]>
Commit | Line | Data |
---|---|---|
210ff7bf | 1 | SYSTEMTAP EXAMPLES INDEX BY KEYWORD |
09a98ae0 | 2 | (see also index.txt) |
210ff7bf | 3 | |
8b88e771 FCE |
4 | = AUTOFS = |
5 | ||
6 | network/autofs4.stp - Watch autofs4 operations | |
7 | keywords: network autofs nfs | |
8 | ||
9 | Trace key autofs4 operations such as mounting or unmounting remote | |
10 | filesystems. | |
11 | ||
12 | ||
210ff7bf FCE |
13 | = BACKTRACE = |
14 | ||
1cc8a4c7 WC |
15 | interrupt/scf.stp - Tally Backtraces for Inter-Processor Interrupt (IPI) |
16 | keywords: interrupt backtrace | |
17 | ||
18 | The Linux kernel function smp_call_function causes expensive | |
19 | inter-processor interrupts (IPIs). The scf.stp script tallies the | |
20 | processes and backtraces causing the interprocessor interrupts to | |
21 | identify the cause of the expensive IPI. On exit the script prints | |
22 | the tallies in descending frequency. | |
23 | ||
24 | ||
210ff7bf | 25 | io/io_submit.stp - Tally Reschedule Reason During AIO io_submit Call |
09a98ae0 | 26 | keywords: io backtrace |
210ff7bf FCE |
27 | |
28 | When a reschedule occurs during an AIO io_submit call, accumulate the | |
29 | traceback in a histogram. When the script exits prints out a sorted | |
30 | list from most common to least common backtrace. | |
31 | ||
32 | ||
cae71dd3 | 33 | process/sleepingBeauties.stp - Generating Backtraces of Threads Waiting for IO Operations |
09a98ae0 | 34 | keywords: io scheduler backtrace |
cae71dd3 FCE |
35 | |
36 | The script monitors the time that threads spend waiting for IO | |
37 | operations (in "D" state) in the wait_for_completion function. If a | |
38 | thread spends over 10ms, its name and backtrace is printed, and later | |
39 | so is the total delay. | |
40 | ||
41 | ||
0e4901b0 WC |
42 | = BUFFER = |
43 | ||
44 | network/dropwatch.stp - Watch Where Socket Buffers are Freed in the Kernel | |
45 | keywords: network tracepoint buffer free | |
46 | ||
47 | Every five seconds the dropwatch.stp script lists the number of | |
48 | socket buffers freed at locations in the kernel. | |
49 | ||
50 | ||
905728a0 WC |
51 | network/sk_stream_wait_memory.stp - Track Start and Stop of Processes Due to Network Buffer Space |
52 | keywords: network tcp buffer memory | |
53 | ||
54 | The sk_stream-wait_memory.stp prints a time stamp, executable, and | |
55 | pid each time a process blocks due to the send buffer being full. A | |
56 | similar entry is printed each time a process continues because there | |
57 | is room in the buffer. | |
58 | ||
59 | ||
210ff7bf FCE |
60 | = CALLGRAPH = |
61 | ||
aa15b9f0 | 62 | general/para-callgraph.stp - Callgraph tracing with arguments |
09a98ae0 | 63 | keywords: trace callgraph |
210ff7bf | 64 | |
aa15b9f0 FCE |
65 | Print a timed per-thread callgraph, complete with function parameters |
66 | and return values. The first parameter names the function probe | |
67 | points to trace. The optional second parameter names the probe | |
68 | points for trigger functions, which acts to enable tracing for only | |
69 | those functions that occur while the current thread is nested within | |
70 | the trigger. | |
210ff7bf FCE |
71 | |
72 | ||
73 | = CPU = | |
74 | ||
75 | general/graphs.stp - Graphing Disk and CPU Utilization | |
09a98ae0 | 76 | keywords: disk cpu use graph |
210ff7bf FCE |
77 | |
78 | The script tracks the disk and CPU utilization. The resulting output | |
79 | of the script can be piped into gnuplot to generate a graph of disk | |
80 | and CPU USE. | |
81 | ||
82 | ||
53e5699f JS |
83 | = DEVICE = |
84 | ||
85 | network/netdev.stp - Trace Activity on Network Devices | |
86 | keywords: network device traffic | |
87 | ||
88 | The netdev.stp script traces configuration and transmit/receive | |
89 | activity on network devices. | |
90 | ||
91 | ||
210ff7bf FCE |
92 | = DISK = |
93 | ||
94 | general/graphs.stp - Graphing Disk and CPU Utilization | |
09a98ae0 | 95 | keywords: disk cpu use graph |
210ff7bf FCE |
96 | |
97 | The script tracks the disk and CPU utilization. The resulting output | |
98 | of the script can be piped into gnuplot to generate a graph of disk | |
99 | and CPU USE. | |
100 | ||
101 | ||
102 | io/disktop.stp - Summarize Disk Read/Write Traffic | |
09a98ae0 | 103 | keywords: disk |
210ff7bf FCE |
104 | |
105 | Get the status of reading/writing disk every 5 seconds, output top | |
106 | ten entries during that period. | |
107 | ||
108 | ||
ac505f97 JS |
109 | = FILESYSTEM = |
110 | ||
111 | general/badname.stp - Bad Filename Filter | |
112 | keywords: filesystem hack | |
113 | ||
114 | The badname.stp script shows how one could prevent the creation of | |
6287a9e6 | 115 | files with undesirable names using guru mode. |
ac505f97 JS |
116 | |
117 | ||
0e0b566a WC |
118 | = FORMAT = |
119 | ||
120 | general/ansi_colors.stp - Color Table for ansi_set_color2() and ansi_set_color3() | |
121 | keywords: format | |
122 | ||
123 | The script prints a table showing the available color combinations | |
124 | for the ansi_set_color2() and ans_set_color3() functions in the | |
125 | ansi.stp tapset. | |
126 | ||
127 | ||
128 | general/ansi_colors2.stp - Show Attribues in Table for ansi_set_color3() | |
129 | keywords: format | |
130 | ||
131 | The script prints a table showing the available attributes (bold, | |
132 | underline, and inverse) with color combinations for the | |
133 | ans_set_color3() function in the ansi.stp tapset. | |
134 | ||
135 | ||
0e4901b0 WC |
136 | = FREE = |
137 | ||
138 | network/dropwatch.stp - Watch Where Socket Buffers are Freed in the Kernel | |
139 | keywords: network tracepoint buffer free | |
140 | ||
141 | Every five seconds the dropwatch.stp script lists the number of | |
142 | socket buffers freed at locations in the kernel. | |
143 | ||
144 | ||
210ff7bf FCE |
145 | = FUNCTIONS = |
146 | ||
147 | profiling/functioncallcount.stp - Count Times Functions Called | |
09a98ae0 | 148 | keywords: profiling functions |
210ff7bf FCE |
149 | |
150 | The functioncallcount.stp script takes one argument, a list of | |
151 | functions to probe. The script will run and count the number of times | |
