 | originator of the request. | |
1062 | ||
1063 | ||
4bb6522c WC |
1064 | = STATISTICS = |
1065 | ||
1066 | network/tcpipstat.stp - Display network statistics for individual TCP sockets. | |
1067 | keywords: network statistics | |
1068 | ||
f3c4da44 | 1069 | tcpipstat collects and displays network statistics related to |
4bb6522c | 1070 | individual TCP sockets or groups of sockets. The statistics that are |
f3c4da44 | 1071 | collected are simular to that of the command netstat -s, only sorted |
4bb6522c WC |
1072 | and grouped by individual sockets. |
1073 | ||
1074 | ||
210ff7bf FCE |
1075 | = SYSCALL = |
1076 | ||
1077 | io/iotime.stp - Trace Time Spent in Read and Write for Files | |
09a98ae0 | 1078 | keywords: syscall read write time io |
210ff7bf FCE |
1079 | |
1080 | The script watches each open, close, read, and write syscalls on the | |
1081 | system. For each file the scripts observes opened it accumulates the | |
f3c4da44 | 1082 | amount of wall clock time spent in read and write operations and the |
210ff7bf FCE |
1083 | number of bytes read and written. When a file is closed the script |
1084 | prints out a pair of lines for the file. Both lines begin with a | |
1085 | timestamp in microseconds, the PID number, and the executable name in | |
ad7e33d7 | 1086 | parentheses. The first line with the "access" keyword lists the file |
210ff7bf FCE |
1087 | name, the attempted number of bytes for the read and write |
1088 | operations. The second line with the "iotime" keyword list the file | |
1089 | name and the number of microseconds accumulated in the read and write | |
1090 | syscalls. | |
1091 | ||
1092 | ||
cc20d853 ET |
1093 | process/errsnoop.stp - tabulate system call errors |
1094 | keywords: process syscall | |
1095 | ||
1096 | The script prints a periodic tabular report about failing system | |
1097 | calls, by process and by syscall failure. The first optional | |
1098 | argument specifies the reporting interval (in seconds, default 5); | |
1099 | the second optional argument gives a screen height (number of lines | |
1100 | in the report, default 20). | |
1101 | ||
1102 | ||
210ff7bf | 1103 | process/futexes.stp - System-Wide Futex Contention |
09a98ae0 | 1104 | keywords: syscall locking futex |
210ff7bf FCE |
1105 | |
1106 | The script watches the futex syscall on the system. On exit the | |
1107 | futexes address, the number of contentions, and the average time for | |
1108 | each contention on the futex are printed from lowest pid number to | |
1109 | highest. | |
1110 | ||
1111 | ||
1112 | process/sleeptime.stp - Trace Time Spent in nanosleep Syscalls | |
09a98ae0 | 1113 | keywords: syscall sleep |
210ff7bf FCE |
1114 | |
1115 | The script watches each nanosleep syscall on the system. At the end | |
1116 | of each nanosleep syscall the script prints out a line with a | |
1117 | timestamp in microseconds, the pid, the executable name in | |
ad7e33d7 | 1118 | parentheses, the "nanosleep:" key, and the duration of the sleep in |
210ff7bf FCE |
1119 | microseconds. |
1120 | ||
1121 | ||
1122 | process/syscalls_by_pid.stp - System-Wide Count of Syscalls by PID | |
09a98ae0 | 1123 | keywords: syscall |
210ff7bf FCE |
1124 | |
1125 | The script watches all syscall on the system. On exit the script | |
1126 | prints a list showing the number of systemcalls executed by each PID | |
1127 | ordered from greatest to least number of syscalls. | |
1128 | ||
1129 | ||
1130 | process/syscalls_by_proc.stp - System-Wide Count of Syscalls by Executable | |
09a98ae0 | 1131 | keywords: syscall |
210ff7bf FCE |
1132 | |
1133 | The script watches all syscall on the system. On exit the script | |
1134 | prints a list showing the number of systemcalls executed by each | |
ad7e33d7 | 1135 | executable ordered from greatest to least number of syscalls. |
210ff7bf FCE |
1136 | |
1137 | ||
1138 | process/wait4time.stp - Trace Time Spent in wait4 Syscalls | |
09a98ae0 | 1139 | keywords: syscall wait4 |
210ff7bf FCE |
1140 | |
1141 | The script watches each wait4 syscall on the system. At the end of | |
1142 | each wait4 syscall the script prints out a line with a timestamp in | |
ad7e33d7 | 1143 | microseconds, the pid, the executable name in parentheses, the |
210ff7bf FCE |
1144 | "wait4:" key, the duration of the wait and the PID that the wait4 was |
1145 | waiting for. If the waited for PID is not specified , it is "-1". | |
1146 | ||
1147 | ||
492d227f WC |
1148 | = TCP = |
1149 | ||
905728a0 WC |
1150 | network/sk_stream_wait_memory.stp - Track Start and Stop of Processes Due to Network Buffer Space |
1151 | keywords: network tcp buffer memory | |
1152 | ||
1153 | The sk_stream-wait_memory.stp prints a time stamp, executable, and | |
