]>
Commit | Line | Data |
---|---|---|
210ff7bf | 1 | SYSTEMTAP EXAMPLES INDEX BY KEYWORD |
09a98ae0 | 2 | (see also index.txt) |
210ff7bf | 3 | |
42c55668 MW |
4 | = ALLOCATOR = |
5 | ||
6 | memory/vm.tracepoints.stp - Collect slab allocation statistics | |
7 | keywords: memory slab allocator | |
8 | ||
9 | The script will probe all memory slab/slub allocations and collects | |
10 | information about the size of the object (bytes requested) and | |
11 | user-space process in execution. When run over a period of time, it | |
12 | helps to correlate kernel-space memory consumption owing to | |
13 | user-space processes. | |
14 | ||
15 | ||
8b88e771 FCE |
16 | = AUTOFS = |
17 | ||
18 | network/autofs4.stp - Watch autofs4 operations | |
19 | keywords: network autofs nfs | |
20 | ||
21 | Trace key autofs4 operations such as mounting or unmounting remote | |
22 | filesystems. | |
23 | ||
24 | ||
210ff7bf FCE |
25 | = BACKTRACE = |
26 | ||
1cc8a4c7 WC |
27 | interrupt/scf.stp - Tally Backtraces for Inter-Processor Interrupt (IPI) |
28 | keywords: interrupt backtrace | |
29 | ||
30 | The Linux kernel function smp_call_function causes expensive | |
31 | inter-processor interrupts (IPIs). The scf.stp script tallies the | |
32 | processes and backtraces causing the interprocessor interrupts to | |
33 | identify the cause of the expensive IPI. On exit the script prints | |
34 | the tallies in descending frequency. | |
35 | ||
36 | ||
210ff7bf | 37 | io/io_submit.stp - Tally Reschedule Reason During AIO io_submit Call |
09a98ae0 | 38 | keywords: io backtrace |
210ff7bf FCE |
39 | |
40 | When a reschedule occurs during an AIO io_submit call, accumulate the | |
41 | traceback in a histogram. When the script exits prints out a sorted | |
42 | list from most common to least common backtrace. | |
43 | ||
44 | ||
cae71dd3 | 45 | process/sleepingBeauties.stp - Generating Backtraces of Threads Waiting for IO Operations |
09a98ae0 | 46 | keywords: io scheduler backtrace |
cae71dd3 | 47 | |
f3c4da44 | 48 | The script monitors the time that threads spend in waiting for IO |
cae71dd3 FCE |
49 | operations (in "D" state) in the wait_for_completion function. If a |
50 | thread spends over 10ms, its name and backtrace is printed, and later | |
51 | so is the total delay. | |
52 | ||
53 | ||
0e4901b0 WC |
54 | = BUFFER = |
55 | ||
56 | network/dropwatch.stp - Watch Where Socket Buffers are Freed in the Kernel | |
57 | keywords: network tracepoint buffer free | |
58 | ||
59 | Every five seconds the dropwatch.stp script lists the number of | |
60 | socket buffers freed at locations in the kernel. | |
61 | ||
62 | ||
905728a0 WC |
63 | network/sk_stream_wait_memory.stp - Track Start and Stop of Processes Due to Network Buffer Space |
64 | keywords: network tcp buffer memory | |
65 | ||
66 | The sk_stream-wait_memory.stp prints a time stamp, executable, and | |
67 | pid each time a process blocks due to the send buffer being full. A | |
68 | similar entry is printed each time a process continues because there | |
69 | is room in the buffer. | |
70 | ||
71 | ||
210ff7bf FCE |
72 | = CALLGRAPH = |
73 | ||
aa15b9f0 | 74 | general/para-callgraph.stp - Callgraph tracing with arguments |
09a98ae0 | 75 | keywords: trace callgraph |
210ff7bf | 76 | |
aa15b9f0 FCE |
77 | Print a timed per-thread callgraph, complete with function parameters |
78 | and return values. The first parameter names the function probe | |
79 | points to trace. The optional second parameter names the probe | |
80 | points for trigger functions, which acts to enable tracing for only | |
81 | those functions that occur while the current thread is nested within | |
82 | the trigger. | |
210ff7bf FCE |
83 | |
84 | ||
85 | = CPU = | |
86 | ||
87 | general/graphs.stp - Graphing Disk and CPU Utilization | |
09a98ae0 | 88 | keywords: disk cpu use graph |
210ff7bf FCE |
89 | |
90 | The script tracks the disk and CPU utilization. The resulting output | |
91 | of the script can be piped into gnuplot to generate a graph of disk | |
92 | and CPU USE. | |
93 | ||
94 | ||
53e5699f JS |
95 | = DEVICE = |
96 | ||
97 | network/netdev.stp - Trace Activity on Network Devices | |
98 | keywords: network device traffic | |
99 | ||
100 | The netdev.stp script traces configuration and transmit/receive | |
101 | activity on network devices. | |
102 | ||
103 | ||
210ff7bf FCE |
104 | = DISK = |
105 | ||
106 | general/graphs.stp - Graphing Disk and CPU Utilization | |
09a98ae0 | 107 | keywords: disk cpu use graph |
210ff7bf FCE |
108 | |
109 | The script tracks the disk and CPU utilization. The resulting output | |
110 | of the script can be piped into gnuplot to generate a graph of disk | |
111 | and CPU USE. | |
112 | ||
113 | ||
114 | io/disktop.stp - Summarize Disk Read/Write Traffic | |
09a98ae0 | 115 | keywords: disk |
210ff7bf FCE |
116 | |
117 | Get the status of reading/writing disk every 5 seconds, output top | |
118 | ten entries during that period. | |
119 | ||
120 | ||
ecf33ff4 ET |
121 | = FILES = |
122 | ||
123 | process/pfiles.stp - print process file descriptors | |
124 | keywords: process files | |
125 | ||
126 | Run pfiles.stp to produce a human-readable summary of all open file | |
127 | descriptors of a given process. Specify the process-id as -x PID for | |
128 | fastest performance. | |
129 | ||
130 | ||
ac505f97 JS |
131 | = FILESYSTEM = |
132 | ||
133 | general/badname.stp - Bad Filename Filter | |
134 | keywords: filesystem hack | |
135 | ||
136 | The badname.stp script shows how one could prevent the creation of | |
6287a9e6 | 137 | files with undesirable names using guru mode. |
ac505f97 JS |
138 | |
139 | ||
0e0b566a WC |
140 | = FORMAT = |
141 | ||
142 | general/ansi_colors.stp - Color Table for ansi_set_color2() and ansi_set_color3() | |
143 | keywords: format | |
144 | ||
145 | The script prints a table showing the available color combinations | |
146 | for the ansi_set_color2() and ans_set_color3() functions in the | |
147 | ansi.stp tapset. | |
148 | ||
149 | ||
150 | general/ansi_colors2.stp - Show Attribues in Table for ansi_set_color3() | |
151 | keywords: format | |
152 | ||
153 | The script prints a table showing the available attributes (bold, | |
154 | underline, and inverse) with color combinations for the | |
155 | ans_set_color3() function in the ansi.stp tapset. | |
156 | ||
157 | ||
0e4901b0 WC |
158 | = FREE = |
159 | ||
160 | network/dropwatch.stp - Watch Where Socket Buffers are Freed in the Kernel | |
161 | keywords: network tracepoint buffer free | |
162 | ||
163 | Every five seconds the dropwatch.stp script lists the number of | |
164 | socket buffers freed at locations in the kernel. | |
165 | ||
166 | ||
210ff7bf FCE |
167 | = FUNCTIONS = |
168 | ||
169 | profiling/functioncallcount.stp - Count Times Functions Called | |
09a98ae0 | 170 | keywords: profiling functions |
210ff7bf FCE |
171 | |
172 | The functioncallcount.stp script takes one argument, a list of | |
173 | functions to probe. The script will run and count the number of times | |
174 | that each of the functions on the list is called. On exit the script | |
175 | will print a sorted list from most frequently to least frequently | |
176 | called function. | |
177 | ||
178 | ||
0449af03 JS |
179 | profiling/sched_switch.stp - Display the task switches happening in the scheduler |
180 | keywords: profiling functions | |
181 | ||
