]>
Commit | Line | Data |
---|---|---|
210ff7bf | 1 | SYSTEMTAP EXAMPLES INDEX BY KEYWORD |
09a98ae0 | 2 | (see also index.txt) |
210ff7bf | 3 | |
42c55668 MW |
4 | = ALLOCATOR = |
5 | ||
6 | memory/vm.tracepoints.stp - Collect slab allocation statistics | |
7 | keywords: memory slab allocator | |
8 | ||
9 | The script will probe all memory slab/slub allocations and collects | |
10 | information about the size of the object (bytes requested) and | |
11 | user-space process in execution. When run over a period of time, it | |
12 | helps to correlate kernel-space memory consumption owing to | |
13 | user-space processes. | |
14 | ||
15 | ||
8b88e771 FCE |
16 | = AUTOFS = |
17 | ||
18 | network/autofs4.stp - Watch autofs4 operations | |
19 | keywords: network autofs nfs | |
20 | ||
21 | Trace key autofs4 operations such as mounting or unmounting remote | |
22 | filesystems. | |
23 | ||
24 | ||
210ff7bf FCE |
25 | = BACKTRACE = |
26 | ||
1cc8a4c7 WC |
27 | interrupt/scf.stp - Tally Backtraces for Inter-Processor Interrupt (IPI) |
28 | keywords: interrupt backtrace | |
29 | ||
30 | The Linux kernel function smp_call_function causes expensive | |
31 | inter-processor interrupts (IPIs). The scf.stp script tallies the | |
32 | processes and backtraces causing the interprocessor interrupts to | |
33 | identify the cause of the expensive IPI. On exit the script prints | |
34 | the tallies in descending frequency. | |
35 | ||
36 | ||
210ff7bf | 37 | io/io_submit.stp - Tally Reschedule Reason During AIO io_submit Call |
09a98ae0 | 38 | keywords: io backtrace |
210ff7bf FCE |
39 | |
40 | When a reschedule occurs during an AIO io_submit call, accumulate the | |
41 | traceback in a histogram. When the script exits prints out a sorted | |
42 | list from most common to least common backtrace. | |
43 | ||
44 | ||
cae71dd3 | 45 | process/sleepingBeauties.stp - Generating Backtraces of Threads Waiting for IO Operations |
09a98ae0 | 46 | keywords: io scheduler backtrace |
cae71dd3 | 47 | |
f3c4da44 | 48 | The script monitors the time that threads spend in waiting for IO |
cae71dd3 FCE |
49 | operations (in "D" state) in the wait_for_completion function. If a |
50 | thread spends over 10ms, its name and backtrace is printed, and later | |
51 | so is the total delay. | |
52 | ||
53 | ||
0e4901b0 WC |
54 | = BUFFER = |
55 | ||
56 | network/dropwatch.stp - Watch Where Socket Buffers are Freed in the Kernel | |
57 | keywords: network tracepoint buffer free | |
58 | ||
59 | Every five seconds the dropwatch.stp script lists the number of | |
60 | socket buffers freed at locations in the kernel. | |
61 | ||
62 | ||
905728a0 WC |
63 | network/sk_stream_wait_memory.stp - Track Start and Stop of Processes Due to Network Buffer Space |
64 | keywords: network tcp buffer memory | |
65 | ||
66 | The sk_stream-wait_memory.stp prints a time stamp, executable, and | |
67 | pid each time a process blocks due to the send buffer being full. A | |
68 | similar entry is printed each time a process continues because there | |
69 | is room in the buffer. | |
70 | ||
71 | ||
210ff7bf FCE |
72 | = CALLGRAPH = |
73 | ||
aa15b9f0 | 74 | general/para-callgraph.stp - Callgraph tracing with arguments |
09a98ae0 | 75 | keywords: trace callgraph |
210ff7bf | 76 | |
aa15b9f0 FCE |
77 | Print a timed per-thread callgraph, complete with function parameters |
78 | and return values. The first parameter names the function probe | |
79 | points to trace. The optional second parameter names the probe | |
80 | points for trigger functions, which acts to enable tracing for only | |
81 | those functions that occur while the current thread is nested within | |
82 | the trigger. | |
210ff7bf FCE |
83 | |
84 | ||
85 | = CPU = | |
86 | ||
87 | general/graphs.stp - Graphing Disk and CPU Utilization | |
09a98ae0 | 88 | keywords: disk cpu use graph |
210ff7bf FCE |
89 | |
90 | The script tracks the disk and CPU utilization. The resulting output | |
91 | of the script can be piped into gnuplot to generate a graph of disk | |
92 | and CPU USE. | |
93 | ||
94 | ||
53e5699f JS |
95 | = DEVICE = |
96 | ||
97 | network/netdev.stp - Trace Activity on Network Devices | |
98 | keywords: network device traffic | |
99 | ||
100 | The netdev.stp script traces configuration and transmit/receive | |
101 | activity on network devices. | |
102 | ||
103 | ||
210ff7bf FCE |
104 | = DISK = |
105 | ||
106 | general/graphs.stp - Graphing Disk and CPU Utilization | |
09a98ae0 | 107 | keywords: disk cpu use graph |
210ff7bf FCE |
108 | |
109 | The script tracks the disk and CPU utilization. The resulting output | |
110 | of the script can be piped into gnuplot to generate a graph of disk | |
111 | and CPU USE. | |
112 | ||
113 | ||
114 | io/disktop.stp - Summarize Disk Read/Write Traffic | |
09a98ae0 | 115 | keywords: disk |
210ff7bf FCE |
116 | |
117 | Get the status of reading/writing disk every 5 seconds, output top | |
118 | ten entries during that period. | |
119 | ||
120 | ||
ecf33ff4 ET |
121 | = FILES = |
122 | ||
123 | process/pfiles.stp - print process file descriptors | |
124 | keywords: process files | |
125 | ||
126 | Run pfiles.stp to produce a human-readable summary of all open file | |
127 | descriptors of a given process. Specify the process-id as -x PID for | |
128 | fastest performance. | |
129 | ||
130 | ||
ac505f97 JS |
131 | = FILESYSTEM = |
132 | ||
133 | general/badname.stp - Bad Filename Filter | |
134 | keywords: filesystem hack | |
135 | ||
136 | The badname.stp script shows how one could prevent the creation of | |
6287a9e6 | 137 | files with undesirable names using guru mode. |
ac505f97 JS |
138 | |
139 | ||
0e0b566a WC |
140 | = FORMAT = |
141 | ||
142 | general/ansi_colors.stp - Color Table for ansi_set_color2() and ansi_set_color3() | |
143 | keywords: format | |
144 | ||
145 | The script prints a table showing the available color combinations | |
146 | for the ansi_set_color2() and ans_set_color3() functions in the | |
147 | ansi.stp tapset. | |
148 | ||
149 | ||
150 | general/ansi_colors2.stp - Show Attribues in Table for ansi_set_color3() | |
151 | keywords: format | |
152 | ||
153 | The script prints a table showing the available attributes (bold, | |
154 | underline, and inverse) with color combinations for the | |
155 | ans_set_color3() function in the ansi.stp tapset. | |
156 | ||
157 | ||
0e4901b0 WC |
158 | = FREE = |
159 | ||
160 | network/dropwatch.stp - Watch Where Socket Buffers are Freed in the Kernel | |
161 | keywords: network tracepoint buffer free | |
162 | ||
163 | Every five seconds the dropwatch.stp script lists the number of | |
164 | socket buffers freed at locations in the kernel. | |
165 | ||
166 | ||
210ff7bf FCE |
167 | = FUNCTIONS = |
168 | ||
169 | profiling/functioncallcount.stp - Count Times Functions Called | |
09a98ae0 | 170 | keywords: profiling functions |
210ff7bf FCE |
171 | |
172 | The functioncallcount.stp script takes one argument, a list of | |
173 | functions to probe. The script will run and count the number of times | |
174 | that each of the functions on the list is called. On exit the script | |
175 | will print a sorted list from most frequently to least frequently | |
176 | called function. | |
177 | ||
178 | ||
0449af03 JS |
179 | profiling/sched_switch.stp - Display the task switches happening in the scheduler |
180 | keywords: profiling functions | |
181 | ||
182 | The sched_switch.stp script takes two arguments, first argument can | |
183 | be "pid" or "name" to indicate what is being passed as second | |
184 | argument. The script will trace the process based on pid/name and | |
185 | print the scheduler switches happening with the process. If no | |
186 | arguments are passed, it displays all the scheduler switches. This | |
187 | can be used to understand which tasks schedule out the current | |
188 | process being traced, and when it gets scheduled in again. | |
189 | ||