152 | that each of the functions on the list is called. On exit the script | |
153 | will print a sorted list from most frequently to least frequently | |
154 | called function. | |
155 | ||
156 | ||
157 | = FUTEX = | |
158 | ||
159 | process/futexes.stp - System-Wide Futex Contention | |
09a98ae0 | 160 | keywords: syscall locking futex |
210ff7bf FCE |
161 | |
162 | The script watches the futex syscall on the system. On exit the | |
163 | futexes address, the number of contentions, and the average time for | |
164 | each contention on the futex are printed from lowest pid number to | |
165 | highest. | |
166 | ||
167 | ||
168 | = GRAPH = | |
169 | ||
170 | general/graphs.stp - Graphing Disk and CPU Utilization | |
09a98ae0 | 171 | keywords: disk cpu use graph |
210ff7bf FCE |
172 | |
173 | The script tracks the disk and CPU utilization. The resulting output | |
174 | of the script can be piped into gnuplot to generate a graph of disk | |
175 | and CPU USE. | |
176 | ||
177 | ||
ac505f97 JS |
178 | = HACK = |
179 | ||
180 | general/badname.stp - Bad Filename Filter | |
181 | keywords: filesystem hack | |
182 | ||
183 | The badname.stp script shows how one could prevent the creation of | |
6287a9e6 | 184 | files with undesirable names using guru mode. |
ac505f97 JS |
185 | |
186 | ||
1cc8a4c7 WC |
187 | = INTERRUPT = |
188 | ||
189 | interrupt/scf.stp - Tally Backtraces for Inter-Processor Interrupt (IPI) | |
190 | keywords: interrupt backtrace | |
191 | ||
192 | The Linux kernel function smp_call_function causes expensive | |
193 | inter-processor interrupts (IPIs). The scf.stp script tallies the | |
194 | processes and backtraces causing the interprocessor interrupts to | |
195 | identify the cause of the expensive IPI. On exit the script prints | |
196 | the tallies in descending frequency. | |
197 | ||
198 | ||
210ff7bf FCE |
199 | = IO = |
200 | ||
201 | io/io_submit.stp - Tally Reschedule Reason During AIO io_submit Call | |
09a98ae0 | 202 | keywords: io backtrace |
210ff7bf FCE |
203 | |
204 | When a reschedule occurs during an AIO io_submit call, accumulate the | |
205 | traceback in a histogram. When the script exits prints out a sorted | |
206 | list from most common to least common backtrace. | |
207 | ||
208 | ||
67f8611b WC |
209 | io/ioblktime.stp - Average Time Block IO Requests Spend in Queue |
210 | keywords: io | |
211 | ||
212 | The ioblktime.stp script tracks the amount of time that each block IO | |
cc20d853 ET |
213 | requests spend waiting for completion. The script computes the |
214 | average time waiting time for block IO per device and prints list | |
ad7e33d7 | 215 | every 10 seconds. In some cases there can be too many outstanding |
cc20d853 | 216 | block IO operations and the script may exceed the default number of |
67f8611b WC |
217 | MAXMAPENTRIES allowed. In this case the allowed number can be |
218 | increased with "-DMAXMAPENTRIES=10000" option on the stap command | |
219 | line. | |
220 | ||
221 | ||
54ff5e0c FCE |
222 | io/iostat-scsi.stp - iostat for SCSI Devices |
223 | keywords: io profiling scsi | |
224 | ||
225 | The iostat-scsi.stp script provides a breakdown of the number of blks | |
ad7e33d7 | 226 | read and written on the machine's various SCSI devices. The script |
54ff5e0c FCE |
227 | takes one argument which is the number of seconds between reports. |
228 | ||
229 | ||
3e4444ed WC |
230 | io/iostats.stp - List Executables Reading and Writing the Most Data |
231 | keywords: io profiling | |
232 | ||
233 | The iostat.stp script measures the amount of data successfully read | |
234 | and written by all the executables on the system. The output is | |
235 | sorted from most greatest sum of bytes read and written by an | |
236 | executable to the least. The output contains the count of operations | |
237 | (opens, reads, and writes), the totals and averages for the number of | |
238 | bytes read and written. | |
239 | ||
240 | ||
210ff7bf | 241 | io/iotime.stp - Trace Time Spent in Read and Write for Files |
09a98ae0 | 242 | keywords: syscall read write time io |
210ff7bf FCE |
243 | |
244 | The script watches each open, close, read, and write syscalls on the | |
245 | system. For each file the scripts observes opened it accumulates the | |
246 | amount of wall clock time spend in read and write operations and the | |
247 | number of bytes read and written. When a file is closed the script | |
248 | prints out a pair of lines for the file. Both lines begin with a | |
249 | timestamp in microseconds, the PID number, and the executable name in | |
ad7e33d7 | 250 | parentheses. The first line with the "access" keyword lists the file |
210ff7bf FCE |
251 | name, the attempted number of bytes for the read and write |
252 | operations. The second line with the "iotime" keyword list the file | |
253 | name and the number of microseconds accumulated in the read and write | |
254 | syscalls. | |
255 | ||
256 | ||
257 | io/iotop.stp - Periodically Print I/O Activity by Process Name | |
09a98ae0 | 258 | keywords: io |
210ff7bf FCE |
259 | |
260 | Every five seconds print out the top ten executables generating I/O | |
261 | traffic during that interval sorted in descending order. | |
262 | ||
263 | ||
264 | io/traceio.stp - Track Cumulative I/O Activity by Process Name | |
09a98ae0 | 265 | keywords: io |
210ff7bf FCE |
266 | |
267 | Every second print out the top ten executables sorted in descending | |
268 | order based on cumulative I/O traffic observed. | |
269 | ||
270 | ||
271 | io/traceio2.stp - Watch I/O Activity on a Particular Device | |
09a98ae0 | 272 | keywords: io |
210ff7bf FCE |
273 | |
274 | Print out the executable name and process number as reads and writes | |
275 | to the specified device occur. | |
276 | ||
277 | ||
b7f6cfc5 FCE |
278 | io/ttyspy.stp - Monitor tty typing. |
279 | keywords: io tty per-process monitor | |
280 | ||
281 | The ttyspy.stp script uses tty_audit hooks to monitor recent typing | |
282 | activity on the system, printing a scrolling record of recent | |
283 | keystrokes, on a per-tty basis. | |
284 | ||
285 | ||