182 | The sched_switch.stp script takes two arguments, first argument can | |
183 | be "pid" or "name" to indicate what is being passed as second | |
184 | argument. The script will trace the process based on pid/name and | |
185 | print the scheduler switches happening with the process. If no | |
186 | arguments are passed, it displays all the scheduler switches. This | |
187 | can be used to understand which tasks schedule out the current | |
188 | process being traced, and when it gets scheduled in again. | |
189 | ||
190 | ||
210ff7bf FCE |
191 | = FUTEX = |
192 | ||
193 | process/futexes.stp - System-Wide Futex Contention | |
09a98ae0 | 194 | keywords: syscall locking futex |
210ff7bf FCE |
195 | |
196 | The script watches the futex syscall on the system. On exit the | |
197 | futexes address, the number of contentions, and the average time for | |
198 | each contention on the futex are printed from lowest pid number to | |
199 | highest. | |
200 | ||
201 | ||
202 | = GRAPH = | |
203 | ||
204 | general/graphs.stp - Graphing Disk and CPU Utilization | |
09a98ae0 | 205 | keywords: disk cpu use graph |
210ff7bf FCE |
206 | |
207 | The script tracks the disk and CPU utilization. The resulting output | |
208 | of the script can be piped into gnuplot to generate a graph of disk | |
209 | and CPU USE. | |
210 | ||
211 | ||
ac505f97 JS |
212 | = HACK = |
213 | ||
214 | general/badname.stp - Bad Filename Filter | |
215 | keywords: filesystem hack | |
216 | ||
217 | The badname.stp script shows how one could prevent the creation of | |
6287a9e6 | 218 | files with undesirable names using guru mode. |
ac505f97 JS |
219 | |
220 | ||
1cc8a4c7 WC |
221 | = INTERRUPT = |
222 | ||
6b95efe9 JS |
223 | interrupt/interrupts-by-dev.stp - Record interrupts on a per-device basis. |
224 | keywords: interrupt | |
225 | ||
226 | The interrupts-by-dev.stp script profiles interrupts received by each | |
227 | device per 100 ms. | |
228 | ||
229 | ||
1cc8a4c7 WC |
230 | interrupt/scf.stp - Tally Backtraces for Inter-Processor Interrupt (IPI) |
231 | keywords: interrupt backtrace | |
232 | ||
233 | The Linux kernel function smp_call_function causes expensive | |
234 | inter-processor interrupts (IPIs). The scf.stp script tallies the | |
235 | processes and backtraces causing the interprocessor interrupts to | |
236 | identify the cause of the expensive IPI. On exit the script prints | |
237 | the tallies in descending frequency. | |
238 | ||
239 | ||
210ff7bf FCE |
240 | = IO = |
241 | ||
242 | io/io_submit.stp - Tally Reschedule Reason During AIO io_submit Call | |
09a98ae0 | 243 | keywords: io backtrace |
210ff7bf FCE |
244 | |
245 | When a reschedule occurs during an AIO io_submit call, accumulate the | |
246 | traceback in a histogram. When the script exits prints out a sorted | |
247 | list from most common to least common backtrace. | |
248 | ||
249 | ||
67f8611b WC |
250 | io/ioblktime.stp - Average Time Block IO Requests Spend in Queue |
251 | keywords: io | |
252 | ||
253 | The ioblktime.stp script tracks the amount of time that each block IO | |
cc20d853 | 254 | requests spend waiting for completion. The script computes the |
f3c4da44 MW |
255 | average waiting time for block IO per device and prints list every 10 |
256 | seconds. In some cases there can be too many outstanding block IO | |
257 | operations and the script may exceed the default number of | |
67f8611b WC |
258 | MAXMAPENTRIES allowed. In this case the allowed number can be |
259 | increased with "-DMAXMAPENTRIES=10000" option on the stap command | |
260 | line. | |
261 | ||
262 | ||
a4f3198f WC |
263 | io/iodevstats.stp - List Executables Reading and Writing the Most Data by Device |
264 | keywords: io profiling | |
265 | ||
266 | The iodevstats.stp script measures the amount of data successfully | |
267 | read and written by all the executables for each io device on the | |
268 | system. The output is sorted from greatest sum of bytes read and | |
269 | written to a device by an executable to the least. The output | |
270 | contains device major/minor number, the count of operations (reads | |
271 | and writes), the totals and averages for the number of bytes read and | |
272 | written. | |
273 | ||
274 | ||
54ff5e0c FCE |
275 | io/iostat-scsi.stp - iostat for SCSI Devices |
276 | keywords: io profiling scsi | |
277 | ||
278 | The iostat-scsi.stp script provides a breakdown of the number of blks | |
ad7e33d7 | 279 | read and written on the machine's various SCSI devices. The script |
54ff5e0c FCE |
280 | takes one argument which is the number of seconds between reports. |
281 | ||
282 | ||
3e4444ed WC |
283 | io/iostats.stp - List Executables Reading and Writing the Most Data |
284 | keywords: io profiling | |
285 | ||
286 | The iostat.stp script measures the amount of data successfully read | |
287 | and written by all the executables on the system. The output is | |
288 | sorted from most greatest sum of bytes read and written by an | |
289 | executable to the least. The output contains the count of operations | |
290 | (opens, reads, and writes), the totals and averages for the number of | |
291 | bytes read and written. | |
292 | ||
293 | ||
210ff7bf | 294 | io/iotime.stp - Trace Time Spent in Read and Write for Files |
09a98ae0 | 295 | keywords: syscall read write time io |
210ff7bf FCE |
296 | |
297 | The script watches each open, close, read, and write syscalls on the | |
298 | system. For each file the scripts observes opened it accumulates the | |
f3c4da44 | 299 | amount of wall clock time spent in read and write operations and the |
210ff7bf FCE |
300 | number of bytes read and written. When a file is closed the script |
301 | prints out a pair of lines for the file. Both lines begin with a | |
302 | timestamp in microseconds, the PID number, and the executable name in | |
ad7e33d7 | 303 | parentheses. The first line with the "access" keyword lists the file |
210ff7bf FCE |
304 | name, the attempted number of bytes for the read and write |
305 | operations. The second line with the "iotime" keyword list the file | |
306 | name and the number of microseconds accumulated in the read and write | |
307 | syscalls. | |
308 | ||
309 | ||
310 | io/iotop.stp - Periodically Print I/O Activity by Process Name | |
09a98ae0 | 311 | keywords: io |
210ff7bf FCE |
312 | |
313 | Every five seconds print out the top ten executables generating I/O | |
314 | traffic during that interval sorted in descending order. | |
315 | ||
316 | ||
1beb5089 FCE |
317 | io/mbrwatch.stp - Monitor read/write of MBR (boot sector) area of block devices |
318 | keywords: io monitoring | |
319 | ||
320 | The mbrwatch.stp script reports any attempted reads/writes of the | |
321 | first few sectors of a raw block device. | |
322 | ||
323 | ||
111dd9ac WC |
324 | io/nfs_func_users.stp - Tally the Number of NFS Functions Used by Each Process |
325 | keywords: io profiling | |
326 | ||
327 | The nfs_func_users.stp script counts the uses of NFS functions in the | |
328 | kernel on a per process bases. The output is sorted from the process | |
329 | with the greatest number of NFS functions called to the least. The | |
330 | output contains the executable name, the process number, and the | |
331 | total number of NFS functions called by the process. | |
332 | ||
333 | ||
210ff7bf | 334 | io/traceio.stp - Track Cumulative I/O Activity by Process Name |
09a98ae0 | 335 | keywords: io |
210ff7bf FCE |