190 | ||
210ff7bf FCE |
191 | = FUTEX = |
192 | ||
193 | process/futexes.stp - System-Wide Futex Contention | |
09a98ae0 | 194 | keywords: syscall locking futex |
210ff7bf FCE |
195 | |
196 | The script watches the futex syscall on the system. On exit the | |
197 | futexes address, the number of contentions, and the average time for | |
198 | each contention on the futex are printed from lowest pid number to | |
199 | highest. | |
200 | ||
201 | ||
202 | = GRAPH = | |
203 | ||
204 | general/graphs.stp - Graphing Disk and CPU Utilization | |
09a98ae0 | 205 | keywords: disk cpu use graph |
210ff7bf FCE |
206 | |
207 | The script tracks the disk and CPU utilization. The resulting output | |
208 | of the script can be piped into gnuplot to generate a graph of disk | |
209 | and CPU USE. | |
210 | ||
211 | ||
ac505f97 JS |
212 | = HACK = |
213 | ||
214 | general/badname.stp - Bad Filename Filter | |
215 | keywords: filesystem hack | |
216 | ||
217 | The badname.stp script shows how one could prevent the creation of | |
6287a9e6 | 218 | files with undesirable names using guru mode. |
ac505f97 JS |
219 | |
220 | ||
1cc8a4c7 WC |
221 | = INTERRUPT = |
222 | ||
6b95efe9 JS |
223 | interrupt/interrupts-by-dev.stp - Record interrupts on a per-device basis. |
224 | keywords: interrupt | |
225 | ||
226 | The interrupts-by-dev.stp script profiles interrupts received by each | |
227 | device per 100 ms. | |
228 | ||
229 | ||
1cc8a4c7 WC |
230 | interrupt/scf.stp - Tally Backtraces for Inter-Processor Interrupt (IPI) |
231 | keywords: interrupt backtrace | |
232 | ||
233 | The Linux kernel function smp_call_function causes expensive | |
234 | inter-processor interrupts (IPIs). The scf.stp script tallies the | |
235 | processes and backtraces causing the interprocessor interrupts to | |
236 | identify the cause of the expensive IPI. On exit the script prints | |
237 | the tallies in descending frequency. | |
238 | ||
239 | ||
e01bc08e WC |
240 | process/cycle_thief.stp - Track IRQs and Other Processes Stealing Cycles from a Task |
241 | keywords: process scheduler time tracepoint interrupt | |
242 | ||
243 | The cycle_thief.stp script instruments the scheduler and IRQ handler | |
244 | to determine which processes and interrupts are competing with the | |
245 | specified task for the cpu cycles. This script uses the '-c' or '-x' | |
246 | options to focus on a specific task. The script output the number of | |
247 | times the task migrates between processors, histograms showing the | |
248 | length of time on and off processor, lists of processes running while | |
249 | the task is off the processor, and the interrupts that occurred while | |
250 | the task was running. | |
251 | ||
252 | ||
210ff7bf FCE |
253 | = IO = |
254 | ||
255 | io/io_submit.stp - Tally Reschedule Reason During AIO io_submit Call | |
09a98ae0 | 256 | keywords: io backtrace |
210ff7bf FCE |
257 | |
258 | When a reschedule occurs during an AIO io_submit call, accumulate the | |
259 | traceback in a histogram. When the script exits prints out a sorted | |
260 | list from most common to least common backtrace. | |
261 | ||
262 | ||
67f8611b WC |
263 | io/ioblktime.stp - Average Time Block IO Requests Spend in Queue |
264 | keywords: io | |
265 | ||
266 | The ioblktime.stp script tracks the amount of time that each block IO | |
cc20d853 | 267 | requests spend waiting for completion. The script computes the |
f3c4da44 MW |
268 | average waiting time for block IO per device and prints list every 10 |
269 | seconds. In some cases there can be too many outstanding block IO | |
270 | operations and the script may exceed the default number of | |
67f8611b WC |
271 | MAXMAPENTRIES allowed. In this case the allowed number can be |
272 | increased with "-DMAXMAPENTRIES=10000" option on the stap command | |
273 | line. | |
274 | ||
275 | ||
a4f3198f WC |
276 | io/iodevstats.stp - List Executables Reading and Writing the Most Data by Device |
277 | keywords: io profiling | |
278 | ||
279 | The iodevstats.stp script measures the amount of data successfully | |
280 | read and written by all the executables for each io device on the | |
281 | system. The output is sorted from greatest sum of bytes read and | |
282 | written to a device by an executable to the least. The output | |
283 | contains device major/minor number, the count of operations (reads | |
284 | and writes), the totals and averages for the number of bytes read and | |
285 | written. | |
286 | ||
287 | ||
54ff5e0c FCE |
288 | io/iostat-scsi.stp - iostat for SCSI Devices |
289 | keywords: io profiling scsi | |
290 | ||
291 | The iostat-scsi.stp script provides a breakdown of the number of blks | |
ad7e33d7 | 292 | read and written on the machine's various SCSI devices. The script |
54ff5e0c FCE |
293 | takes one argument which is the number of seconds between reports. |
294 | ||
295 | ||
3e4444ed WC |
296 | io/iostats.stp - List Executables Reading and Writing the Most Data |
297 | keywords: io profiling | |
298 | ||
299 | The iostat.stp script measures the amount of data successfully read | |
300 | and written by all the executables on the system. The output is | |
301 | sorted from most greatest sum of bytes read and written by an | |
302 | executable to the least. The output contains the count of operations | |
303 | (opens, reads, and writes), the totals and averages for the number of | |
304 | bytes read and written. | |
305 | ||
306 | ||
210ff7bf | 307 | io/iotime.stp - Trace Time Spent in Read and Write for Files |
09a98ae0 | 308 | keywords: syscall read write time io |
210ff7bf FCE |
309 | |
310 | The script watches each open, close, read, and write syscalls on the | |
311 | system. For each file the scripts observes opened it accumulates the | |
f3c4da44 | 312 | amount of wall clock time spent in read and write operations and the |
210ff7bf FCE |
313 | number of bytes read and written. When a file is closed the script |
314 | prints out a pair of lines for the file. Both lines begin with a | |
315 | timestamp in microseconds, the PID number, and the executable name in | |
ad7e33d7 | 316 | parentheses. The first line with the "access" keyword lists the file |
210ff7bf FCE |
317 | name, the attempted number of bytes for the read and write |
318 | operations. The second line with the "iotime" keyword list the file | |
319 | name and the number of microseconds accumulated in the read and write | |
320 | syscalls. | |
321 | ||
322 | ||
323 | io/iotop.stp - Periodically Print I/O Activity by Process Name | |
09a98ae0 | 324 | keywords: io |
210ff7bf FCE |
325 | |
326 | Every five seconds print out the top ten executables generating I/O | |
327 | traffic during that interval sorted in descending order. | |
328 | ||
329 | ||
1beb5089 FCE |
330 | io/mbrwatch.stp - Monitor read/write of MBR (boot sector) area of block devices |
331 | keywords: io monitoring | |
332 | ||
333 | The mbrwatch.stp script reports any attempted reads/writes of the | |
334 | first few sectors of a raw block device. | |
335 | ||
336 | ||
111dd9ac WC |
337 | io/nfs_func_users.stp - Tally the Number of NFS Functions Used by Each Process |
338 | keywords: io profiling | |
339 | ||
340 | The nfs_func_users.stp script counts the uses of NFS functions in the | |
341 | kernel on a per process bases. The output is sorted from the process | |
342 | with the greatest number of NFS functions called to the least. The | |
343 | output contains the executable name, the process number, and the | |
344 | total number of NFS functions called by the process. | |
345 | ||
346 | ||
210ff7bf | 347 | io/traceio.stp - Track Cumulative I/O Activity by Process Name |
09a98ae0 | 348 | keywords: io |
210ff7bf FCE |
349 | |
350 | Every second print out the top ten executables sorted in descending | |
351 | order based on cumulative I/O traffic observed. | |
352 | ||
353 | ||
354 | io/traceio2.stp - Watch I/O Activity on a Particular Device | |