210ff7bf | 286 | process/sleepingBeauties.stp - Generating Backtraces of Threads Waiting for IO Operations |
09a98ae0 | 287 | keywords: io scheduler backtrace |
210ff7bf | 288 | |
cae71dd3 FCE |
289 | The script monitors the time that threads spend waiting for IO |
290 | operations (in "D" state) in the wait_for_completion function. If a | |
291 | thread spends over 10ms, its name and backtrace is printed, and later | |
292 | so is the total delay. | |
210ff7bf FCE |
293 | |
294 | ||
295 | = LOCKING = | |
296 | ||
cf5023fb WC |
297 | locks/bkl.stp - Tracing Contention on Big Kernel Lock (BKL) |
298 | keywords: locking | |
299 | ||
300 | The bkl.stp script can help determine whether the Big Kernel Lock | |
301 | (BKL) is causing serialization on a multiprocessor system due to | |
302 | excessive contention of the BKL. The bkl.stp script takes one | |
303 | argument which is the number of processes waiting for the Big Kernel | |
304 | Lock (BKL). When the number of processes waiting for the BKL is | |
305 | reached or exceeded, the script will print a time stamp, the number | |
306 | of processes waiting for the BKL, the holder of the BKL, and the | |
307 | amount of time the BKL was held. | |
308 | ||
309 | ||
310 | locks/bkl_stats.stp - Per Process Statistics on Big Kernel Lock (BKL) Use | |
311 | keywords: locking | |
312 | ||
313 | The bkl_stats.stp script can indicate which processes have excessive | |
314 | waits for the Big Kernel Lock (BKL) and which processes are taking | |
315 | the BKL for long periods of time. The bkl_stats.stp script prints | |
316 | lists of all the processes that require the BKL. Every five seconds | |
317 | two tables are printed out. The first table lists the processes that | |
318 | waited for the BKL followed by the number of times that the process | |
319 | waited, the minimum time of the wait, the average and the maximum | |
320 | time waited. The second table lists has similar information for the | |
321 | time spent holding the lock for each of the processes. | |
322 | ||
323 | ||
210ff7bf | 324 | process/futexes.stp - System-Wide Futex Contention |
09a98ae0 | 325 | keywords: syscall locking futex |
210ff7bf FCE |
326 | |
327 | The script watches the futex syscall on the system. On exit the | |
328 | futexes address, the number of contentions, and the average time for | |
329 | each contention on the futex are printed from lowest pid number to | |
330 | highest. | |
331 | ||
332 | ||
22f971e8 WC |
333 | = MEMORY = |
334 | ||
335 | memory/kmalloc-top - Show Paths to Kernel Malloc (kmalloc) Invocations | |
336 | keywords: memory | |
337 | ||
338 | The kmalloc-top perl program runs a small systemtap script to collect | |
339 | stack traces for each call to the kmalloc function and counts the | |
340 | time that each stack trace is observed. When kmalloc-top exits it | |
341 | prints out sorted list. The output can be be filtered to print only | |
342 | only the first stack traces (-t) stack traces with more a minimum | |
343 | counts (-m), or exclude certain stack traces (-e). | |
344 | ||
345 | ||
0dc23d1d WC |
346 | memory/mmanonpage.stp - Track Virtual Memory System Actions on Anonymous Pages |
347 | keywords: memory | |
348 | ||
349 | The mmanonpage.stp script uses the virtual memory tracepoints | |
350 | available in some kernels to track the number of faults, user space | |
351 | frees, page ins, copy on writes and unmaps for anonymous pages. When | |
352 | the script is terminated the counts are printed for each process that | |
353 | allocated pages while the script was running. This script displays | |
354 | the anonymous page statistics for each process that ran while the | |
355 | script is active. Its useful in debugging leaks in the anonymous | |
356 | regions of a process. | |
357 | ||
358 | ||
359 | memory/mmfilepage.stp - Track Virtual Memory System Actions on File Backed Pages | |
360 | keywords: memory | |
361 | ||
362 | The mmfilepage.stp script uses the virtual memory tracepoints | |
363 | available in some kernels to track the number of faults, copy on | |
364 | writes mapping, and unmapping operations for file backed pages. When | |
365 | the script is terminated the counts are printed for each process that | |
366 | allocated pages while the script was running. The mmfilepage.stp | |
367 | script is useful in debugging leaks in the mapped file regions of a | |
368 | process. | |
369 | ||
370 | ||
371 | memory/mmreclaim.stp - Track Virtual Memory System Page Reclamation | |
372 | keywords: memory | |
373 | ||
374 | The mmreclaim.stp script uses the virtual memory tracepoints | |
ad7e33d7 JS |
375 | available in some kernels to track page reclaim activity that |
376 | occurred while the script was running. Its useful is debugging | |
377 | performance problems that occur due to page reclamation. | |
0dc23d1d WC |
378 | |
379 | ||
380 | memory/mmwriteback.stp - Track Virtual Memory System Writing to Disk | |
381 | keywords: memory | |
382 | ||
383 | The mmwriteback.stp script uses the virtual memory tracepoints | |
384 | available in some kernels to report all of the file writebacks that | |
385 | occur form kupdate, pdflush and kjournald while the script is | |
386 | running. Its useful in determining where writes are coming from on a | |
ad7e33d7 | 387 | supposedly idle system that is experiencing unexpected IO. |
0dc23d1d WC |
388 | |
389 | ||
c728b7da WC |
390 | memory/numa_faults.stp - Summarize Process Misses across NUMA Nodes |
391 | keywords: memory numa | |
392 | ||
393 | The numa_faults.stp script tracks the read and write pages faults for | |
394 | each process. When the script exits it prints out the total read and | |
ad7e33d7 | 395 | write pages faults for each process. The script also provide a break |
c728b7da WC |
396 | down of page faults per node for each process. This script is useful |
397 | for determining whether the program has good locality (page faults | |
398 | limited to a single node) on a NUMA computer. | |
399 | ||
400 | ||
413996e0 WC |
401 | memory/pfaults.stp - Generate Log of Major and Minor Page Faults |
402 | keywords: memory | |
403 | ||
