Re: Trace syscalls

[Masami Hiramatsu <mhiramat at redhat dot com>]

Hi,

Rus-Rebreanu Alin-Florin wrote:
> Hi,
> 
>  i'm quite new with systemtap but it seems as a wonderful way to trace
> syscalls. i want to trace for example sys_write in such a way that it
> would print the internal path of the sys_write syscall. such as:
> entering fget_light()->exit fget_light()->entering
> file_pos_read()->exit file_pos_read() or even follow the path into
> those functions.
> do i have to write a probe for every single kernel function i want to
> trace? or is it a simpler way to trace the path through a syscall?
> 
> i tried , and it's almost what i want :
> probe kernel.function("*@fs/read_write.c"){
>    printf("%s->%s\n",thread
> _indent(1),probefunc())
> }
> probe kernel.function("*@fs/read_write.c").return{
>    printf("%s->%s\n",thread_indent(1),probefunc())
> }
> 
> but this adds probes to all the functions in the read_write file, and
> i'm only interested in read or write syscalls, but entering every
> function of the syscall

You can filter the probes by masking threads like below;
---
global rwthreads

probe syscall.read, syscall.write {
        rwthreads[tid()] = 1
}
probe syscall.read.return, syscall.write.return {
        delete rwthreads[tid()]
}

probe kernel.function("*@fs/read_write.c").call {
 if (rwthreads[tid()]) { # filtering by thread
   printf("%s->%s\n",thread_indent(1),probefunc())
 }
}
probe kernel.function("*@fs/read_write.c").return {
 if (rwthreads[tid()]) {
   printf("%s<-%s\n",thread_indent(-1),probefunc())
 }
}
---


Thanks,

-- 
Masami Hiramatsu
e-mail: mhiramat@redhat.com