09a98ae0 | 355 | keywords: io |
210ff7bf FCE |
356 | |
357 | Print out the executable name and process number as reads and writes | |
358 | to the specified device occur. | |
359 | ||
360 | ||
b7f6cfc5 | 361 | io/ttyspy.stp - Monitor tty typing. |
14f0bb18 | 362 | keywords: io tty per-process monitoring |
b7f6cfc5 FCE |
363 | |
364 | The ttyspy.stp script uses tty_audit hooks to monitor recent typing | |
365 | activity on the system, printing a scrolling record of recent | |
366 | keystrokes, on a per-tty basis. | |
367 | ||
368 | ||
210ff7bf | 369 | process/sleepingBeauties.stp - Generating Backtraces of Threads Waiting for IO Operations |
09a98ae0 | 370 | keywords: io scheduler backtrace |
210ff7bf | 371 | |
f3c4da44 | 372 | The script monitors the time that threads spend in waiting for IO |
cae71dd3 FCE |
373 | operations (in "D" state) in the wait_for_completion function. If a |
374 | thread spends over 10ms, its name and backtrace is printed, and later | |
375 | so is the total delay. | |
210ff7bf FCE |
376 | |
377 | ||
378 | = LOCKING = | |
379 | ||
cf5023fb WC |
380 | locks/bkl.stp - Tracing Contention on Big Kernel Lock (BKL) |
381 | keywords: locking | |
382 | ||
383 | The bkl.stp script can help determine whether the Big Kernel Lock | |
384 | (BKL) is causing serialization on a multiprocessor system due to | |
385 | excessive contention of the BKL. The bkl.stp script takes one | |
386 | argument which is the number of processes waiting for the Big Kernel | |
387 | Lock (BKL). When the number of processes waiting for the BKL is | |
388 | reached or exceeded, the script will print a time stamp, the number | |
389 | of processes waiting for the BKL, the holder of the BKL, and the | |
390 | amount of time the BKL was held. | |
391 | ||
392 | ||
393 | locks/bkl_stats.stp - Per Process Statistics on Big Kernel Lock (BKL) Use | |
394 | keywords: locking | |
395 | ||
396 | The bkl_stats.stp script can indicate which processes have excessive | |
397 | waits for the Big Kernel Lock (BKL) and which processes are taking | |
398 | the BKL for long periods of time. The bkl_stats.stp script prints | |
399 | lists of all the processes that require the BKL. Every five seconds | |
400 | two tables are printed out. The first table lists the processes that | |
401 | waited for the BKL followed by the number of times that the process | |
402 | waited, the minimum time of the wait, the average and the maximum | |
403 | time waited. The second table lists has similar information for the | |
f3c4da44 | 404 | time spent in holding the lock for each of the processes. |
cf5023fb WC |
405 | |
406 | ||
210ff7bf | 407 | process/futexes.stp - System-Wide Futex Contention |
09a98ae0 | 408 | keywords: syscall locking futex |
210ff7bf FCE |
409 | |
410 | The script watches the futex syscall on the system. On exit the | |
411 | futexes address, the number of contentions, and the average time for | |
412 | each contention on the futex are printed from lowest pid number to | |
413 | highest. | |
414 | ||
415 | ||
22f971e8 WC |
416 | = MEMORY = |
417 | ||
418 | memory/kmalloc-top - Show Paths to Kernel Malloc (kmalloc) Invocations | |
419 | keywords: memory | |
420 | ||
421 | The kmalloc-top perl program runs a small systemtap script to collect | |
422 | stack traces for each call to the kmalloc function and counts the | |
423 | time that each stack trace is observed. When kmalloc-top exits it | |
f3c4da44 MW |
424 | prints out sorted list. The output can be filtered to print only the |
425 | first N stack traces (-t), stack traces with a minimum counts (-m), | |
426 | or exclude certain stack traces (-e). | |
22f971e8 WC |
427 | |
428 | ||
0dc23d1d WC |
429 | memory/mmanonpage.stp - Track Virtual Memory System Actions on Anonymous Pages |
430 | keywords: memory | |
431 | ||
432 | The mmanonpage.stp script uses the virtual memory tracepoints | |
433 | available in some kernels to track the number of faults, user space | |
434 | frees, page ins, copy on writes and unmaps for anonymous pages. When | |
435 | the script is terminated the counts are printed for each process that | |
436 | allocated pages while the script was running. This script displays | |
437 | the anonymous page statistics for each process that ran while the | |
f3c4da44 | 438 | script is active. It's useful in debugging leaks in the anonymous |
0dc23d1d WC |
439 | regions of a process. |
440 | ||
441 | ||
442 | memory/mmfilepage.stp - Track Virtual Memory System Actions on File Backed Pages | |
443 | keywords: memory | |
444 | ||
445 | The mmfilepage.stp script uses the virtual memory tracepoints | |
446 | available in some kernels to track the number of faults, copy on | |
447 | writes mapping, and unmapping operations for file backed pages. When | |
448 | the script is terminated the counts are printed for each process that | |
449 | allocated pages while the script was running. The mmfilepage.stp | |
450 | script is useful in debugging leaks in the mapped file regions of a | |
451 | process. | |
452 | ||
453 | ||
454 | memory/mmreclaim.stp - Track Virtual Memory System Page Reclamation | |
455 | keywords: memory | |
456 | ||
457 | The mmreclaim.stp script uses the virtual memory tracepoints | |
ad7e33d7 | 458 | available in some kernels to track page reclaim activity that |
f3c4da44 | 459 | occurred while the script was running. It's useful in debugging |
ad7e33d7 | 460 | performance problems that occur due to page reclamation. |
0dc23d1d WC |
461 | |
462 | ||
463 | memory/mmwriteback.stp - Track Virtual Memory System Writing to Disk | |
464 | keywords: memory | |
465 | ||
466 | The mmwriteback.stp script uses the virtual memory tracepoints | |
467 | available in some kernels to report all of the file writebacks that | |
468 | occur form kupdate, pdflush and kjournald while the script is | |
f3c4da44 MW |
469 | running. It's useful in determining where writes are coming from on |
470 | a supposedly idle system that is experiencing unexpected IO. | |
0dc23d1d WC |
471 | |
472 | ||
c728b7da WC |
473 | memory/numa_faults.stp - Summarize Process Misses across NUMA Nodes |
474 | keywords: memory numa | |
475 | ||
476 | The numa_faults.stp script tracks the read and write pages faults for | |
477 | each process. When the script exits it prints out the total read and | |
ad7e33d7 | 478 | write pages faults for each process. The script also provide a break |
c728b7da WC |
479 | down of page faults per node for each process. This script is useful |
480 | for determining whether the program has good locality (page faults | |
481 | limited to a single node) on a NUMA computer. | |
482 | ||
483 | ||
1ff1a65d FCE |
484 | memory/overcommit.stp - Log failed process memory allocation due to overcommit limits |
485 | keywords: memory process | |
486 | ||
487 | The overcommit.stp script prints a line each time the kernel refuses | |
488 | a memory allocation request from a process because of | |
489 | /proc/sys/vm/overcommit* limits. | |
490 | ||
491 | ||
413996e0 WC |
492 | memory/pfaults.stp - Generate Log of Major and Minor Page Faults |
493 | keywords: memory | |
494 | ||
495 | The pfaults.stp script generates a simple log for each major and | |
496 | minor page fault that occurs on the system. Each line contains a | |
497 | timestamp (in microseconds) when the page fault servicing was | |
498 | completed, the pid of the process, the address of the page fault, the | |
499 | type of access (read or write), the type of fault (major or minor), | |
500 | and the elapsed time for page fault. This log can be examined to | |
ad7e33d7 | 501 | determine where the page faults are occurring. |
413996e0 WC |
502 | |
503 | ||
42c55668 MW |
504 | memory/vm.tracepoints.stp - Collect slab allocation statistics |
505 | keywords: memory slab allocator | |
506 | ||
507 | The script will probe all memory slab/slub allocations and collects | |