404 | The pfaults.stp script generates a simple log for each major and | |
405 | minor page fault that occurs on the system. Each line contains a | |
406 | timestamp (in microseconds) when the page fault servicing was | |
407 | completed, the pid of the process, the address of the page fault, the | |
408 | type of access (read or write), the type of fault (major or minor), | |
409 | and the elapsed time for page fault. This log can be examined to | |
ad7e33d7 | 410 | determine where the page faults are occurring. |
413996e0 WC |
411 | |
412 | ||
905728a0 WC |
413 | network/sk_stream_wait_memory.stp - Track Start and Stop of Processes Due to Network Buffer Space |
414 | keywords: network tcp buffer memory | |
415 | ||
416 | The sk_stream-wait_memory.stp prints a time stamp, executable, and | |
417 | pid each time a process blocks due to the send buffer being full. A | |
418 | similar entry is printed each time a process continues because there | |
419 | is room in the buffer. | |
420 | ||
421 | ||
b7f6cfc5 FCE |
422 | = MONITOR = |
423 | ||
424 | io/ttyspy.stp - Monitor tty typing. | |
425 | keywords: io tty per-process monitor | |
426 | ||
427 | The ttyspy.stp script uses tty_audit hooks to monitor recent typing | |
428 | activity on the system, printing a scrolling record of recent | |
429 | keystrokes, on a per-tty basis. | |
430 | ||
431 | ||
210ff7bf FCE |
432 | = NETWORK = |
433 | ||
8b88e771 FCE |
434 | network/autofs4.stp - Watch autofs4 operations |
435 | keywords: network autofs nfs | |
436 | ||
437 | Trace key autofs4 operations such as mounting or unmounting remote | |
438 | filesystems. | |
439 | ||
440 | ||
0e4901b0 WC |
441 | network/dropwatch.stp - Watch Where Socket Buffers are Freed in the Kernel |
442 | keywords: network tracepoint buffer free | |
443 | ||
444 | Every five seconds the dropwatch.stp script lists the number of | |
445 | socket buffers freed at locations in the kernel. | |
446 | ||
447 | ||
53e5699f JS |
448 | network/netdev.stp - Trace Activity on Network Devices |
449 | keywords: network device traffic | |
450 | ||
451 | The netdev.stp script traces configuration and transmit/receive | |
452 | activity on network devices. | |
453 | ||
454 | ||
210ff7bf | 455 | network/nettop.stp - Periodic Listing of Processes Using Network Interfaces |
09a98ae0 | 456 | keywords: network traffic per-process |
210ff7bf FCE |
457 | |
458 | Every five seconds the nettop.stp script prints out a list of | |
459 | processed (PID and command) with the number of packets sent/received | |
460 | and the amount of data sent/received by the process during that | |
461 | interval. | |
462 | ||
463 | ||
905728a0 WC |
464 | network/sk_stream_wait_memory.stp - Track Start and Stop of Processes Due to Network Buffer Space |
465 | keywords: network tcp buffer memory | |
466 | ||
467 | The sk_stream-wait_memory.stp prints a time stamp, executable, and | |
468 | pid each time a process blocks due to the send buffer being full. A | |
469 | similar entry is printed each time a process continues because there | |
470 | is room in the buffer. | |
471 | ||
472 | ||
210ff7bf | 473 | network/socket-trace.stp - Trace Functions called in Network Socket Code |
09a98ae0 | 474 | keywords: network socket |
210ff7bf FCE |
475 | |
476 | The script instrument each of the functions inn the Linux kernel's | |
477 | net/socket.c file. The script prints out trace. The first element of | |
478 | a line is time delta in microseconds from the previous entry. This | |
479 | is followed by the command name and the PID. The "->" and "<-" | |
480 | indicates function entry and function exit, respectively. The last | |
481 | element of the line is the function name. | |
482 | ||
483 | ||
492d227f WC |
484 | network/tcp_connections.stp - Track Creation of Incoming TCP Connections |
485 | keywords: network tcp socket | |
486 | ||
487 | The tcp_connections.stp script prints information for each new | |
488 | incoming TCP connection accepted by the computer. The information | |
489 | includes the UID, the command accepting the connection, the PID of | |
490 | the command, the port the connection is on, and the IP address of the | |
491 | originator of the request. | |
492 | ||
493 | ||
7a51212c WC |
494 | network/tcpdumplike.stp - Dump of Received TCP Packets |
495 | keywords: network traffic | |
496 | ||
497 | The tcpdumplike.stp prints out a line for each TCP packet received. | |
498 | Each line includes the source and destination IP addresses, the | |
499 | source and destination ports, and flags. | |
500 | ||
501 | ||
4bb6522c WC |
502 | network/tcpipstat.stp - Display network statistics for individual TCP sockets. |
503 | keywords: network statistics | |
504 | ||
505 | tcpipstat collects and display network statistics related to | |
506 | individual TCP sockets or groups of sockets. The statistics that are | |
507 | collected are simmer to that of the command netstat -s, only sorted | |
508 | and grouped by individual sockets. | |
509 | ||
510 | ||
8b88e771 FCE |
511 | = NFS = |
512 | ||
513 | network/autofs4.stp - Watch autofs4 operations | |
514 | keywords: network autofs nfs | |
515 | ||
516 | Trace key autofs4 operations such as mounting or unmounting remote | |
517 | filesystems. | |
518 | ||
519 | ||
c728b7da WC |
520 | = NUMA = |
521 | ||
522 | memory/numa_faults.stp - Summarize Process Misses across NUMA Nodes | |
523 | keywords: memory numa | |
524 | ||
525 | The numa_faults.stp script tracks the read and write pages faults for | |
526 | each process. When the script exits it prints out the total read and | |
ad7e33d7 | 527 | write pages faults for each process. The script also provide a break |
c728b7da WC |
528 | down of page faults per node for each process. This script is useful |
529 | for determining whether the program has good locality (page faults | |
530 | limited to a single node) on a NUMA computer. | |
531 | ||
532 | ||
210ff7bf FCE |
533 | = PER-PROCESS = |
534 | ||
b7f6cfc5 FCE |
535 | io/ttyspy.stp - Monitor tty typing. |
536 | keywords: io tty per-process monitor | |
537 | ||
538 | The ttyspy.stp script uses tty_audit hooks to monitor recent typing | |