336 | |
337 | Every second print out the top ten executables sorted in descending | |
338 | order based on cumulative I/O traffic observed. | |
339 | ||
340 | ||
341 | io/traceio2.stp - Watch I/O Activity on a Particular Device | |
09a98ae0 | 342 | keywords: io |
210ff7bf FCE |
343 | |
344 | Print out the executable name and process number as reads and writes | |
345 | to the specified device occur. | |
346 | ||
347 | ||
b7f6cfc5 | 348 | io/ttyspy.stp - Monitor tty typing. |
14f0bb18 | 349 | keywords: io tty per-process monitoring |
b7f6cfc5 FCE |
350 | |
351 | The ttyspy.stp script uses tty_audit hooks to monitor recent typing | |
352 | activity on the system, printing a scrolling record of recent | |
353 | keystrokes, on a per-tty basis. | |
354 | ||
355 | ||
210ff7bf | 356 | process/sleepingBeauties.stp - Generating Backtraces of Threads Waiting for IO Operations |
09a98ae0 | 357 | keywords: io scheduler backtrace |
210ff7bf | 358 | |
f3c4da44 | 359 | The script monitors the time that threads spend in waiting for IO |
cae71dd3 FCE |
360 | operations (in "D" state) in the wait_for_completion function. If a |
361 | thread spends over 10ms, its name and backtrace is printed, and later | |
362 | so is the total delay. | |
210ff7bf FCE |
363 | |
364 | ||
365 | = LOCKING = | |
366 | ||
cf5023fb WC |
367 | locks/bkl.stp - Tracing Contention on Big Kernel Lock (BKL) |
368 | keywords: locking | |
369 | ||
370 | The bkl.stp script can help determine whether the Big Kernel Lock | |
371 | (BKL) is causing serialization on a multiprocessor system due to | |
372 | excessive contention of the BKL. The bkl.stp script takes one | |
373 | argument which is the number of processes waiting for the Big Kernel | |
374 | Lock (BKL). When the number of processes waiting for the BKL is | |
375 | reached or exceeded, the script will print a time stamp, the number | |
376 | of processes waiting for the BKL, the holder of the BKL, and the | |
377 | amount of time the BKL was held. | |
378 | ||
379 | ||
380 | locks/bkl_stats.stp - Per Process Statistics on Big Kernel Lock (BKL) Use | |
381 | keywords: locking | |
382 | ||
383 | The bkl_stats.stp script can indicate which processes have excessive | |
384 | waits for the Big Kernel Lock (BKL) and which processes are taking | |
385 | the BKL for long periods of time. The bkl_stats.stp script prints | |
386 | lists of all the processes that require the BKL. Every five seconds | |
387 | two tables are printed out. The first table lists the processes that | |
388 | waited for the BKL followed by the number of times that the process | |
389 | waited, the minimum time of the wait, the average and the maximum | |
390 | time waited. The second table lists has similar information for the | |
f3c4da44 | 391 | time spent in holding the lock for each of the processes. |
cf5023fb WC |
392 | |
393 | ||
210ff7bf | 394 | process/futexes.stp - System-Wide Futex Contention |
09a98ae0 | 395 | keywords: syscall locking futex |
210ff7bf FCE |
396 | |
397 | The script watches the futex syscall on the system. On exit the | |
398 | futexes address, the number of contentions, and the average time for | |
399 | each contention on the futex are printed from lowest pid number to | |
400 | highest. | |
401 | ||
402 | ||
22f971e8 WC |
403 | = MEMORY = |
404 | ||
405 | memory/kmalloc-top - Show Paths to Kernel Malloc (kmalloc) Invocations | |
406 | keywords: memory | |
407 | ||
408 | The kmalloc-top perl program runs a small systemtap script to collect | |
409 | stack traces for each call to the kmalloc function and counts the | |
410 | time that each stack trace is observed. When kmalloc-top exits it | |
f3c4da44 MW |
411 | prints out sorted list. The output can be filtered to print only the |
412 | first N stack traces (-t), stack traces with a minimum counts (-m), | |
413 | or exclude certain stack traces (-e). | |
22f971e8 WC |
414 | |
415 | ||
0dc23d1d WC |
416 | memory/mmanonpage.stp - Track Virtual Memory System Actions on Anonymous Pages |
417 | keywords: memory | |
418 | ||
419 | The mmanonpage.stp script uses the virtual memory tracepoints | |
420 | available in some kernels to track the number of faults, user space | |
421 | frees, page ins, copy on writes and unmaps for anonymous pages. When | |
422 | the script is terminated the counts are printed for each process that | |
423 | allocated pages while the script was running. This script displays | |
424 | the anonymous page statistics for each process that ran while the | |
f3c4da44 | 425 | script is active. It's useful in debugging leaks in the anonymous |
0dc23d1d WC |
426 | regions of a process. |
427 | ||
428 | ||
429 | memory/mmfilepage.stp - Track Virtual Memory System Actions on File Backed Pages | |
430 | keywords: memory | |
431 | ||
432 | The mmfilepage.stp script uses the virtual memory tracepoints | |
433 | available in some kernels to track the number of faults, copy on | |
434 | writes mapping, and unmapping operations for file backed pages. When | |
435 | the script is terminated the counts are printed for each process that | |
436 | allocated pages while the script was running. The mmfilepage.stp | |
437 | script is useful in debugging leaks in the mapped file regions of a | |
438 | process. | |
439 | ||
440 | ||
441 | memory/mmreclaim.stp - Track Virtual Memory System Page Reclamation | |
442 | keywords: memory | |
443 | ||
444 | The mmreclaim.stp script uses the virtual memory tracepoints | |
ad7e33d7 | 445 | available in some kernels to track page reclaim activity that |
f3c4da44 | 446 | occurred while the script was running. It's useful in debugging |
ad7e33d7 | 447 | performance problems that occur due to page reclamation. |
0dc23d1d WC |
448 | |
449 | ||
450 | memory/mmwriteback.stp - Track Virtual Memory System Writing to Disk | |
451 | keywords: memory | |
452 | ||
453 | The mmwriteback.stp script uses the virtual memory tracepoints | |
454 | available in some kernels to report all of the file writebacks that | |
455 | occur form kupdate, pdflush and kjournald while the script is | |
f3c4da44 MW |
456 | running. It's useful in determining where writes are coming from on |
457 | a supposedly idle system that is experiencing unexpected IO. | |
0dc23d1d WC |
458 | |
459 | ||
c728b7da WC |
460 | memory/numa_faults.stp - Summarize Process Misses across NUMA Nodes |
461 | keywords: memory numa | |
462 | ||
463 | The numa_faults.stp script tracks the read and write pages faults for | |
464 | each process. When the script exits it prints out the total read and | |
ad7e33d7 | 465 | write pages faults for each process. The script also provide a break |
c728b7da WC |
466 | down of page faults per node for each process. This script is useful |
467 | for determining whether the program has good locality (page faults | |
468 | limited to a single node) on a NUMA computer. | |
469 | ||
470 | ||
1ff1a65d FCE |
471 | memory/overcommit.stp - Log failed process memory allocation due to overcommit limits |
472 | keywords: memory process | |
473 | ||
474 | The overcommit.stp script prints a line each time the kernel refuses | |
475 | a memory allocation request from a process because of | |
476 | /proc/sys/vm/overcommit* limits. | |
477 | ||
478 | ||
413996e0 WC |
479 | memory/pfaults.stp - Generate Log of Major and Minor Page Faults |
480 | keywords: memory | |
481 | ||
482 | The pfaults.stp script generates a simple log for each major and | |