508 | information about the size of the object (bytes requested) and | |
509 | user-space process in execution. When run over a period of time, it | |
510 | helps to correlate kernel-space memory consumption owing to | |
511 | user-space processes. | |
512 | ||
513 | ||
905728a0 WC |
514 | network/sk_stream_wait_memory.stp - Track Start and Stop of Processes Due to Network Buffer Space |
515 | keywords: network tcp buffer memory | |
516 | ||
517 | The sk_stream-wait_memory.stp prints a time stamp, executable, and | |
518 | pid each time a process blocks due to the send buffer being full. A | |
519 | similar entry is printed each time a process continues because there | |
520 | is room in the buffer. | |
521 | ||
522 | ||
14f0bb18 | 523 | = MONITORING = |
b7f6cfc5 | 524 | |
14f0bb18 FCE |
525 | general/varwatch.stp - Watch a variable changing value in a thread. |
526 | keywords: monitoring | |
b7f6cfc5 | 527 | |
14f0bb18 FCE |
528 | This script places a set of probes (specified by $1), each of which |
529 | monitors the state of some context $variable expression (specified by | |
530 | $2). Whenever the value changes, with respect to the active thread, | |
531 | the event is traced. | |
b7f6cfc5 | 532 | |
1beb5089 FCE |
533 | |
534 | io/mbrwatch.stp - Monitor read/write of MBR (boot sector) area of block devices | |
535 | keywords: io monitoring | |
536 | ||
537 | The mbrwatch.stp script reports any attempted reads/writes of the | |
538 | first few sectors of a raw block device. | |
539 | ||
540 | ||
14f0bb18 FCE |
541 | io/ttyspy.stp - Monitor tty typing. |
542 | keywords: io tty per-process monitoring | |
543 | ||
544 | The ttyspy.stp script uses tty_audit hooks to monitor recent typing | |
545 | activity on the system, printing a scrolling record of recent | |
546 | keystrokes, on a per-tty basis. | |
547 | ||
548 | ||
210ff7bf FCE |
549 | = NETWORK = |
550 | ||
8b88e771 FCE |
551 | network/autofs4.stp - Watch autofs4 operations |
552 | keywords: network autofs nfs | |
553 | ||
554 | Trace key autofs4 operations such as mounting or unmounting remote | |
555 | filesystems. | |
556 | ||
557 | ||
0e4901b0 WC |
558 | network/dropwatch.stp - Watch Where Socket Buffers are Freed in the Kernel |
559 | keywords: network tracepoint buffer free | |
560 | ||
561 | Every five seconds the dropwatch.stp script lists the number of | |
562 | socket buffers freed at locations in the kernel. | |
563 | ||
564 | ||
53e5699f JS |
565 | network/netdev.stp - Trace Activity on Network Devices |
566 | keywords: network device traffic | |
567 | ||
568 | The netdev.stp script traces configuration and transmit/receive | |
569 | activity on network devices. | |
570 | ||
571 | ||
210ff7bf | 572 | network/nettop.stp - Periodic Listing of Processes Using Network Interfaces |
09a98ae0 | 573 | keywords: network traffic per-process |
210ff7bf FCE |
574 | |
575 | Every five seconds the nettop.stp script prints out a list of | |
576 | processed (PID and command) with the number of packets sent/received | |
577 | and the amount of data sent/received by the process during that | |
578 | interval. | |
579 | ||
580 | ||
905728a0 WC |
581 | network/sk_stream_wait_memory.stp - Track Start and Stop of Processes Due to Network Buffer Space |
582 | keywords: network tcp buffer memory | |
583 | ||
584 | The sk_stream-wait_memory.stp prints a time stamp, executable, and | |
585 | pid each time a process blocks due to the send buffer being full. A | |
586 | similar entry is printed each time a process continues because there | |
587 | is room in the buffer. | |
588 | ||
589 | ||
210ff7bf | 590 | network/socket-trace.stp - Trace Functions called in Network Socket Code |
09a98ae0 | 591 | keywords: network socket |
210ff7bf | 592 | |
f3c4da44 MW |
593 | The script instruments each of the functions in the Linux kernel's |
594 | net/socket.c file. The script prints out trace data. The first | |
595 | element of a line is time delta in microseconds from the previous | |
596 | entry. This is followed by the command name and the PID. The "->" and | |
597 | "<-" indicates function entry and function exit, respectively. The | |
598 | last element of the line is the function name. | |
210ff7bf FCE |
599 | |
600 | ||
492d227f WC |
601 | network/tcp_connections.stp - Track Creation of Incoming TCP Connections |
602 | keywords: network tcp socket | |
603 | ||
604 | The tcp_connections.stp script prints information for each new | |
605 | incoming TCP connection accepted by the computer. The information | |
606 | includes the UID, the command accepting the connection, the PID of | |
607 | the command, the port the connection is on, and the IP address of the | |
608 | originator of the request. | |
609 | ||
610 | ||
2e251678 DW |
611 | network/tcp_trace.stp - Tcp connection tracing utility. |
612 | keywords: network trace | |
613 | ||
614 | This scripts traces a given tcp connection based on the filter | |
615 | parameters given by the user. The indexing is done by the 4 tuples | |
616 | local address, remote address, local port, remote port. | |
617 | ||
618 | ||
7a51212c WC |
619 | network/tcpdumplike.stp - Dump of Received TCP Packets |
620 | keywords: network traffic | |
621 | ||
622 | The tcpdumplike.stp prints out a line for each TCP packet received. | |
623 | Each line includes the source and destination IP addresses, the | |
624 | source and destination ports, and flags. | |
625 | ||
626 | ||
4bb6522c WC |
627 | network/tcpipstat.stp - Display network statistics for individual TCP sockets. |
628 | keywords: network statistics | |
629 | ||
f3c4da44 | 630 | tcpipstat collects and displays network statistics related to |
4bb6522c | 631 | individual TCP sockets or groups of sockets. The statistics that are |
f3c4da44 | 632 | collected are simular to that of the command netstat -s, only sorted |
4bb6522c WC |
633 | and grouped by individual sockets. |
634 | ||
635 | ||
8b88e771 FCE |
636 | = NFS = |
637 | ||
638 | network/autofs4.stp - Watch autofs4 operations | |
639 | keywords: network autofs nfs | |
640 | ||
641 | Trace key autofs4 operations such as mounting or unmounting remote | |
642 | filesystems. | |
643 | ||
644 | ||
c728b7da WC |
645 | = NUMA = |
646 | ||
647 | memory/numa_faults.stp - Summarize Process Misses across NUMA Nodes | |
648 | keywords: memory numa | |
649 | ||
650 | The numa_faults.stp script tracks the read and write pages faults for | |
651 | each process. When the script exits it prints out the total read and | |
ad7e33d7 | 652 | write pages faults for each process. The script also provide a break |
c728b7da WC |
653 | down of page faults per node for each process. This script is useful |
654 | for determining whether the program has good locality (page faults | |
655 | limited to a single node) on a NUMA computer. | |
656 | ||
657 | ||
210ff7bf FCE |
658 | = PER-PROCESS = |
659 | ||
b7f6cfc5 | 660 | io/ttyspy.stp - Monitor tty typing. |
14f0bb18 | 661 | keywords: io tty per-process monitoring |
b7f6cfc5 FCE |
662 | |
663 | The ttyspy.stp script uses tty_audit hooks to monitor recent typing | |
664 | activity on the system, printing a scrolling record of recent | |
665 | keystrokes, on a per-tty basis. | |
666 | ||
667 | ||
210ff7bf | 668 | network/nettop.stp - Periodic Listing of Processes Using Network Interfaces |
09a98ae0 | 669 | keywords: network traffic per-process |
210ff7bf FCE |
670 | |
671 | Every five seconds the nettop.stp script prints out a list of | |
672 | processed (PID and command) with the number of packets sent/received | |
673 | and the amount of data sent/received by the process during that | |
674 | interval. | |
675 | ||
676 | ||
cc20d853 ET |
677 | = PROCESS = |
678 | ||
1ff1a65d FCE |
679 | memory/overcommit.stp - Log failed process memory allocation due to overcommit limits |
680 | keywords: memory process | |
681 | ||
682 | The overcommit.stp script prints a line each time the kernel refuses | |