539 | activity on the system, printing a scrolling record of recent | |
540 | keystrokes, on a per-tty basis. | |
541 | ||
542 | ||
210ff7bf | 543 | network/nettop.stp - Periodic Listing of Processes Using Network Interfaces |
09a98ae0 | 544 | keywords: network traffic per-process |
210ff7bf FCE |
545 | |
546 | Every five seconds the nettop.stp script prints out a list of | |
547 | processed (PID and command) with the number of packets sent/received | |
548 | and the amount of data sent/received by the process during that | |
549 | interval. | |
550 | ||
551 | ||
cc20d853 ET |
552 | = PROCESS = |
553 | ||
554 | process/errsnoop.stp - tabulate system call errors | |
555 | keywords: process syscall | |
556 | ||
557 | The script prints a periodic tabular report about failing system | |
558 | calls, by process and by syscall failure. The first optional | |
559 | argument specifies the reporting interval (in seconds, default 5); | |
560 | the second optional argument gives a screen height (number of lines | |
561 | in the report, default 20). | |
562 | ||
563 | ||
e6b653c8 WC |
564 | process/forktracker.stp - Trace Creation of Processes |
565 | keywords: process scheduler | |
566 | ||
567 | The forktracker.stp script prints out a time-stamped entry showing | |
568 | each fork and exec operation on the machine. This can be useful for | |
569 | determine what process is creating a flurry of short-lived processes. | |
570 | ||
571 | ||
34029cd3 WC |
572 | process/schedtimes.stp - Track Time Processes Spend in Various States using Tracepoints |
573 | keywords: process scheduler time tracepoint | |
574 | ||
575 | The schedtimes.stp script instruments the scheduler to track the | |
576 | amount of time that each process spends running, sleeping, queued, | |
577 | and waiting for io. On exit the script prints out the accumulated | |
578 | time for each state of processes observed. Optionally, this script | |
579 | can be used with the '-c' or '-x' options to focus on a specific PID. | |
580 | ||
581 | ||
210ff7bf FCE |
582 | = PROFILING = |
583 | ||
54ff5e0c FCE |
584 | io/iostat-scsi.stp - iostat for SCSI Devices |
585 | keywords: io profiling scsi | |
586 | ||
587 | The iostat-scsi.stp script provides a breakdown of the number of blks | |
ad7e33d7 | 588 | read and written on the machine's various SCSI devices. The script |
54ff5e0c FCE |
589 | takes one argument which is the number of seconds between reports. |
590 | ||
591 | ||
3e4444ed WC |
592 | io/iostats.stp - List Executables Reading and Writing the Most Data |
593 | keywords: io profiling | |
594 | ||
595 | The iostat.stp script measures the amount of data successfully read | |
596 | and written by all the executables on the system. The output is | |
597 | sorted from most greatest sum of bytes read and written by an | |
598 | executable to the least. The output contains the count of operations | |
599 | (opens, reads, and writes), the totals and averages for the number of | |
600 | bytes read and written. | |
601 | ||
602 | ||
210ff7bf | 603 | process/pf2.stp - Profile kernel functions |
09a98ae0 | 604 | keywords: profiling |
210ff7bf FCE |
605 | |
606 | The pf2.stp script sets up time-based sampling. Every five seconds it | |
607 | prints out a sorted list with the top ten kernel functions with | |
608 | samples. | |
609 | ||
610 | ||
611 | profiling/functioncallcount.stp - Count Times Functions Called | |
09a98ae0 | 612 | keywords: profiling functions |
210ff7bf FCE |
613 | |
614 | The functioncallcount.stp script takes one argument, a list of | |
615 | functions to probe. The script will run and count the number of times | |
616 | that each of the functions on the list is called. On exit the script | |
617 | will print a sorted list from most frequently to least frequently | |
618 | called function. | |
619 | ||
620 | ||
621 | profiling/thread-times.stp - Profile kernel functions | |
09a98ae0 | 622 | keywords: profiling |
210ff7bf FCE |
623 | |
624 | The thread-times.stp script sets up time-based sampling. Every five | |
625 | seconds it prints out a sorted list with the top twenty processes | |
626 | with samples broken down into percentage total time spent in | |
627 | user-space and kernel-space. | |
628 | ||
629 | ||
ff90b297 WC |
630 | profiling/timeout.stp - Show Processes Doing Polling Operations |
631 | keywords: profiling | |
632 | ||
633 | The timeout.stp script is based on a blog entry | |
634 | (http://udrepper.livejournal.com/19041.html) mentioning a need for a | |
635 | tool to help developers find applications that are polling. The | |
636 | timeout.stp script monitors systemcall used for polling and records | |
637 | the systemcalls that timed out rather than returned because some | |
638 | action occurred. The script updates the screen once a second with the | |
639 | top twenty processes. | |
640 | ||
641 | ||
1bf72dfe WC |
642 | profiling/topsys.stp - Show Processes Doing Polling Operations |
643 | keywords: profiling | |
644 | ||
645 | The topsys.stp script lists out the top twenty systemcalls for the | |
646 | previous 5 seconds. The output is sorted from most frequent to least | |
647 | frequent. | |
648 | ||
649 | ||
210ff7bf FCE |
650 | = READ = |
651 | ||
652 | io/iotime.stp - Trace Time Spent in Read and Write for Files | |
09a98ae0 | 653 | keywords: syscall read write time io |
210ff7bf FCE |
654 | |
655 | The script watches each open, close, read, and write syscalls on the | |
656 | system. For each file the scripts observes opened it accumulates the | |
657 | amount of wall clock time spend in read and write operations and the | |
658 | number of bytes read and written. When a file is closed the script | |
659 | prints out a pair of lines for the file. Both lines begin with a | |
660 | timestamp in microseconds, the PID number, and the executable name in | |
ad7e33d7 | 661 | parentheses. The first line with the "access" keyword lists the file |
210ff7bf FCE |
662 | name, the attempted number of bytes for the read and write |
663 | operations. The second line with the "iotime" keyword list the file | |