483 | minor page fault that occurs on the system. Each line contains a | |
484 | timestamp (in microseconds) when the page fault servicing was | |
485 | completed, the pid of the process, the address of the page fault, the | |
486 | type of access (read or write), the type of fault (major or minor), | |
487 | and the elapsed time for page fault. This log can be examined to | |
ad7e33d7 | 488 | determine where the page faults are occurring. |
413996e0 WC |
489 | |
490 | ||
42c55668 MW |
491 | memory/vm.tracepoints.stp - Collect slab allocation statistics |
492 | keywords: memory slab allocator | |
493 | ||
494 | The script will probe all memory slab/slub allocations and collects | |
495 | information about the size of the object (bytes requested) and | |
496 | user-space process in execution. When run over a period of time, it | |
497 | helps to correlate kernel-space memory consumption owing to | |
498 | user-space processes. | |
499 | ||
500 | ||
905728a0 WC |
501 | network/sk_stream_wait_memory.stp - Track Start and Stop of Processes Due to Network Buffer Space |
502 | keywords: network tcp buffer memory | |
503 | ||
504 | The sk_stream-wait_memory.stp prints a time stamp, executable, and | |
505 | pid each time a process blocks due to the send buffer being full. A | |
506 | similar entry is printed each time a process continues because there | |
507 | is room in the buffer. | |
508 | ||
509 | ||
14f0bb18 | 510 | = MONITORING = |
b7f6cfc5 | 511 | |
14f0bb18 FCE |
512 | general/varwatch.stp - Watch a variable changing value in a thread. |
513 | keywords: monitoring | |
b7f6cfc5 | 514 | |
14f0bb18 FCE |
515 | This script places a set of probes (specified by $1), each of which |
516 | monitors the state of some context $variable expression (specified by | |
517 | $2). Whenever the value changes, with respect to the active thread, | |
518 | the event is traced. | |
b7f6cfc5 | 519 | |
1beb5089 FCE |
520 | |
521 | io/mbrwatch.stp - Monitor read/write of MBR (boot sector) area of block devices | |
522 | keywords: io monitoring | |
523 | ||
524 | The mbrwatch.stp script reports any attempted reads/writes of the | |
525 | first few sectors of a raw block device. | |
526 | ||
527 | ||
14f0bb18 FCE |
528 | io/ttyspy.stp - Monitor tty typing. |
529 | keywords: io tty per-process monitoring | |
530 | ||
531 | The ttyspy.stp script uses tty_audit hooks to monitor recent typing | |
532 | activity on the system, printing a scrolling record of recent | |
533 | keystrokes, on a per-tty basis. | |
534 | ||
535 | ||
210ff7bf FCE |
536 | = NETWORK = |
537 | ||
8b88e771 FCE |
538 | network/autofs4.stp - Watch autofs4 operations |
539 | keywords: network autofs nfs | |
540 | ||
541 | Trace key autofs4 operations such as mounting or unmounting remote | |
542 | filesystems. | |
543 | ||
544 | ||
0e4901b0 WC |
545 | network/dropwatch.stp - Watch Where Socket Buffers are Freed in the Kernel |
546 | keywords: network tracepoint buffer free | |
547 | ||
548 | Every five seconds the dropwatch.stp script lists the number of | |
549 | socket buffers freed at locations in the kernel. | |
550 | ||
551 | ||
53e5699f JS |
552 | network/netdev.stp - Trace Activity on Network Devices |
553 | keywords: network device traffic | |
554 | ||
555 | The netdev.stp script traces configuration and transmit/receive | |
556 | activity on network devices. | |
557 | ||
558 | ||
210ff7bf | 559 | network/nettop.stp - Periodic Listing of Processes Using Network Interfaces |
09a98ae0 | 560 | keywords: network traffic per-process |
210ff7bf FCE |
561 | |
562 | Every five seconds the nettop.stp script prints out a list of | |
563 | processed (PID and command) with the number of packets sent/received | |
564 | and the amount of data sent/received by the process during that | |
565 | interval. | |
566 | ||
567 | ||
905728a0 WC |
568 | network/sk_stream_wait_memory.stp - Track Start and Stop of Processes Due to Network Buffer Space |
569 | keywords: network tcp buffer memory | |
570 | ||
571 | The sk_stream-wait_memory.stp prints a time stamp, executable, and | |
572 | pid each time a process blocks due to the send buffer being full. A | |
573 | similar entry is printed each time a process continues because there | |
574 | is room in the buffer. | |
575 | ||
576 | ||
210ff7bf | 577 | network/socket-trace.stp - Trace Functions called in Network Socket Code |
09a98ae0 | 578 | keywords: network socket |
210ff7bf | 579 | |
f3c4da44 MW |
580 | The script instruments each of the functions in the Linux kernel's |
581 | net/socket.c file. The script prints out trace data. The first | |
582 | element of a line is time delta in microseconds from the previous | |
583 | entry. This is followed by the command name and the PID. The "->" and | |
584 | "<-" indicates function entry and function exit, respectively. The | |
585 | last element of the line is the function name. | |
210ff7bf FCE |
586 | |
587 | ||
492d227f WC |
588 | network/tcp_connections.stp - Track Creation of Incoming TCP Connections |
589 | keywords: network tcp socket | |
590 | ||
591 | The tcp_connections.stp script prints information for each new | |
592 | incoming TCP connection accepted by the computer. The information | |
593 | includes the UID, the command accepting the connection, the PID of | |
594 | the command, the port the connection is on, and the IP address of the | |
595 | originator of the request. | |
596 | ||
597 | ||
2e251678 DW |
598 | network/tcp_trace.stp - Tcp connection tracing utility. |
599 | keywords: network trace | |
600 | ||
601 | This scripts traces a given tcp connection based on the filter | |
602 | parameters given by the user. The indexing is done by the 4 tuples | |
603 | local address, remote address, local port, remote port. | |
604 | ||
605 | ||
7a51212c WC |
606 | network/tcpdumplike.stp - Dump of Received TCP Packets |
607 | keywords: network traffic | |
608 | ||
609 | The tcpdumplike.stp prints out a line for each TCP packet received. | |
610 | Each line includes the source and destination IP addresses, the | |
611 | source and destination ports, and flags. | |
612 | ||
613 | ||
4bb6522c WC |
614 | network/tcpipstat.stp - Display network statistics for individual TCP sockets. |
615 | keywords: network statistics | |
616 | ||
f3c4da44 | 617 | tcpipstat collects and displays network statistics related to |
4bb6522c | 618 | individual TCP sockets or groups of sockets. The statistics that are |
f3c4da44 | 619 | collected are simular to that of the command netstat -s, only sorted |
4bb6522c WC |
620 | and grouped by individual sockets. |
621 | ||
622 | ||
8b88e771 FCE |
623 | = NFS = |
624 | ||
625 | network/autofs4.stp - Watch autofs4 operations | |
626 | keywords: network autofs nfs | |
627 | ||
628 | Trace key autofs4 operations such as mounting or unmounting remote | |
629 | filesystems. | |
630 | ||
631 | ||
c728b7da WC |
632 | = NUMA = |
633 | ||
634 | memory/numa_faults.stp - Summarize Process Misses across NUMA Nodes | |
635 | keywords: memory numa | |
636 | ||
637 | The numa_faults.stp script tracks the read and write pages faults for | |
638 | each process. When the script exits it prints out the total read and | |
ad7e33d7 | 639 | write pages faults for each process. The script also provide a break |
c728b7da WC |
640 | down of page faults per node for each process. This script is useful |