1154 | pid each time a process blocks due to the send buffer being full. A | |
1155 | similar entry is printed each time a process continues because there | |
1156 | is room in the buffer. | |
1157 | ||
1158 | ||
492d227f WC |
1159 | network/tcp_connections.stp - Track Creation of Incoming TCP Connections |
1160 | keywords: network tcp socket | |
1161 | ||
1162 | The tcp_connections.stp script prints information for each new | |
1163 | incoming TCP connection accepted by the computer. The information | |
1164 | includes the UID, the command accepting the connection, the PID of | |
1165 | the command, the port the connection is on, and the IP address of the | |
1166 | originator of the request. | |
1167 | ||
1168 | ||
210ff7bf FCE |
1169 | = TIME = |
1170 | ||
1171 | io/iotime.stp - Trace Time Spent in Read and Write for Files | |
09a98ae0 | 1172 | keywords: syscall read write time io |
210ff7bf FCE |
1173 | |
1174 | The script watches each open, close, read, and write syscalls on the | |
1175 | system. For each file the scripts observes opened it accumulates the | |
f3c4da44 | 1176 | amount of wall clock time spent in read and write operations and the |
210ff7bf FCE |
1177 | number of bytes read and written. When a file is closed the script |
1178 | prints out a pair of lines for the file. Both lines begin with a | |
1179 | timestamp in microseconds, the PID number, and the executable name in | |
ad7e33d7 | 1180 | parentheses. The first line with the "access" keyword lists the file |
210ff7bf FCE |
1181 | name, the attempted number of bytes for the read and write |
1182 | operations. The second line with the "iotime" keyword list the file | |
1183 | name and the number of microseconds accumulated in the read and write | |
1184 | syscalls. | |
1185 | ||
1186 | ||
e01bc08e WC |
1187 | process/cycle_thief.stp - Track IRQs and Other Processes Stealing Cycles from a Task |
1188 | keywords: process scheduler time tracepoint interrupt | |
1189 | ||
1190 | The cycle_thief.stp script instruments the scheduler and IRQ handler | |
1191 | to determine which processes and interrupts are competing with the | |
1192 | specified task for the cpu cycles. This script uses the '-c' or '-x' | |
1193 | options to focus on a specific task. The script output the number of | |
1194 | times the task migrates between processors, histograms showing the | |
1195 | length of time on and off processor, lists of processes running while | |
1196 | the task is off the processor, and the interrupts that occurred while | |
1197 | the task was running. | |
1198 | ||
1199 | ||
34029cd3 WC |
1200 | process/schedtimes.stp - Track Time Processes Spend in Various States using Tracepoints |
1201 | keywords: process scheduler time tracepoint | |
1202 | ||
1203 | The schedtimes.stp script instruments the scheduler to track the | |
f3c4da44 MW |
1204 | amount of time that each process spends in running, sleeping, |
1205 | queuing, and waiting for io. On exit the script prints out the | |
1206 | accumulated time for each state of processes observed. Optionally, | |
1207 | this script can be used with the '-c' or '-x' options to focus on a | |
1208 | specific PID. | |
34029cd3 WC |
1209 | |
1210 | ||
210ff7bf FCE |
1211 | = TRACE = |
1212 | ||
aa15b9f0 | 1213 | general/para-callgraph.stp - Callgraph tracing with arguments |
09a98ae0 | 1214 | keywords: trace callgraph |
210ff7bf | 1215 | |
aa15b9f0 FCE |
1216 | Print a timed per-thread callgraph, complete with function parameters |
1217 | and return values. The first parameter names the function probe | |
1218 | points to trace. The optional second parameter names the probe | |
1219 | points for trigger functions, which acts to enable tracing for only | |
1220 | those functions that occur while the current thread is nested within | |
1221 | the trigger. | |
210ff7bf FCE |
1222 | |
1223 | ||
2e251678 DW |
1224 | network/tcp_trace.stp - Tcp connection tracing utility. |
1225 | keywords: network trace | |
1226 | ||
1227 | This scripts traces a given tcp connection based on the filter | |
1228 | parameters given by the user. The indexing is done by the 4 tuples | |
1229 | local address, remote address, local port, remote port. | |
1230 | ||
1231 | ||
0e4901b0 WC |
1232 | = TRACEPOINT = |
1233 | ||
1234 | network/dropwatch.stp - Watch Where Socket Buffers are Freed in the Kernel | |
1235 | keywords: network tracepoint buffer free | |
1236 | ||
1237 | Every five seconds the dropwatch.stp script lists the number of | |
1238 | socket buffers freed at locations in the kernel. | |
1239 | ||
1240 | ||
e01bc08e WC |
1241 | process/cycle_thief.stp - Track IRQs and Other Processes Stealing Cycles from a Task |
1242 | keywords: process scheduler time tracepoint interrupt | |
1243 | ||