664 | name and the number of microseconds accumulated in the read and write | |
665 | syscalls. | |
666 | ||
667 | ||
668 | = SCHEDULER = | |
669 | ||
deb63545 WC |
670 | process/chng_cpu.stp - Monitor Changes in Processor Executing a Task |
671 | keywords: scheduler | |
672 | ||
673 | The chng_cpu.stp script takes an argument which is the executable | |
674 | name of the task it should monitor. Each time a task with that | |
675 | executable name is found running on a different processor, the script | |
676 | prints out the thread id (tid), the executable name, the processor | |
677 | now running the task, the thread state, and a backtrace showing the | |
678 | kernel functions that triggered the running of the task on the | |
679 | processor. | |
680 | ||
681 | ||
e6b653c8 WC |
682 | process/forktracker.stp - Trace Creation of Processes |
683 | keywords: process scheduler | |
684 | ||
685 | The forktracker.stp script prints out a time-stamped entry showing | |
686 | each fork and exec operation on the machine. This can be useful for | |
687 | determine what process is creating a flurry of short-lived processes. | |
688 | ||
689 | ||
deb63545 WC |
690 | process/migrate.stp - Track the Migration of Specific Executables |
691 | keywords: scheduler | |
692 | ||
693 | The migrate.stp script takes an argument which is the executable name | |
694 | of the task it should monitor. Each time a task with that executable | |
695 | name migrates between processors an entry is printed with the process | |
696 | id (pid), the executable name, the processor off loading the task, | |
697 | and the process taking the task. Note that the task may or may not be | |
698 | executing at the time of the migration. | |
699 | ||
700 | ||
34029cd3 WC |
701 | process/schedtimes.stp - Track Time Processes Spend in Various States using Tracepoints |
702 | keywords: process scheduler time tracepoint | |
703 | ||
704 | The schedtimes.stp script instruments the scheduler to track the | |
705 | amount of time that each process spends running, sleeping, queued, | |
706 | and waiting for io. On exit the script prints out the accumulated | |
707 | time for each state of processes observed. Optionally, this script | |
708 | can be used with the '-c' or '-x' options to focus on a specific PID. | |
709 | ||
710 | ||
210ff7bf | 711 | process/sleepingBeauties.stp - Generating Backtraces of Threads Waiting for IO Operations |
09a98ae0 | 712 | keywords: io scheduler backtrace |
cae71dd3 FCE |
713 | |
714 | The script monitors the time that threads spend waiting for IO | |
715 | operations (in "D" state) in the wait_for_completion function. If a | |
716 | thread spends over 10ms, its name and backtrace is printed, and later | |
717 | so is the total delay. | |
210ff7bf FCE |
718 | |
719 | ||
54ff5e0c FCE |
720 | = SCSI = |
721 | ||
722 | io/iostat-scsi.stp - iostat for SCSI Devices | |
723 | keywords: io profiling scsi | |
724 | ||
725 | The iostat-scsi.stp script provides a breakdown of the number of blks | |
ad7e33d7 | 726 | read and written on the machine's various SCSI devices. The script |
54ff5e0c FCE |
727 | takes one argument which is the number of seconds between reports. |
728 | ||
729 | ||
210ff7bf FCE |
730 | = SIGNALS = |
731 | ||
732 | process/sig_by_pid.stp - Signal Counts by Process ID | |
09a98ae0 | 733 | keywords: signals |
210ff7bf FCE |
734 | |
735 | Print signal counts by process ID in descending order. | |
736 | ||
737 | ||
738 | process/sig_by_proc.stp - Signal Counts by Process Name | |
09a98ae0 | 739 | keywords: signals |
210ff7bf FCE |
740 | |
741 | Print signal counts by process name in descending order. | |
742 | ||
743 | ||
744 | process/sigkill.stp - Track SIGKILL Signals | |
09a98ae0 | 745 | keywords: signals |
210ff7bf FCE |
746 | |
747 | The script traces any SIGKILL signals. When that SIGKILL signal is | |
748 | sent to a process, the script prints out the signal name, the | |
ad7e33d7 | 749 | destination executable and process ID, the executable name user ID |
210ff7bf FCE |
750 | that sent the signal. |
751 | ||
752 | ||
3a748561 | 753 | process/sigmon.stp - Track a particular signal to a specific process |
09a98ae0 | 754 | keywords: signals |
210ff7bf FCE |
755 | |
756 | The script watches for a particular signal sent to a specific | |
757 | process. When that signal is sent to the specified process, the | |
758 | script prints out the PID and executable of the process sending the | |
759 | signal, the PID and executable name of the process receiving the | |
760 | signal, and the signal number and name. | |
761 | ||
762 | ||
763 | = SIMPLE = | |
764 | ||
765 | general/helloworld.stp - SystemTap "Hello World" Program | |
09a98ae0 | 766 | keywords: simple |
210ff7bf FCE |
767 | |
768 | A basic "Hello World" program implemented in SystemTap script. It | |
769 | prints out "hello world" message and then immediately exits. | |
770 | ||
771 | ||
772 | = SLEEP = | |
773 | ||
774 | process/sleeptime.stp - Trace Time Spent in nanosleep Syscalls | |
09a98ae0 | 775 | keywords: syscall sleep |
210ff7bf FCE |
776 | |
777 | The script watches each nanosleep syscall on the system. At the end | |
778 | of each nanosleep syscall the script prints out a line with a | |
779 | timestamp in microseconds, the pid, the executable name in | |
ad7e33d7 | 780 | parentheses, the "nanosleep:" key, and the duration of the sleep in |
210ff7bf FCE |
781 | microseconds. |
782 | ||
783 | ||
784 | = SOCKET = | |
785 | ||
786 | network/socket-trace.stp - Trace Functions called in Network Socket Code | |
09a98ae0 | 787 | keywords: network socket |
210ff7bf FCE |
788 | |
789 | The script instrument each of the functions inn the Linux kernel's | |
790 | net/socket.c file. The script prints out trace. The first element of | |
791 | a line is time delta in microseconds from the previous entry. This | |
792 | is followed by the command name and the PID. The "->" and "<-" | |
793 | indicates function entry and function exit, respectively. The last | |
794 | element of the line is the function name. | |
795 | ||
796 | ||
492d227f WC |
797 | network/tcp_connections.stp - Track Creation of Incoming TCP Connections |