641 | for determining whether the program has good locality (page faults | |
642 | limited to a single node) on a NUMA computer. | |
643 | ||
644 | ||
210ff7bf FCE |
645 | = PER-PROCESS = |
646 | ||
b7f6cfc5 | 647 | io/ttyspy.stp - Monitor tty typing. |
14f0bb18 | 648 | keywords: io tty per-process monitoring |
b7f6cfc5 FCE |
649 | |
650 | The ttyspy.stp script uses tty_audit hooks to monitor recent typing | |
651 | activity on the system, printing a scrolling record of recent | |
652 | keystrokes, on a per-tty basis. | |
653 | ||
654 | ||
210ff7bf | 655 | network/nettop.stp - Periodic Listing of Processes Using Network Interfaces |
09a98ae0 | 656 | keywords: network traffic per-process |
210ff7bf FCE |
657 | |
658 | Every five seconds the nettop.stp script prints out a list of | |
659 | processed (PID and command) with the number of packets sent/received | |
660 | and the amount of data sent/received by the process during that | |
661 | interval. | |
662 | ||
663 | ||
cc20d853 ET |
664 | = PROCESS = |
665 | ||
1ff1a65d FCE |
666 | memory/overcommit.stp - Log failed process memory allocation due to overcommit limits |
667 | keywords: memory process | |
668 | ||
669 | The overcommit.stp script prints a line each time the kernel refuses | |
670 | a memory allocation request from a process because of | |
671 | /proc/sys/vm/overcommit* limits. | |
672 | ||
673 | ||
cc20d853 ET |
674 | process/errsnoop.stp - tabulate system call errors |
675 | keywords: process syscall | |
676 | ||
677 | The script prints a periodic tabular report about failing system | |
678 | calls, by process and by syscall failure. The first optional | |
679 | argument specifies the reporting interval (in seconds, default 5); | |
680 | the second optional argument gives a screen height (number of lines | |
681 | in the report, default 20). | |
682 | ||
683 | ||
e6b653c8 WC |
684 | process/forktracker.stp - Trace Creation of Processes |
685 | keywords: process scheduler | |
686 | ||
687 | The forktracker.stp script prints out a time-stamped entry showing | |
f3c4da44 | 688 | each fork and exec operation on the machine. This can be useful to |
e6b653c8 WC |
689 | determine what process is creating a flurry of short-lived processes. |
690 | ||
691 | ||
ecf33ff4 ET |
692 | process/pfiles.stp - print process file descriptors |
693 | keywords: process files | |
694 | ||
695 | Run pfiles.stp to produce a human-readable summary of all open file | |
696 | descriptors of a given process. Specify the process-id as -x PID for | |
697 | fastest performance. | |
698 | ||
699 | ||
5b8642a2 FCE |
700 | process/plimit.stp - print resource limits |
701 | keywords: process | |
702 | ||
703 | The script prints a variety of resource limits for a given pid, like | |
704 | /proc/$$/limits on recent kernels. | |
705 | ||
706 | ||
34029cd3 WC |
707 | process/schedtimes.stp - Track Time Processes Spend in Various States using Tracepoints |
708 | keywords: process scheduler time tracepoint | |
709 | ||
710 | The schedtimes.stp script instruments the scheduler to track the | |
f3c4da44 MW |
711 | amount of time that each process spends in running, sleeping, |
712 | queuing, and waiting for io. On exit the script prints out the | |
713 | accumulated time for each state of processes observed. Optionally, | |
714 | this script can be used with the '-c' or '-x' options to focus on a | |
715 | specific PID. | |
34029cd3 WC |
716 | |
717 | ||
210ff7bf FCE |
718 | = PROFILING = |
719 | ||
a4f3198f WC |
720 | io/iodevstats.stp - List Executables Reading and Writing the Most Data by Device |
721 | keywords: io profiling | |
722 | ||
723 | The iodevstats.stp script measures the amount of data successfully | |
724 | read and written by all the executables for each io device on the | |
725 | system. The output is sorted from greatest sum of bytes read and | |
726 | written to a device by an executable to the least. The output | |
727 | contains device major/minor number, the count of operations (reads | |
728 | and writes), the totals and averages for the number of bytes read and | |
729 | written. | |
730 | ||
731 | ||
54ff5e0c FCE |
732 | io/iostat-scsi.stp - iostat for SCSI Devices |
733 | keywords: io profiling scsi | |
734 | ||
735 | The iostat-scsi.stp script provides a breakdown of the number of blks | |
ad7e33d7 | 736 | read and written on the machine's various SCSI devices. The script |
54ff5e0c FCE |
737 | takes one argument which is the number of seconds between reports. |
738 | ||
739 | ||
3e4444ed WC |
740 | io/iostats.stp - List Executables Reading and Writing the Most Data |
741 | keywords: io profiling | |
742 | ||
743 | The iostat.stp script measures the amount of data successfully read | |
744 | and written by all the executables on the system. The output is | |
745 | sorted from most greatest sum of bytes read and written by an | |
746 | executable to the least. The output contains the count of operations | |
747 | (opens, reads, and writes), the totals and averages for the number of | |
748 | bytes read and written. | |
749 | ||
750 | ||
111dd9ac WC |
751 | io/nfs_func_users.stp - Tally the Number of NFS Functions Used by Each Process |
752 | keywords: io profiling | |
753 | ||
754 | The nfs_func_users.stp script counts the uses of NFS functions in the | |
755 | kernel on a per process bases. The output is sorted from the process | |
756 | with the greatest number of NFS functions called to the least. The | |
757 | output contains the executable name, the process number, and the | |
758 | total number of NFS functions called by the process. | |
759 | ||
760 | ||
210ff7bf | 761 | process/pf2.stp - Profile kernel functions |
09a98ae0 | 762 | keywords: profiling |
210ff7bf FCE |
763 | |
764 | The pf2.stp script sets up time-based sampling. Every five seconds it | |
765 | prints out a sorted list with the top ten kernel functions with | |
766 | samples. | |
767 | ||
768 | ||
f503d3c0 FCE |
769 | profiling/fntimes.stp - Show functions taking longer than usual |
770 | keywords: profiling | |
771 | ||
772 | The fntimes.stp script monitors the execution time history of a given | |
773 | function family (assumed non-recursive). Each time (beyond a warmup | |
774 | interval) is then compared to the historical maximum. If it exceeds | |
775 | a certain threshold (250%), a message is printed. | |
776 | ||
777 | ||
210ff7bf | 778 | profiling/functioncallcount.stp - Count Times Functions Called |
09a98ae0 | 779 | keywords: profiling functions |
210ff7bf FCE |
780 | |
781 | The functioncallcount.stp script takes one argument, a list of | |
782 | functions to probe. The script will run and count the number of times | |
783 | that each of the functions on the list is called. On exit the script | |
784 | will print a sorted list from most frequently to least frequently | |
785 | called function. | |
786 | ||
787 | ||
0449af03 JS |
788 | profiling/sched_switch.stp - Display the task switches happening in the scheduler |
789 | keywords: profiling functions | |
790 | ||
791 | The sched_switch.stp script takes two arguments, first argument can | |
792 | be "pid" or "name" to indicate what is being passed as second | |
793 | argument. The script will trace the process based on pid/name and | |
794 | print the scheduler switches happening with the process. If no | |
795 | arguments are passed, it displays all the scheduler switches. This | |