683 | a memory allocation request from a process because of | |
684 | /proc/sys/vm/overcommit* limits. | |
685 | ||
686 | ||
e01bc08e WC |
687 | process/cycle_thief.stp - Track IRQs and Other Processes Stealing Cycles from a Task |
688 | keywords: process scheduler time tracepoint interrupt | |
689 | ||
690 | The cycle_thief.stp script instruments the scheduler and IRQ handler | |
691 | to determine which processes and interrupts are competing with the | |
692 | specified task for the cpu cycles. This script uses the '-c' or '-x' | |
693 | options to focus on a specific task. The script output the number of | |
694 | times the task migrates between processors, histograms showing the | |
695 | length of time on and off processor, lists of processes running while | |
696 | the task is off the processor, and the interrupts that occurred while | |
697 | the task was running. | |
698 | ||
699 | ||
cc20d853 ET |
700 | process/errsnoop.stp - tabulate system call errors |
701 | keywords: process syscall | |
702 | ||
703 | The script prints a periodic tabular report about failing system | |
704 | calls, by process and by syscall failure. The first optional | |
705 | argument specifies the reporting interval (in seconds, default 5); | |
706 | the second optional argument gives a screen height (number of lines | |
707 | in the report, default 20). | |
708 | ||
709 | ||
e6b653c8 WC |
710 | process/forktracker.stp - Trace Creation of Processes |
711 | keywords: process scheduler | |
712 | ||
713 | The forktracker.stp script prints out a time-stamped entry showing | |
f3c4da44 | 714 | each fork and exec operation on the machine. This can be useful to |
e6b653c8 WC |
715 | determine what process is creating a flurry of short-lived processes. |
716 | ||
717 | ||
ecf33ff4 ET |
718 | process/pfiles.stp - print process file descriptors |
719 | keywords: process files | |
720 | ||
721 | Run pfiles.stp to produce a human-readable summary of all open file | |
722 | descriptors of a given process. Specify the process-id as -x PID for | |
723 | fastest performance. | |
724 | ||
725 | ||
5b8642a2 FCE |
726 | process/plimit.stp - print resource limits |
727 | keywords: process | |
728 | ||
729 | The script prints a variety of resource limits for a given pid, like | |
730 | /proc/$$/limits on recent kernels. | |
731 | ||
732 | ||
34029cd3 WC |
733 | process/schedtimes.stp - Track Time Processes Spend in Various States using Tracepoints |
734 | keywords: process scheduler time tracepoint | |
735 | ||
736 | The schedtimes.stp script instruments the scheduler to track the | |
f3c4da44 MW |
737 | amount of time that each process spends in running, sleeping, |
738 | queuing, and waiting for io. On exit the script prints out the | |
739 | accumulated time for each state of processes observed. Optionally, | |
740 | this script can be used with the '-c' or '-x' options to focus on a | |
741 | specific PID. | |
34029cd3 WC |
742 | |
743 | ||
210ff7bf FCE |
744 | = PROFILING = |
745 | ||
a4f3198f WC |
746 | io/iodevstats.stp - List Executables Reading and Writing the Most Data by Device |
747 | keywords: io profiling | |
748 | ||
749 | The iodevstats.stp script measures the amount of data successfully | |
750 | read and written by all the executables for each io device on the | |
751 | system. The output is sorted from greatest sum of bytes read and | |
752 | written to a device by an executable to the least. The output | |
753 | contains device major/minor number, the count of operations (reads | |
754 | and writes), the totals and averages for the number of bytes read and | |
755 | written. | |
756 | ||
757 | ||
54ff5e0c FCE |
758 | io/iostat-scsi.stp - iostat for SCSI Devices |
759 | keywords: io profiling scsi | |
760 | ||
761 | The iostat-scsi.stp script provides a breakdown of the number of blks | |
ad7e33d7 | 762 | read and written on the machine's various SCSI devices. The script |
54ff5e0c FCE |
763 | takes one argument which is the number of seconds between reports. |
764 | ||
765 | ||
3e4444ed WC |
766 | io/iostats.stp - List Executables Reading and Writing the Most Data |
767 | keywords: io profiling | |
768 | ||
769 | The iostat.stp script measures the amount of data successfully read | |
770 | and written by all the executables on the system. The output is | |
771 | sorted from most greatest sum of bytes read and written by an | |
772 | executable to the least. The output contains the count of operations | |
773 | (opens, reads, and writes), the totals and averages for the number of | |
774 | bytes read and written. | |
775 | ||
776 | ||
111dd9ac WC |
777 | io/nfs_func_users.stp - Tally the Number of NFS Functions Used by Each Process |
778 | keywords: io profiling | |
779 | ||
780 | The nfs_func_users.stp script counts the uses of NFS functions in the | |
781 | kernel on a per process bases. The output is sorted from the process | |
782 | with the greatest number of NFS functions called to the least. The | |
783 | output contains the executable name, the process number, and the | |
784 | total number of NFS functions called by the process. | |
785 | ||
786 | ||
210ff7bf | 787 | process/pf2.stp - Profile kernel functions |
09a98ae0 | 788 | keywords: profiling |
210ff7bf FCE |
789 | |
790 | The pf2.stp script sets up time-based sampling. Every five seconds it | |
791 | prints out a sorted list with the top ten kernel functions with | |
792 | samples. | |
793 | ||
794 | ||
f503d3c0 FCE |
795 | profiling/fntimes.stp - Show functions taking longer than usual |
796 | keywords: profiling | |
797 | ||
798 | The fntimes.stp script monitors the execution time history of a given | |
799 | function family (assumed non-recursive). Each time (beyond a warmup | |
800 | interval) is then compared to the historical maximum. If it exceeds | |
801 | a certain threshold (250%), a message is printed. | |
802 | ||
803 | ||
210ff7bf | 804 | profiling/functioncallcount.stp - Count Times Functions Called |
09a98ae0 | 805 | keywords: profiling functions |
210ff7bf FCE |
806 | |
807 | The functioncallcount.stp script takes one argument, a list of | |
808 | functions to probe. The script will run and count the number of times | |
809 | that each of the functions on the list is called. On exit the script | |
810 | will print a sorted list from most frequently to least frequently | |
811 | called function. | |
812 | ||
813 | ||
0449af03 JS |
814 | profiling/sched_switch.stp - Display the task switches happening in the scheduler |
815 | keywords: profiling functions | |
816 | ||
817 | The sched_switch.stp script takes two arguments, first argument can | |
818 | be "pid" or "name" to indicate what is being passed as second | |
819 | argument. The script will trace the process based on pid/name and | |
820 | print the scheduler switches happening with the process. If no | |
821 | arguments are passed, it displays all the scheduler switches. This | |
822 | can be used to understand which tasks schedule out the current | |
823 | process being traced, and when it gets scheduled in again. | |
824 | ||
825 | ||
210ff7bf | 826 | profiling/thread-times.stp - Profile kernel functions |
09a98ae0 | 827 | keywords: profiling |
210ff7bf | 828 | |
1ae72757 JS |
829 | The thread-times.stp script sets up time-based sampling. Every five |
830 | seconds it prints out a sorted list with the top twenty threads | |
831 | occupying the CPUs, broken down as a percentage of user and kernel | |
832 | time. | |
210ff7bf FCE |
833 | |
834 | ||
ff90b297 WC |
835 | profiling/timeout.stp - Show Processes Doing Polling Operations |
836 | keywords: profiling | |
837 | ||
838 | The timeout.stp script is based on a blog entry | |
839 | (http://udrepper.livejournal.com/19041.html) mentioning a need for a | |
840 | tool to help developers find applications that are polling. The | |