798 | keywords: network tcp socket | |
799 | ||
800 | The tcp_connections.stp script prints information for each new | |
801 | incoming TCP connection accepted by the computer. The information | |
802 | includes the UID, the command accepting the connection, the PID of | |
803 | the command, the port the connection is on, and the IP address of the | |
804 | originator of the request. | |
805 | ||
806 | ||
4bb6522c WC |
807 | = STATISTICS = |
808 | ||
809 | network/tcpipstat.stp - Display network statistics for individual TCP sockets. | |
810 | keywords: network statistics | |
811 | ||
812 | tcpipstat collects and display network statistics related to | |
813 | individual TCP sockets or groups of sockets. The statistics that are | |
814 | collected are simmer to that of the command netstat -s, only sorted | |
815 | and grouped by individual sockets. | |
816 | ||
817 | ||
210ff7bf FCE |
818 | = SYSCALL = |
819 | ||
820 | io/iotime.stp - Trace Time Spent in Read and Write for Files | |
09a98ae0 | 821 | keywords: syscall read write time io |
210ff7bf FCE |
822 | |
823 | The script watches each open, close, read, and write syscalls on the | |
824 | system. For each file the scripts observes opened it accumulates the | |
825 | amount of wall clock time spend in read and write operations and the | |
826 | number of bytes read and written. When a file is closed the script | |
827 | prints out a pair of lines for the file. Both lines begin with a | |
828 | timestamp in microseconds, the PID number, and the executable name in | |
ad7e33d7 | 829 | parentheses. The first line with the "access" keyword lists the file |
210ff7bf FCE |
830 | name, the attempted number of bytes for the read and write |
831 | operations. The second line with the "iotime" keyword list the file | |
832 | name and the number of microseconds accumulated in the read and write | |
833 | syscalls. | |
834 | ||
835 | ||
cc20d853 ET |
836 | process/errsnoop.stp - tabulate system call errors |
837 | keywords: process syscall | |
838 | ||
839 | The script prints a periodic tabular report about failing system | |
840 | calls, by process and by syscall failure. The first optional | |
841 | argument specifies the reporting interval (in seconds, default 5); | |
842 | the second optional argument gives a screen height (number of lines | |
843 | in the report, default 20). | |
844 | ||
845 | ||
210ff7bf | 846 | process/futexes.stp - System-Wide Futex Contention |
09a98ae0 | 847 | keywords: syscall locking futex |
210ff7bf FCE |
848 | |
849 | The script watches the futex syscall on the system. On exit the | |
850 | futexes address, the number of contentions, and the average time for | |
851 | each contention on the futex are printed from lowest pid number to | |
852 | highest. | |
853 | ||
854 | ||
855 | process/sleeptime.stp - Trace Time Spent in nanosleep Syscalls | |
09a98ae0 | 856 | keywords: syscall sleep |
210ff7bf FCE |
857 | |
858 | The script watches each nanosleep syscall on the system. At the end | |
859 | of each nanosleep syscall the script prints out a line with a | |
860 | timestamp in microseconds, the pid, the executable name in | |
ad7e33d7 | 861 | parentheses, the "nanosleep:" key, and the duration of the sleep in |
210ff7bf FCE |
862 | microseconds. |
863 | ||
864 | ||
865 | process/syscalls_by_pid.stp - System-Wide Count of Syscalls by PID | |
09a98ae0 | 866 | keywords: syscall |
210ff7bf FCE |
867 | |
868 | The script watches all syscall on the system. On exit the script | |
869 | prints a list showing the number of systemcalls executed by each PID | |
870 | ordered from greatest to least number of syscalls. | |
871 | ||
872 | ||
873 | process/syscalls_by_proc.stp - System-Wide Count of Syscalls by Executable | |
09a98ae0 | 874 | keywords: syscall |
210ff7bf FCE |
875 | |
876 | The script watches all syscall on the system. On exit the script | |
877 | prints a list showing the number of systemcalls executed by each | |
ad7e33d7 | 878 | executable ordered from greatest to least number of syscalls. |
210ff7bf FCE |
879 | |
880 | ||
881 | process/wait4time.stp - Trace Time Spent in wait4 Syscalls | |
09a98ae0 | 882 | keywords: syscall wait4 |
210ff7bf FCE |
883 | |
884 | The script watches each wait4 syscall on the system. At the end of | |
885 | each wait4 syscall the script prints out a line with a timestamp in | |
ad7e33d7 | 886 | microseconds, the pid, the executable name in parentheses, the |
210ff7bf FCE |
887 | "wait4:" key, the duration of the wait and the PID that the wait4 was |
888 | waiting for. If the waited for PID is not specified , it is "-1". | |
889 | ||
890 | ||
492d227f WC |
891 | = TCP = |
892 | ||
905728a0 WC |
893 | network/sk_stream_wait_memory.stp - Track Start and Stop of Processes Due to Network Buffer Space |
894 | keywords: network tcp buffer memory | |
895 | ||
896 | The sk_stream-wait_memory.stp prints a time stamp, executable, and | |
897 | pid each time a process blocks due to the send buffer being full. A | |
898 | similar entry is printed each time a process continues because there | |
899 | is room in the buffer. | |
900 | ||
901 | ||
492d227f WC |
902 | network/tcp_connections.stp - Track Creation of Incoming TCP Connections |
903 | keywords: network tcp socket | |
904 | ||
905 | The tcp_connections.stp script prints information for each new | |
906 | incoming TCP connection accepted by the computer. The information | |
907 | includes the UID, the command accepting the connection, the PID of | |
908 | the command, the port the connection is on, and the IP address of the | |
909 | originator of the request. | |
910 | ||
911 | ||
210ff7bf FCE |
912 | = TIME = |
913 | ||
914 | io/iotime.stp - Trace Time Spent in Read and Write for Files | |
09a98ae0 | 915 | keywords: syscall read write time io |
210ff7bf FCE |
916 | |
917 | The script watches each open, close, read, and write syscalls on the | |
918 | system. For each file the scripts observes opened it accumulates the | |
919 | amount of wall clock time spend in read and write operations and the | |
920 | number of bytes read and written. When a file is closed the script | |