796 | can be used to understand which tasks schedule out the current | |
797 | process being traced, and when it gets scheduled in again. | |
798 | ||
799 | ||
210ff7bf | 800 | profiling/thread-times.stp - Profile kernel functions |
09a98ae0 | 801 | keywords: profiling |
210ff7bf FCE |
802 | |
803 | The thread-times.stp script sets up time-based sampling. Every five | |
804 | seconds it prints out a sorted list with the top twenty processes | |
805 | with samples broken down into percentage total time spent in | |
806 | user-space and kernel-space. | |
807 | ||
808 | ||
ff90b297 WC |
809 | profiling/timeout.stp - Show Processes Doing Polling Operations |
810 | keywords: profiling | |
811 | ||
812 | The timeout.stp script is based on a blog entry | |
813 | (http://udrepper.livejournal.com/19041.html) mentioning a need for a | |
814 | tool to help developers find applications that are polling. The | |
815 | timeout.stp script monitors systemcall used for polling and records | |
816 | the systemcalls that timed out rather than returned because some | |
817 | action occurred. The script updates the screen once a second with the | |
818 | top twenty processes. | |
819 | ||
820 | ||
1bf72dfe WC |
821 | profiling/topsys.stp - Show Processes Doing Polling Operations |
822 | keywords: profiling | |
823 | ||
824 | The topsys.stp script lists out the top twenty systemcalls for the | |
825 | previous 5 seconds. The output is sorted from most frequent to least | |
826 | frequent. | |
827 | ||
828 | ||
210ff7bf FCE |
829 | = READ = |
830 | ||
831 | io/iotime.stp - Trace Time Spent in Read and Write for Files | |
09a98ae0 | 832 | keywords: syscall read write time io |
210ff7bf FCE |
833 | |
834 | The script watches each open, close, read, and write syscalls on the | |
835 | system. For each file the scripts observes opened it accumulates the | |
f3c4da44 | 836 | amount of wall clock time spent in read and write operations and the |
210ff7bf FCE |
837 | number of bytes read and written. When a file is closed the script |
838 | prints out a pair of lines for the file. Both lines begin with a | |
839 | timestamp in microseconds, the PID number, and the executable name in | |
ad7e33d7 | 840 | parentheses. The first line with the "access" keyword lists the file |
210ff7bf FCE |
841 | name, the attempted number of bytes for the read and write |
842 | operations. The second line with the "iotime" keyword list the file | |
843 | name and the number of microseconds accumulated in the read and write | |
844 | syscalls. | |
845 | ||
846 | ||
847 | = SCHEDULER = | |
848 | ||
deb63545 WC |
849 | process/chng_cpu.stp - Monitor Changes in Processor Executing a Task |
850 | keywords: scheduler | |
851 | ||
852 | The chng_cpu.stp script takes an argument which is the executable | |
853 | name of the task it should monitor. Each time a task with that | |
854 | executable name is found running on a different processor, the script | |
855 | prints out the thread id (tid), the executable name, the processor | |
856 | now running the task, the thread state, and a backtrace showing the | |
857 | kernel functions that triggered the running of the task on the | |
858 | processor. | |
859 | ||
860 | ||
e6b653c8 WC |
861 | process/forktracker.stp - Trace Creation of Processes |
862 | keywords: process scheduler | |
863 | ||
864 | The forktracker.stp script prints out a time-stamped entry showing | |
f3c4da44 | 865 | each fork and exec operation on the machine. This can be useful to |
e6b653c8 WC |
866 | determine what process is creating a flurry of short-lived processes. |
867 | ||
868 | ||
deb63545 WC |
869 | process/migrate.stp - Track the Migration of Specific Executables |
870 | keywords: scheduler | |
871 | ||
872 | The migrate.stp script takes an argument which is the executable name | |
873 | of the task it should monitor. Each time a task with that executable | |
874 | name migrates between processors an entry is printed with the process | |
875 | id (pid), the executable name, the processor off loading the task, | |
876 | and the process taking the task. Note that the task may or may not be | |
877 | executing at the time of the migration. | |
878 | ||
879 | ||
34029cd3 WC |
880 | process/schedtimes.stp - Track Time Processes Spend in Various States using Tracepoints |
881 | keywords: process scheduler time tracepoint | |
882 | ||
883 | The schedtimes.stp script instruments the scheduler to track the | |
f3c4da44 MW |
884 | amount of time that each process spends in running, sleeping, |
885 | queuing, and waiting for io. On exit the script prints out the | |
886 | accumulated time for each state of processes observed. Optionally, | |
887 | this script can be used with the '-c' or '-x' options to focus on a | |
888 | specific PID. | |
34029cd3 WC |
889 | |
890 | ||
210ff7bf | 891 | process/sleepingBeauties.stp - Generating Backtraces of Threads Waiting for IO Operations |
09a98ae0 | 892 | keywords: io scheduler backtrace |
cae71dd3 | 893 | |
f3c4da44 | 894 | The script monitors the time that threads spend in waiting for IO |
cae71dd3 FCE |
895 | operations (in "D" state) in the wait_for_completion function. If a |
896 | thread spends over 10ms, its name and backtrace is printed, and later | |
897 | so is the total delay. | |
210ff7bf FCE |
898 | |
899 | ||
54ff5e0c FCE |
900 | = SCSI = |
901 | ||
902 | io/iostat-scsi.stp - iostat for SCSI Devices | |
903 | keywords: io profiling scsi | |
904 | ||
905 | The iostat-scsi.stp script provides a breakdown of the number of blks | |
ad7e33d7 | 906 | read and written on the machine's various SCSI devices. The script |
54ff5e0c FCE |
907 | takes one argument which is the number of seconds between reports. |
908 | ||
909 | ||
210ff7bf FCE |
910 | = SIGNALS = |
911 | ||
912 | process/sig_by_pid.stp - Signal Counts by Process ID | |
09a98ae0 | 913 | keywords: signals |
210ff7bf FCE |
914 | |
915 | Print signal counts by process ID in descending order. | |
916 | ||
917 | ||
918 | process/sig_by_proc.stp - Signal Counts by Process Name | |
09a98ae0 | 919 | keywords: signals |
210ff7bf FCE |
920 | |
921 | Print signal counts by process name in descending order. | |
922 | ||
923 | ||
924 | process/sigkill.stp - Track SIGKILL Signals | |
09a98ae0 | 925 | keywords: signals |
210ff7bf FCE |
926 | |
927 | The script traces any SIGKILL signals. When that SIGKILL signal is | |
928 | sent to a process, the script prints out the signal name, the | |
f3c4da44 MW |
929 | destination executable and process ID, the executable name and user |
930 | ID that sents the signal. | |
210ff7bf FCE |
931 | |
932 | ||
3a748561 | 933 | process/sigmon.stp - Track a particular signal to a specific process |
09a98ae0 | 934 | keywords: signals |
210ff7bf FCE |
935 | |
936 | The script watches for a particular signal sent to a specific | |
937 | process. When that signal is sent to the specified process, the | |
938 | script prints out the PID and executable of the process sending the | |
939 | signal, the PID and executable name of the process receiving the | |
940 | signal, and the signal number and name. | |
941 | ||
942 | ||
943 | = SIMPLE = | |
944 | ||
945 | general/helloworld.stp - SystemTap "Hello World" Program | |
09a98ae0 | 946 | keywords: simple |
210ff7bf FCE |
947 | |
948 | A basic "Hello World" program implemented in SystemTap script. It | |
949 | prints out "hello world" message and then immediately exits. | |
950 | ||