841 | timeout.stp script monitors systemcall used for polling and records | |
842 | the systemcalls that timed out rather than returned because some | |
843 | action occurred. The script updates the screen once a second with the | |
844 | top twenty processes. | |
845 | ||
846 | ||
1bf72dfe WC |
847 | profiling/topsys.stp - Show Processes Doing Polling Operations |
848 | keywords: profiling | |
849 | ||
850 | The topsys.stp script lists out the top twenty systemcalls for the | |
851 | previous 5 seconds. The output is sorted from most frequent to least | |
852 | frequent. | |
853 | ||
854 | ||
210ff7bf FCE |
855 | = READ = |
856 | ||
857 | io/iotime.stp - Trace Time Spent in Read and Write for Files | |
09a98ae0 | 858 | keywords: syscall read write time io |
210ff7bf FCE |
859 | |
860 | The script watches each open, close, read, and write syscalls on the | |
861 | system. For each file the scripts observes opened it accumulates the | |
f3c4da44 | 862 | amount of wall clock time spent in read and write operations and the |
210ff7bf FCE |
863 | number of bytes read and written. When a file is closed the script |
864 | prints out a pair of lines for the file. Both lines begin with a | |
865 | timestamp in microseconds, the PID number, and the executable name in | |
ad7e33d7 | 866 | parentheses. The first line with the "access" keyword lists the file |
210ff7bf FCE |
867 | name, the attempted number of bytes for the read and write |
868 | operations. The second line with the "iotime" keyword list the file | |
869 | name and the number of microseconds accumulated in the read and write | |
870 | syscalls. | |
871 | ||
872 | ||
873 | = SCHEDULER = | |
874 | ||
deb63545 WC |
875 | process/chng_cpu.stp - Monitor Changes in Processor Executing a Task |
876 | keywords: scheduler | |
877 | ||
878 | The chng_cpu.stp script takes an argument which is the executable | |
879 | name of the task it should monitor. Each time a task with that | |
880 | executable name is found running on a different processor, the script | |
881 | prints out the thread id (tid), the executable name, the processor | |
882 | now running the task, the thread state, and a backtrace showing the | |
883 | kernel functions that triggered the running of the task on the | |
884 | processor. | |
885 | ||
886 | ||
e01bc08e WC |
887 | process/cycle_thief.stp - Track IRQs and Other Processes Stealing Cycles from a Task |
888 | keywords: process scheduler time tracepoint interrupt | |
889 | ||
890 | The cycle_thief.stp script instruments the scheduler and IRQ handler | |
891 | to determine which processes and interrupts are competing with the | |
892 | specified task for the cpu cycles. This script uses the '-c' or '-x' | |
893 | options to focus on a specific task. The script output the number of | |
894 | times the task migrates between processors, histograms showing the | |
895 | length of time on and off processor, lists of processes running while | |
896 | the task is off the processor, and the interrupts that occurred while | |
897 | the task was running. | |
898 | ||
899 | ||
e6b653c8 WC |
900 | process/forktracker.stp - Trace Creation of Processes |
901 | keywords: process scheduler | |
902 | ||
903 | The forktracker.stp script prints out a time-stamped entry showing | |
f3c4da44 | 904 | each fork and exec operation on the machine. This can be useful to |
e6b653c8 WC |
905 | determine what process is creating a flurry of short-lived processes. |
906 | ||
907 | ||
deb63545 WC |
908 | process/migrate.stp - Track the Migration of Specific Executables |
909 | keywords: scheduler | |
910 | ||
911 | The migrate.stp script takes an argument which is the executable name | |
912 | of the task it should monitor. Each time a task with that executable | |
913 | name migrates between processors an entry is printed with the process | |
914 | id (pid), the executable name, the processor off loading the task, | |
915 | and the process taking the task. Note that the task may or may not be | |
916 | executing at the time of the migration. | |
917 | ||
918 | ||
34029cd3 WC |
919 | process/schedtimes.stp - Track Time Processes Spend in Various States using Tracepoints |
920 | keywords: process scheduler time tracepoint | |
921 | ||
922 | The schedtimes.stp script instruments the scheduler to track the | |
f3c4da44 MW |
923 | amount of time that each process spends in running, sleeping, |
924 | queuing, and waiting for io. On exit the script prints out the | |
925 | accumulated time for each state of processes observed. Optionally, | |
926 | this script can be used with the '-c' or '-x' options to focus on a | |
927 | specific PID. | |
34029cd3 WC |
928 | |
929 | ||
210ff7bf | 930 | process/sleepingBeauties.stp - Generating Backtraces of Threads Waiting for IO Operations |
09a98ae0 | 931 | keywords: io scheduler backtrace |
cae71dd3 | 932 | |
f3c4da44 | 933 | The script monitors the time that threads spend in waiting for IO |
cae71dd3 FCE |
934 | operations (in "D" state) in the wait_for_completion function. If a |
935 | thread spends over 10ms, its name and backtrace is printed, and later | |
936 | so is the total delay. | |
210ff7bf FCE |
937 | |
938 | ||
54ff5e0c FCE |
939 | = SCSI = |
940 | ||
941 | io/iostat-scsi.stp - iostat for SCSI Devices | |
942 | keywords: io profiling scsi | |
943 | ||
944 | The iostat-scsi.stp script provides a breakdown of the number of blks | |
ad7e33d7 | 945 | read and written on the machine's various SCSI devices. The script |
54ff5e0c FCE |
946 | takes one argument which is the number of seconds between reports. |
947 | ||
948 | ||
210ff7bf FCE |
949 | = SIGNALS = |
950 | ||
951 | process/sig_by_pid.stp - Signal Counts by Process ID | |
09a98ae0 | 952 | keywords: signals |
210ff7bf FCE |
953 | |
954 | Print signal counts by process ID in descending order. | |
955 | ||
956 | ||
957 | process/sig_by_proc.stp - Signal Counts by Process Name | |
09a98ae0 | 958 | keywords: signals |
210ff7bf FCE |
959 | |
960 | Print signal counts by process name in descending order. | |
961 | ||
962 | ||
963 | process/sigkill.stp - Track SIGKILL Signals | |
09a98ae0 | 964 | keywords: signals |
210ff7bf FCE |
965 | |
966 | The script traces any SIGKILL signals. When that SIGKILL signal is | |
967 | sent to a process, the script prints out the signal name, the | |
f3c4da44 MW |
968 | destination executable and process ID, the executable name and user |
969 | ID that sents the signal. | |
210ff7bf FCE |
970 | |
971 | ||
3a748561 | 972 | process/sigmon.stp - Track a particular signal to a specific process |
09a98ae0 | 973 | keywords: signals |
210ff7bf FCE |
974 | |
975 | The script watches for a particular signal sent to a specific | |
976 | process. When that signal is sent to the specified process, the | |
977 | script prints out the PID and executable of the process sending the | |
978 | signal, the PID and executable name of the process receiving the | |
979 | signal, and the signal number and name. | |
980 | ||
981 | ||
982 | = SIMPLE = | |
983 | ||
984 | general/helloworld.stp - SystemTap "Hello World" Program | |
09a98ae0 | 985 | keywords: simple |
210ff7bf FCE |
986 | |
987 | A basic "Hello World" program implemented in SystemTap script. It | |
988 | prints out "hello world" message and then immediately exits. | |
989 | ||
990 | ||
42c55668 MW |
991 | = SLAB = |
992 | ||
993 | memory/vm.tracepoints.stp - Collect slab allocation statistics | |
994 | keywords: memory slab allocator | |
995 | ||
996 | The script will probe all memory slab/slub allocations and collects | |
997 | information about the size of the object (bytes requested) and | |
998 | user-space process in execution. When run over a period of time, it | |
999 | helps to correlate kernel-space memory consumption owing to | |
1000 | user-space processes. | |
1001 | ||
1002 | ||
210ff7bf FCE |
1003 | = SLEEP = |
1004 | ||
1005 | process/sleeptime.stp - Trace Time Spent in nanosleep Syscalls | |