921 | prints out a pair of lines for the file. Both lines begin with a | |
922 | timestamp in microseconds, the PID number, and the executable name in | |
ad7e33d7 | 923 | parentheses. The first line with the "access" keyword lists the file |
210ff7bf FCE |
924 | name, the attempted number of bytes for the read and write |
925 | operations. The second line with the "iotime" keyword list the file | |
926 | name and the number of microseconds accumulated in the read and write | |
927 | syscalls. | |
928 | ||
929 | ||
34029cd3 WC |
930 | process/schedtimes.stp - Track Time Processes Spend in Various States using Tracepoints |
931 | keywords: process scheduler time tracepoint | |
932 | ||
933 | The schedtimes.stp script instruments the scheduler to track the | |
934 | amount of time that each process spends running, sleeping, queued, | |
935 | and waiting for io. On exit the script prints out the accumulated | |
936 | time for each state of processes observed. Optionally, this script | |
937 | can be used with the '-c' or '-x' options to focus on a specific PID. | |
938 | ||
939 | ||
210ff7bf FCE |
940 | = TRACE = |
941 | ||
aa15b9f0 | 942 | general/para-callgraph.stp - Callgraph tracing with arguments |
09a98ae0 | 943 | keywords: trace callgraph |
210ff7bf | 944 | |
aa15b9f0 FCE |
945 | Print a timed per-thread callgraph, complete with function parameters |
946 | and return values. The first parameter names the function probe | |
947 | points to trace. The optional second parameter names the probe | |
948 | points for trigger functions, which acts to enable tracing for only | |
949 | those functions that occur while the current thread is nested within | |
950 | the trigger. | |
210ff7bf FCE |
951 | |
952 | ||
0e4901b0 WC |
953 | = TRACEPOINT = |
954 | ||
955 | network/dropwatch.stp - Watch Where Socket Buffers are Freed in the Kernel | |
956 | keywords: network tracepoint buffer free | |
957 | ||
958 | Every five seconds the dropwatch.stp script lists the number of | |
959 | socket buffers freed at locations in the kernel. | |
960 | ||
961 | ||
34029cd3 WC |
962 | process/schedtimes.stp - Track Time Processes Spend in Various States using Tracepoints |
963 | keywords: process scheduler time tracepoint | |
964 | ||
965 | The schedtimes.stp script instruments the scheduler to track the | |
966 | amount of time that each process spends running, sleeping, queued, | |
967 | and waiting for io. On exit the script prints out the accumulated | |
968 | time for each state of processes observed. Optionally, this script | |
969 | can be used with the '-c' or '-x' options to focus on a specific PID. | |
970 | ||
971 | ||
210ff7bf FCE |
972 | = TRAFFIC = |
973 | ||
53e5699f JS |
974 | network/netdev.stp - Trace Activity on Network Devices |
975 | keywords: network device traffic | |
976 | ||
977 | The netdev.stp script traces configuration and transmit/receive | |
978 | activity on network devices. | |
979 | ||
980 | ||
210ff7bf | 981 | network/nettop.stp - Periodic Listing of Processes Using Network Interfaces |
09a98ae0 | 982 | keywords: network traffic per-process |
210ff7bf FCE |
983 | |
984 | Every five seconds the nettop.stp script prints out a list of | |
985 | processed (PID and command) with the number of packets sent/received | |
986 | and the amount of data sent/received by the process during that | |
987 | interval. | |
988 | ||
989 | ||
7a51212c WC |
990 | network/tcpdumplike.stp - Dump of Received TCP Packets |
991 | keywords: network traffic | |
992 | ||
993 | The tcpdumplike.stp prints out a line for each TCP packet received. | |
994 | Each line includes the source and destination IP addresses, the | |
995 | source and destination ports, and flags. | |
996 | ||
997 | ||
b7f6cfc5 FCE |
998 | = TTY = |
999 | ||
1000 | io/ttyspy.stp - Monitor tty typing. | |
1001 | keywords: io tty per-process monitor | |
1002 | ||
1003 | The ttyspy.stp script uses tty_audit hooks to monitor recent typing | |
1004 | activity on the system, printing a scrolling record of recent | |
1005 | keystrokes, on a per-tty basis. | |
1006 | ||
1007 | ||
210ff7bf FCE |
1008 | = USE = |
1009 | ||
1010 | general/graphs.stp - Graphing Disk and CPU Utilization | |
09a98ae0 | 1011 | keywords: disk cpu use graph |
210ff7bf FCE |
1012 | |
1013 | The script tracks the disk and CPU utilization. The resulting output | |
1014 | of the script can be piped into gnuplot to generate a graph of disk | |
1015 | and CPU USE. | |
1016 | ||
1017 | ||
1018 | = WAIT4 = | |
1019 | ||
1020 | process/wait4time.stp - Trace Time Spent in wait4 Syscalls | |
09a98ae0 | 1021 | keywords: syscall wait4 |
210ff7bf FCE |
1022 | |
1023 | The script watches each wait4 syscall on the system. At the end of | |
1024 | each wait4 syscall the script prints out a line with a timestamp in | |
ad7e33d7 | 1025 | microseconds, the pid, the executable name in parentheses, the |
210ff7bf FCE |
1026 | "wait4:" key, the duration of the wait and the PID that the wait4 was |
1027 | waiting for. If the waited for PID is not specified , it is "-1". | |
1028 | ||
1029 | ||
1030 | = WRITE = | |
1031 | ||
1032 | io/iotime.stp - Trace Time Spent in Read and Write for Files | |
09a98ae0 | 1033 | keywords: syscall read write time io |
210ff7bf FCE |
1034 | |
1035 | The script watches each open, close, read, and write syscalls on the | |
1036 | system. For each file the scripts observes opened it accumulates the | |
1037 | amount of wall clock time spend in read and write operations and the | |
1038 | number of bytes read and written. When a file is closed the script | |
1039 | prints out a pair of lines for the file. Both lines begin with a | |
1040 | timestamp in microseconds, the PID number, and the executable name in | |
ad7e33d7 | 1041 | parentheses. The first line with the "access" keyword lists the file |
210ff7bf FCE |
1042 | name, the attempted number of bytes for the read and write |
1043 | operations. The second line with the "iotime" keyword list the file | |
1044 | name and the number of microseconds accumulated in the read and write | |
1045 | syscalls. | |
1046 | ||
1047 |