951 | ||
42c55668 MW |
952 | = SLAB = |
953 | ||
954 | memory/vm.tracepoints.stp - Collect slab allocation statistics | |
955 | keywords: memory slab allocator | |
956 | ||
957 | The script will probe all memory slab/slub allocations and collects | |
958 | information about the size of the object (bytes requested) and | |
959 | user-space process in execution. When run over a period of time, it | |
960 | helps to correlate kernel-space memory consumption owing to | |
961 | user-space processes. | |
962 | ||
963 | ||
210ff7bf FCE |
964 | = SLEEP = |
965 | ||
966 | process/sleeptime.stp - Trace Time Spent in nanosleep Syscalls | |
09a98ae0 | 967 | keywords: syscall sleep |
210ff7bf FCE |
968 | |
969 | The script watches each nanosleep syscall on the system. At the end | |
970 | of each nanosleep syscall the script prints out a line with a | |
971 | timestamp in microseconds, the pid, the executable name in | |
ad7e33d7 | 972 | parentheses, the "nanosleep:" key, and the duration of the sleep in |
210ff7bf FCE |
973 | microseconds. |
974 | ||
975 | ||
976 | = SOCKET = | |
977 | ||
978 | network/socket-trace.stp - Trace Functions called in Network Socket Code | |
09a98ae0 | 979 | keywords: network socket |
210ff7bf | 980 | |
f3c4da44 MW |
981 | The script instruments each of the functions in the Linux kernel's |
982 | net/socket.c file. The script prints out trace data. The first | |
983 | element of a line is time delta in microseconds from the previous | |
984 | entry. This is followed by the command name and the PID. The "->" and | |
985 | "<-" indicates function entry and function exit, respectively. The | |
986 | last element of the line is the function name. | |
210ff7bf FCE |
987 | |
988 | ||
492d227f WC |
989 | network/tcp_connections.stp - Track Creation of Incoming TCP Connections |
990 | keywords: network tcp socket | |
991 | ||
992 | The tcp_connections.stp script prints information for each new | |
993 | incoming TCP connection accepted by the computer. The information | |
994 | includes the UID, the command accepting the connection, the PID of | |
995 | the command, the port the connection is on, and the IP address of the | |
996 | originator of the request. | |
997 | ||
998 | ||
4bb6522c WC |
999 | = STATISTICS = |
1000 | ||
1001 | network/tcpipstat.stp - Display network statistics for individual TCP sockets. | |
1002 | keywords: network statistics | |
1003 | ||
f3c4da44 | 1004 | tcpipstat collects and displays network statistics related to |
4bb6522c | 1005 | individual TCP sockets or groups of sockets. The statistics that are |
f3c4da44 | 1006 | collected are simular to that of the command netstat -s, only sorted |
4bb6522c WC |
1007 | and grouped by individual sockets. |
1008 | ||
1009 | ||
210ff7bf FCE |
1010 | = SYSCALL = |
1011 | ||
1012 | io/iotime.stp - Trace Time Spent in Read and Write for Files | |
09a98ae0 | 1013 | keywords: syscall read write time io |
210ff7bf FCE |
1014 | |
1015 | The script watches each open, close, read, and write syscalls on the | |
1016 | system. For each file the scripts observes opened it accumulates the | |
f3c4da44 | 1017 | amount of wall clock time spent in read and write operations and the |
210ff7bf FCE |
1018 | number of bytes read and written. When a file is closed the script |
1019 | prints out a pair of lines for the file. Both lines begin with a | |
1020 | timestamp in microseconds, the PID number, and the executable name in | |
ad7e33d7 | 1021 | parentheses. The first line with the "access" keyword lists the file |
210ff7bf FCE |
1022 | name, the attempted number of bytes for the read and write |
1023 | operations. The second line with the "iotime" keyword list the file | |
1024 | name and the number of microseconds accumulated in the read and write | |
1025 | syscalls. | |
1026 | ||
1027 | ||
cc20d853 ET |
1028 | process/errsnoop.stp - tabulate system call errors |
1029 | keywords: process syscall | |
1030 | ||
1031 | The script prints a periodic tabular report about failing system | |
1032 | calls, by process and by syscall failure. The first optional | |
1033 | argument specifies the reporting interval (in seconds, default 5); | |
1034 | the second optional argument gives a screen height (number of lines | |
1035 | in the report, default 20). | |
1036 | ||
1037 | ||
210ff7bf | 1038 | process/futexes.stp - System-Wide Futex Contention |
09a98ae0 | 1039 | keywords: syscall locking futex |
210ff7bf FCE |
1040 | |
1041 | The script watches the futex syscall on the system. On exit the | |
1042 | futexes address, the number of contentions, and the average time for | |
1043 | each contention on the futex are printed from lowest pid number to | |
1044 | highest. | |
1045 | ||
1046 | ||
1047 | process/sleeptime.stp - Trace Time Spent in nanosleep Syscalls | |
09a98ae0 | 1048 | keywords: syscall sleep |
210ff7bf FCE |
1049 | |
1050 | The script watches each nanosleep syscall on the system. At the end | |
1051 | of each nanosleep syscall the script prints out a line with a | |
1052 | timestamp in microseconds, the pid, the executable name in | |
ad7e33d7 | 1053 | parentheses, the "nanosleep:" key, and the duration of the sleep in |
210ff7bf FCE |
1054 | microseconds. |
1055 | ||
1056 | ||
1057 | process/syscalls_by_pid.stp - System-Wide Count of Syscalls by PID | |
09a98ae0 | 1058 | keywords: syscall |
210ff7bf FCE |
1059 | |
1060 | The script watches all syscall on the system. On exit the script | |
1061 | prints a list showing the number of systemcalls executed by each PID | |
1062 | ordered from greatest to least number of syscalls. | |
1063 | ||
1064 | ||
1065 | process/syscalls_by_proc.stp - System-Wide Count of Syscalls by Executable | |
09a98ae0 | 1066 | keywords: syscall |
210ff7bf FCE |
1067 | |
1068 | The script watches all syscall on the system. On exit the script | |
1069 | prints a list showing the number of systemcalls executed by each | |
ad7e33d7 | 1070 | executable ordered from greatest to least number of syscalls. |
210ff7bf FCE |
1071 | |
1072 | ||
1073 | process/wait4time.stp - Trace Time Spent in wait4 Syscalls | |
09a98ae0 | 1074 | keywords: syscall wait4 |
210ff7bf FCE |
1075 | |
1076 | The script watches each wait4 syscall on the system. At the end of | |
1077 | each wait4 syscall the script prints out a line with a timestamp in | |
ad7e33d7 | 1078 | microseconds, the pid, the executable name in parentheses, the |
210ff7bf FCE |
1079 | "wait4:" key, the duration of the wait and the PID that the wait4 was |
1080 | waiting for. If the waited for PID is not specified , it is "-1". | |
1081 | ||
1082 | ||
492d227f WC |
1083 | = TCP = |
1084 | ||
905728a0 WC |
1085 | network/sk_stream_wait_memory.stp - Track Start and Stop of Processes Due to Network Buffer Space |
1086 | keywords: network tcp buffer memory | |
1087 | ||
1088 | The sk_stream-wait_memory.stp prints a time stamp, executable, and | |
1089 | pid each time a process blocks due to the send buffer being full. A | |
1090 | similar entry is printed each time a process continues because there | |
1091 | is room in the buffer. | |
1092 | ||
1093 | ||
492d227f WC |
1094 | network/tcp_connections.stp - Track Creation of Incoming TCP Connections |
1095 | keywords: network tcp socket | |
1096 | ||
1097 | The tcp_connections.stp script prints information for each new | |
1098 | incoming TCP connection accepted by the computer. The information | |