09a98ae0 | 1006 | keywords: syscall sleep |
210ff7bf FCE |
1007 | |
1008 | The script watches each nanosleep syscall on the system. At the end | |
1009 | of each nanosleep syscall the script prints out a line with a | |
1010 | timestamp in microseconds, the pid, the executable name in | |
ad7e33d7 | 1011 | parentheses, the "nanosleep:" key, and the duration of the sleep in |
210ff7bf FCE |
1012 | microseconds. |
1013 | ||
1014 | ||
1015 | = SOCKET = | |
1016 | ||
1017 | network/socket-trace.stp - Trace Functions called in Network Socket Code | |
09a98ae0 | 1018 | keywords: network socket |
210ff7bf | 1019 | |
f3c4da44 MW |
1020 | The script instruments each of the functions in the Linux kernel's |
1021 | net/socket.c file. The script prints out trace data. The first | |
1022 | element of a line is time delta in microseconds from the previous | |
1023 | entry. This is followed by the command name and the PID. The "->" and | |
1024 | "<-" indicates function entry and function exit, respectively. The | |
1025 | last element of the line is the function name. | |
210ff7bf FCE |
1026 | |
1027 | ||
492d227f WC |
1028 | network/tcp_connections.stp - Track Creation of Incoming TCP Connections |
1029 | keywords: network tcp socket | |
1030 | ||
1031 | The tcp_connections.stp script prints information for each new | |
1032 | incoming TCP connection accepted by the computer. The information | |
1033 | includes the UID, the command accepting the connection, the PID of | |
1034 | the command, the port the connection is on, and the IP address of the | |
1035 | originator of the request. | |
1036 | ||
1037 | ||
4bb6522c WC |
1038 | = STATISTICS = |
1039 | ||
1040 | network/tcpipstat.stp - Display network statistics for individual TCP sockets. | |
1041 | keywords: network statistics | |
1042 | ||
f3c4da44 | 1043 | tcpipstat collects and displays network statistics related to |
4bb6522c | 1044 | individual TCP sockets or groups of sockets. The statistics that are |
f3c4da44 | 1045 | collected are simular to that of the command netstat -s, only sorted |
4bb6522c WC |
1046 | and grouped by individual sockets. |
1047 | ||
1048 | ||
210ff7bf FCE |
1049 | = SYSCALL = |
1050 | ||
1051 | io/iotime.stp - Trace Time Spent in Read and Write for Files | |
09a98ae0 | 1052 | keywords: syscall read write time io |
210ff7bf FCE |
1053 | |
1054 | The script watches each open, close, read, and write syscalls on the | |
1055 | system. For each file the scripts observes opened it accumulates the | |
f3c4da44 | 1056 | amount of wall clock time spent in read and write operations and the |
210ff7bf FCE |
1057 | number of bytes read and written. When a file is closed the script |
1058 | prints out a pair of lines for the file. Both lines begin with a | |
1059 | timestamp in microseconds, the PID number, and the executable name in | |
ad7e33d7 | 1060 | parentheses. The first line with the "access" keyword lists the file |
210ff7bf FCE |
1061 | name, the attempted number of bytes for the read and write |
1062 | operations. The second line with the "iotime" keyword list the file | |
1063 | name and the number of microseconds accumulated in the read and write | |
1064 | syscalls. | |
1065 | ||
1066 | ||
cc20d853 ET |
1067 | process/errsnoop.stp - tabulate system call errors |
1068 | keywords: process syscall | |
1069 | ||
1070 | The script prints a periodic tabular report about failing system | |
1071 | calls, by process and by syscall failure. The first optional | |
1072 | argument specifies the reporting interval (in seconds, default 5); | |
1073 | the second optional argument gives a screen height (number of lines | |
1074 | in the report, default 20). | |
1075 | ||
1076 | ||
210ff7bf | 1077 | process/futexes.stp - System-Wide Futex Contention |
09a98ae0 | 1078 | keywords: syscall locking futex |
210ff7bf FCE |
1079 | |
1080 | The script watches the futex syscall on the system. On exit the | |
1081 | futexes address, the number of contentions, and the average time for | |
1082 | each contention on the futex are printed from lowest pid number to | |
1083 | highest. | |
1084 | ||
1085 | ||
1086 | process/sleeptime.stp - Trace Time Spent in nanosleep Syscalls | |
09a98ae0 | 1087 | keywords: syscall sleep |
210ff7bf FCE |
1088 | |
1089 | The script watches each nanosleep syscall on the system. At the end | |
1090 | of each nanosleep syscall the script prints out a line with a | |
1091 | timestamp in microseconds, the pid, the executable name in | |
ad7e33d7 | 1092 | parentheses, the "nanosleep:" key, and the duration of the sleep in |
210ff7bf FCE |
1093 | microseconds. |
1094 | ||
1095 | ||
1096 | process/syscalls_by_pid.stp - System-Wide Count of Syscalls by PID | |
09a98ae0 | 1097 | keywords: syscall |
210ff7bf FCE |
1098 | |
1099 | The script watches all syscall on the system. On exit the script | |
1100 | prints a list showing the number of systemcalls executed by each PID | |
1101 | ordered from greatest to least number of syscalls. | |
1102 | ||
1103 | ||
1104 | process/syscalls_by_proc.stp - System-Wide Count of Syscalls by Executable | |
09a98ae0 | 1105 | keywords: syscall |
210ff7bf FCE |
1106 | |
1107 | The script watches all syscall on the system. On exit the script | |
1108 | prints a list showing the number of systemcalls executed by each | |
ad7e33d7 | 1109 | executable ordered from greatest to least number of syscalls. |
210ff7bf FCE |
1110 | |
1111 | ||
1112 | process/wait4time.stp - Trace Time Spent in wait4 Syscalls | |
09a98ae0 | 1113 | keywords: syscall wait4 |
210ff7bf FCE |
1114 | |
1115 | The script watches each wait4 syscall on the system. At the end of | |
1116 | each wait4 syscall the script prints out a line with a timestamp in | |
ad7e33d7 | 1117 | microseconds, the pid, the executable name in parentheses, the |
210ff7bf FCE |
1118 | "wait4:" key, the duration of the wait and the PID that the wait4 was |
1119 | waiting for. If the waited for PID is not specified , it is "-1". | |
1120 | ||
1121 | ||
492d227f WC |
1122 | = TCP = |
1123 | ||
905728a0 WC |
1124 | network/sk_stream_wait_memory.stp - Track Start and Stop of Processes Due to Network Buffer Space |
1125 | keywords: network tcp buffer memory | |
1126 | ||
1127 | The sk_stream-wait_memory.stp prints a time stamp, executable, and | |
1128 | pid each time a process blocks due to the send buffer being full. A | |
1129 | similar entry is printed each time a process continues because there | |
1130 | is room in the buffer. | |
1131 | ||
1132 | ||
492d227f WC |
1133 | network/tcp_connections.stp - Track Creation of Incoming TCP Connections |
1134 | keywords: network tcp socket | |
1135 | ||
1136 | The tcp_connections.stp script prints information for each new | |
1137 | incoming TCP connection accepted by the computer. The information | |
1138 | includes the UID, the command accepting the connection, the PID of | |
1139 | the command, the port the connection is on, and the IP address of the | |
1140 | originator of the request. | |
1141 | ||
1142 | ||
210ff7bf FCE |
1143 | = TIME = |
1144 | ||
1145 | io/iotime.stp - Trace Time Spent in Read and Write for Files | |
09a98ae0 | 1146 | keywords: syscall read write time io |
210ff7bf FCE |
1147 | |
1148 | The script watches each open, close, read, and write syscalls on the | |
1149 | system. For each file the scripts observes opened it accumulates the | |
f3c4da44 | 1150 | amount of wall clock time spent in read and write operations and the |
210ff7bf FCE |
1151 | number of bytes read and written. When a file is closed the script |
1152 | prints out a pair of lines for the file. Both lines begin with a | |
1153 | timestamp in microseconds, the PID number, and the executable name in | |
ad7e33d7 | 1154 | parentheses. The first line with the "access" keyword lists the file |
210ff7bf FCE |
1155 | name, the attempted number of bytes for the read and write |