1244 | The cycle_thief.stp script instruments the scheduler and IRQ handler | |
1245 | to determine which processes and interrupts are competing with the | |
1246 | specified task for the cpu cycles. This script uses the '-c' or '-x' | |
1247 | options to focus on a specific task. The script output the number of | |
1248 | times the task migrates between processors, histograms showing the | |
1249 | length of time on and off processor, lists of processes running while | |
1250 | the task is off the processor, and the interrupts that occurred while | |
1251 | the task was running. | |
1252 | ||
1253 | ||
34029cd3 WC |
1254 | process/schedtimes.stp - Track Time Processes Spend in Various States using Tracepoints |
1255 | keywords: process scheduler time tracepoint | |
1256 | ||
1257 | The schedtimes.stp script instruments the scheduler to track the | |
f3c4da44 MW |
1258 | amount of time that each process spends in running, sleeping, |
1259 | queuing, and waiting for io. On exit the script prints out the | |
1260 | accumulated time for each state of processes observed. Optionally, | |
1261 | this script can be used with the '-c' or '-x' options to focus on a | |
1262 | specific PID. | |
34029cd3 WC |
1263 | |
1264 | ||
210ff7bf FCE |
1265 | = TRAFFIC = |
1266 | ||
53e5699f JS |
1267 | network/netdev.stp - Trace Activity on Network Devices |
1268 | keywords: network device traffic | |
1269 | ||
1270 | The netdev.stp script traces configuration and transmit/receive | |
1271 | activity on network devices. | |
1272 | ||
1273 | ||
210ff7bf | 1274 | network/nettop.stp - Periodic Listing of Processes Using Network Interfaces |
09a98ae0 | 1275 | keywords: network traffic per-process |
210ff7bf FCE |
1276 | |
1277 | Every five seconds the nettop.stp script prints out a list of | |
1278 | processed (PID and command) with the number of packets sent/received | |
1279 | and the amount of data sent/received by the process during that | |
1280 | interval. | |
1281 | ||
1282 | ||
7a51212c WC |
1283 | network/tcpdumplike.stp - Dump of Received TCP Packets |
1284 | keywords: network traffic | |
1285 | ||
1286 | The tcpdumplike.stp prints out a line for each TCP packet received. | |
1287 | Each line includes the source and destination IP addresses, the | |
1288 | source and destination ports, and flags. | |
1289 | ||
1290 | ||
b7f6cfc5 FCE |
1291 | = TTY = |
1292 | ||
1293 | io/ttyspy.stp - Monitor tty typing. | |
14f0bb18 | 1294 | keywords: io tty per-process monitoring |
b7f6cfc5 FCE |
1295 | |
1296 | The ttyspy.stp script uses tty_audit hooks to monitor recent typing | |
1297 | activity on the system, printing a scrolling record of recent | |
1298 | keystrokes, on a per-tty basis. | |
1299 | ||
1300 | ||
210ff7bf FCE |
1301 | = USE = |
1302 | ||
1303 | general/graphs.stp - Graphing Disk and CPU Utilization | |
09a98ae0 | 1304 | keywords: disk cpu use graph |
210ff7bf FCE |
1305 | |
1306 | The script tracks the disk and CPU utilization. The resulting output | |
1307 | of the script can be piped into gnuplot to generate a graph of disk | |
1308 | and CPU USE. | |
1309 | ||
1310 | ||
1311 | = WAIT4 = | |
1312 | ||
1313 | process/wait4time.stp - Trace Time Spent in wait4 Syscalls | |
09a98ae0 | 1314 | keywords: syscall wait4 |
210ff7bf FCE |
1315 | |
1316 | The script watches each wait4 syscall on the system. At the end of | |
1317 | each wait4 syscall the script prints out a line with a timestamp in | |
ad7e33d7 | 1318 | microseconds, the pid, the executable name in parentheses, the |
210ff7bf FCE |
1319 | "wait4:" key, the duration of the wait and the PID that the wait4 was |
1320 | waiting for. If the waited for PID is not specified , it is "-1". | |
1321 | ||
1322 | ||
1323 | = WRITE = | |
1324 | ||
1325 | io/iotime.stp - Trace Time Spent in Read and Write for Files | |
09a98ae0 | 1326 | keywords: syscall read write time io |
210ff7bf FCE |
1327 | |
1328 | The script watches each open, close, read, and write syscalls on the | |
1329 | system. For each file the scripts observes opened it accumulates the | |
f3c4da44 | 1330 | amount of wall clock time spent in read and write operations and the |
210ff7bf FCE |
1331 | number of bytes read and written. When a file is closed the script |
1332 | prints out a pair of lines for the file. Both lines begin with a | |
1333 | timestamp in microseconds, the PID number, and the executable name in | |
ad7e33d7 | 1334 | parentheses. The first line with the "access" keyword lists the file |
210ff7bf FCE |
1335 | name, the attempted number of bytes for the read and write |
1336 | operations. The second line with the "iotime" keyword list the file | |
1337 | name and the number of microseconds accumulated in the read and write | |
1338 | syscalls. | |
1339 | ||
1340 |