1099 | includes the UID, the command accepting the connection, the PID of | |
1100 | the command, the port the connection is on, and the IP address of the | |
1101 | originator of the request. | |
1102 | ||
1103 | ||
210ff7bf FCE |
1104 | = TIME = |
1105 | ||
1106 | io/iotime.stp - Trace Time Spent in Read and Write for Files | |
09a98ae0 | 1107 | keywords: syscall read write time io |
210ff7bf FCE |
1108 | |
1109 | The script watches each open, close, read, and write syscalls on the | |
1110 | system. For each file the scripts observes opened it accumulates the | |
f3c4da44 | 1111 | amount of wall clock time spent in read and write operations and the |
210ff7bf FCE |
1112 | number of bytes read and written. When a file is closed the script |
1113 | prints out a pair of lines for the file. Both lines begin with a | |
1114 | timestamp in microseconds, the PID number, and the executable name in | |
ad7e33d7 | 1115 | parentheses. The first line with the "access" keyword lists the file |
210ff7bf FCE |
1116 | name, the attempted number of bytes for the read and write |
1117 | operations. The second line with the "iotime" keyword list the file | |
1118 | name and the number of microseconds accumulated in the read and write | |
1119 | syscalls. | |
1120 | ||
1121 | ||
34029cd3 WC |
1122 | process/schedtimes.stp - Track Time Processes Spend in Various States using Tracepoints |
1123 | keywords: process scheduler time tracepoint | |
1124 | ||
1125 | The schedtimes.stp script instruments the scheduler to track the | |
f3c4da44 MW |
1126 | amount of time that each process spends in running, sleeping, |
1127 | queuing, and waiting for io. On exit the script prints out the | |
1128 | accumulated time for each state of processes observed. Optionally, | |
1129 | this script can be used with the '-c' or '-x' options to focus on a | |
1130 | specific PID. | |
34029cd3 WC |
1131 | |
1132 | ||
210ff7bf FCE |
1133 | = TRACE = |
1134 | ||
aa15b9f0 | 1135 | general/para-callgraph.stp - Callgraph tracing with arguments |
09a98ae0 | 1136 | keywords: trace callgraph |
210ff7bf | 1137 | |
aa15b9f0 FCE |
1138 | Print a timed per-thread callgraph, complete with function parameters |
1139 | and return values. The first parameter names the function probe | |
1140 | points to trace. The optional second parameter names the probe | |
1141 | points for trigger functions, which acts to enable tracing for only | |
1142 | those functions that occur while the current thread is nested within | |
1143 | the trigger. | |
210ff7bf FCE |
1144 | |
1145 | ||
2e251678 DW |
1146 | network/tcp_trace.stp - Tcp connection tracing utility. |
1147 | keywords: network trace | |
1148 | ||
1149 | This scripts traces a given tcp connection based on the filter | |
1150 | parameters given by the user. The indexing is done by the 4 tuples | |
1151 | local address, remote address, local port, remote port. | |
1152 | ||
1153 | ||
0e4901b0 WC |
1154 | = TRACEPOINT = |
1155 | ||
1156 | network/dropwatch.stp - Watch Where Socket Buffers are Freed in the Kernel | |
1157 | keywords: network tracepoint buffer free | |
1158 | ||
1159 | Every five seconds the dropwatch.stp script lists the number of | |
1160 | socket buffers freed at locations in the kernel. | |
1161 | ||
1162 | ||
34029cd3 WC |
1163 | process/schedtimes.stp - Track Time Processes Spend in Various States using Tracepoints |
1164 | keywords: process scheduler time tracepoint | |
1165 | ||
1166 | The schedtimes.stp script instruments the scheduler to track the | |
f3c4da44 MW |
1167 | amount of time that each process spends in running, sleeping, |
1168 | queuing, and waiting for io. On exit the script prints out the | |
1169 | accumulated time for each state of processes observed. Optionally, | |
1170 | this script can be used with the '-c' or '-x' options to focus on a | |
1171 | specific PID. | |
34029cd3 WC |
1172 | |
1173 | ||
210ff7bf FCE |
1174 | = TRAFFIC = |
1175 | ||
53e5699f JS |
1176 | network/netdev.stp - Trace Activity on Network Devices |
1177 | keywords: network device traffic | |
1178 | ||
1179 | The netdev.stp script traces configuration and transmit/receive | |
1180 | activity on network devices. | |
1181 | ||
1182 | ||
210ff7bf | 1183 | network/nettop.stp - Periodic Listing of Processes Using Network Interfaces |
09a98ae0 | 1184 | keywords: network traffic per-process |
210ff7bf FCE |
1185 | |
1186 | Every five seconds the nettop.stp script prints out a list of | |
1187 | processed (PID and command) with the number of packets sent/received | |
1188 | and the amount of data sent/received by the process during that | |
1189 | interval. | |
1190 | ||
1191 | ||
7a51212c WC |
1192 | network/tcpdumplike.stp - Dump of Received TCP Packets |
1193 | keywords: network traffic | |
1194 | ||
1195 | The tcpdumplike.stp prints out a line for each TCP packet received. | |
1196 | Each line includes the source and destination IP addresses, the | |
1197 | source and destination ports, and flags. | |
1198 | ||
1199 | ||
b7f6cfc5 FCE |
1200 | = TTY = |
1201 | ||
1202 | io/ttyspy.stp - Monitor tty typing. | |
14f0bb18 | 1203 | keywords: io tty per-process monitoring |
b7f6cfc5 FCE |
1204 | |
1205 | The ttyspy.stp script uses tty_audit hooks to monitor recent typing | |
1206 | activity on the system, printing a scrolling record of recent | |
1207 | keystrokes, on a per-tty basis. | |
1208 | ||
1209 | ||
210ff7bf FCE |
1210 | = USE = |
1211 | ||
1212 | general/graphs.stp - Graphing Disk and CPU Utilization | |
09a98ae0 | 1213 | keywords: disk cpu use graph |
210ff7bf FCE |
1214 | |
1215 | The script tracks the disk and CPU utilization. The resulting output | |
1216 | of the script can be piped into gnuplot to generate a graph of disk | |
1217 | and CPU USE. | |
1218 | ||
1219 | ||
1220 | = WAIT4 = | |
1221 | ||
1222 | process/wait4time.stp - Trace Time Spent in wait4 Syscalls | |
09a98ae0 | 1223 | keywords: syscall wait4 |
210ff7bf FCE |
1224 | |
1225 | The script watches each wait4 syscall on the system. At the end of | |
1226 | each wait4 syscall the script prints out a line with a timestamp in | |
ad7e33d7 | 1227 | microseconds, the pid, the executable name in parentheses, the |
210ff7bf FCE |
1228 | "wait4:" key, the duration of the wait and the PID that the wait4 was |
1229 | waiting for. If the waited for PID is not specified , it is "-1". | |
1230 | ||
1231 | ||
1232 | = WRITE = | |
1233 | ||
1234 | io/iotime.stp - Trace Time Spent in Read and Write for Files | |
09a98ae0 | 1235 | keywords: syscall read write time io |
210ff7bf FCE |
1236 | |
1237 | The script watches each open, close, read, and write syscalls on the | |
1238 | system. For each file the scripts observes opened it accumulates the | |
f3c4da44 | 1239 | amount of wall clock time spent in read and write operations and the |
210ff7bf FCE |
1240 | number of bytes read and written. When a file is closed the script |
1241 | prints out a pair of lines for the file. Both lines begin with a | |
1242 | timestamp in microseconds, the PID number, and the executable name in | |
ad7e33d7 | 1243 | parentheses. The first line with the "access" keyword lists the file |
210ff7bf FCE |
1244 | name, the attempted number of bytes for the read and write |
1245 | operations. The second line with the "iotime" keyword list the file | |
1246 | name and the number of microseconds accumulated in the read and write | |
1247 | syscalls. | |
1248 | ||
1249 |