1156 | operations. The second line with the "iotime" keyword list the file | |
1157 | name and the number of microseconds accumulated in the read and write | |
1158 | syscalls. | |
1159 | ||
1160 | ||
e01bc08e WC |
1161 | process/cycle_thief.stp - Track IRQs and Other Processes Stealing Cycles from a Task |
1162 | keywords: process scheduler time tracepoint interrupt | |
1163 | ||
1164 | The cycle_thief.stp script instruments the scheduler and IRQ handler | |
1165 | to determine which processes and interrupts are competing with the | |
1166 | specified task for the cpu cycles. This script uses the '-c' or '-x' | |
1167 | options to focus on a specific task. The script output the number of | |
1168 | times the task migrates between processors, histograms showing the | |
1169 | length of time on and off processor, lists of processes running while | |
1170 | the task is off the processor, and the interrupts that occurred while | |
1171 | the task was running. | |
1172 | ||
1173 | ||
34029cd3 WC |
1174 | process/schedtimes.stp - Track Time Processes Spend in Various States using Tracepoints |
1175 | keywords: process scheduler time tracepoint | |
1176 | ||
1177 | The schedtimes.stp script instruments the scheduler to track the | |
f3c4da44 MW |
1178 | amount of time that each process spends in running, sleeping, |
1179 | queuing, and waiting for io. On exit the script prints out the | |
1180 | accumulated time for each state of processes observed. Optionally, | |
1181 | this script can be used with the '-c' or '-x' options to focus on a | |
1182 | specific PID. | |
34029cd3 WC |
1183 | |
1184 | ||
210ff7bf FCE |
1185 | = TRACE = |
1186 | ||
aa15b9f0 | 1187 | general/para-callgraph.stp - Callgraph tracing with arguments |
09a98ae0 | 1188 | keywords: trace callgraph |
210ff7bf | 1189 | |
aa15b9f0 FCE |
1190 | Print a timed per-thread callgraph, complete with function parameters |
1191 | and return values. The first parameter names the function probe | |
1192 | points to trace. The optional second parameter names the probe | |
1193 | points for trigger functions, which acts to enable tracing for only | |
1194 | those functions that occur while the current thread is nested within | |
1195 | the trigger. | |
210ff7bf FCE |
1196 | |
1197 | ||
2e251678 DW |
1198 | network/tcp_trace.stp - Tcp connection tracing utility. |
1199 | keywords: network trace | |
1200 | ||
1201 | This scripts traces a given tcp connection based on the filter | |
1202 | parameters given by the user. The indexing is done by the 4 tuples | |
1203 | local address, remote address, local port, remote port. | |
1204 | ||
1205 | ||
0e4901b0 WC |
1206 | = TRACEPOINT = |
1207 | ||
1208 | network/dropwatch.stp - Watch Where Socket Buffers are Freed in the Kernel | |
1209 | keywords: network tracepoint buffer free | |
1210 | ||
1211 | Every five seconds the dropwatch.stp script lists the number of | |
1212 | socket buffers freed at locations in the kernel. | |
1213 | ||
1214 | ||
e01bc08e WC |
1215 | process/cycle_thief.stp - Track IRQs and Other Processes Stealing Cycles from a Task |
1216 | keywords: process scheduler time tracepoint interrupt | |
1217 | ||
1218 | The cycle_thief.stp script instruments the scheduler and IRQ handler | |
1219 | to determine which processes and interrupts are competing with the | |
1220 | specified task for the cpu cycles. This script uses the '-c' or '-x' | |
1221 | options to focus on a specific task. The script output the number of | |
1222 | times the task migrates between processors, histograms showing the | |
1223 | length of time on and off processor, lists of processes running while | |
1224 | the task is off the processor, and the interrupts that occurred while | |
1225 | the task was running. | |
1226 | ||
1227 | ||
34029cd3 WC |
1228 | process/schedtimes.stp - Track Time Processes Spend in Various States using Tracepoints |
1229 | keywords: process scheduler time tracepoint | |
1230 | ||
1231 | The schedtimes.stp script instruments the scheduler to track the | |
f3c4da44 MW |
1232 | amount of time that each process spends in running, sleeping, |
1233 | queuing, and waiting for io. On exit the script prints out the | |
1234 | accumulated time for each state of processes observed. Optionally, | |
1235 | this script can be used with the '-c' or '-x' options to focus on a | |
1236 | specific PID. | |
34029cd3 WC |
1237 | |
1238 | ||
210ff7bf FCE |
1239 | = TRAFFIC = |
1240 | ||
53e5699f JS |
1241 | network/netdev.stp - Trace Activity on Network Devices |
1242 | keywords: network device traffic | |
1243 | ||
1244 | The netdev.stp script traces configuration and transmit/receive | |
1245 | activity on network devices. | |
1246 | ||
1247 | ||
210ff7bf | 1248 | network/nettop.stp - Periodic Listing of Processes Using Network Interfaces |
09a98ae0 | 1249 | keywords: network traffic per-process |
210ff7bf FCE |
1250 | |
1251 | Every five seconds the nettop.stp script prints out a list of | |
1252 | processed (PID and command) with the number of packets sent/received | |
1253 | and the amount of data sent/received by the process during that | |
1254 | interval. | |
1255 | ||
1256 | ||
7a51212c WC |
1257 | network/tcpdumplike.stp - Dump of Received TCP Packets |
1258 | keywords: network traffic | |
1259 | ||
1260 | The tcpdumplike.stp prints out a line for each TCP packet received. | |
1261 | Each line includes the source and destination IP addresses, the | |
1262 | source and destination ports, and flags. | |
1263 | ||
1264 | ||
b7f6cfc5 FCE |
1265 | = TTY = |
1266 | ||
1267 | io/ttyspy.stp - Monitor tty typing. | |
14f0bb18 | 1268 | keywords: io tty per-process monitoring |
b7f6cfc5 FCE |
1269 | |
1270 | The ttyspy.stp script uses tty_audit hooks to monitor recent typing | |
1271 | activity on the system, printing a scrolling record of recent | |
1272 | keystrokes, on a per-tty basis. | |
1273 | ||
1274 | ||
210ff7bf FCE |
1275 | = USE = |
1276 | ||
1277 | general/graphs.stp - Graphing Disk and CPU Utilization | |
09a98ae0 | 1278 | keywords: disk cpu use graph |
210ff7bf FCE |
1279 | |
1280 | The script tracks the disk and CPU utilization. The resulting output | |
1281 | of the script can be piped into gnuplot to generate a graph of disk | |
1282 | and CPU USE. | |
1283 | ||
1284 | ||
1285 | = WAIT4 = | |
1286 | ||
1287 | process/wait4time.stp - Trace Time Spent in wait4 Syscalls | |
09a98ae0 | 1288 | keywords: syscall wait4 |
210ff7bf FCE |
1289 | |
1290 | The script watches each wait4 syscall on the system. At the end of | |
1291 | each wait4 syscall the script prints out a line with a timestamp in | |
ad7e33d7 | 1292 | microseconds, the pid, the executable name in parentheses, the |
210ff7bf FCE |
1293 | "wait4:" key, the duration of the wait and the PID that the wait4 was |
1294 | waiting for. If the waited for PID is not specified , it is "-1". | |
1295 | ||
1296 | ||
1297 | = WRITE = | |
1298 | ||
1299 | io/iotime.stp - Trace Time Spent in Read and Write for Files | |
09a98ae0 | 1300 | keywords: syscall read write time io |
210ff7bf FCE |
1301 | |
1302 | The script watches each open, close, read, and write syscalls on the | |
1303 | system. For each file the scripts observes opened it accumulates the | |
f3c4da44 | 1304 | amount of wall clock time spent in read and write operations and the |
210ff7bf FCE |
1305 | number of bytes read and written. When a file is closed the script |
1306 | prints out a pair of lines for the file. Both lines begin with a | |
1307 | timestamp in microseconds, the PID number, and the executable name in | |
ad7e33d7 | 1308 | parentheses. The first line with the "access" keyword lists the file |
210ff7bf FCE |
1309 | name, the attempted number of bytes for the read and write |
1310 | operations. The second line with the "iotime" keyword list the file | |
1311 | name and the number of microseconds accumulated in the read and write | |
1312 | syscalls. | |
1313 | ||
1314 |