file io script example

[James Dickens]

On 9/7/05, Kevin Stafford <kevinrs@us.ibm.com> wrote:
> Here is a simple script which monitors sys_open and sys_close.
> 
> %{
> #include <linux/file.h>
> %}
> 
> function get_string(str_ptr_addr)
> %{
>         strlcpy(THIS->__retvalue,
>                     (const char __user*) (uintptr_t) THIS->str_ptr_addr,
>                     MAXSTRINGLEN);
> %}
> 
> function get_fname(fd)
> %{
>         struct file *file;
>         file = fget(THIS->fd);
>         strlcpy(THIS->__retvalue,
>                     file->f_dentry->d_name.name,
>                     MAXSTRINGLEN);
> %}
> 
> 
> # The format variable will not be needed when bz#1306
> # is resolved
> # http://sourceware.org/bugzilla/show_bug.cgi?id=1306
> global format
> 
> probe kernel.statement("*@fs/open.c:958")
> {
>         if(format) {
>                 print("sys_open: fd = " . string($fd) .
>                           ", file = " . get_string($tmp)  .
>                           ", proc = " . pexecname()       .
>                           ", pid = " . string(pid()) . "\n")
>                 format = 0
>         } else
>                 format = 1
> }
> 
> probe kernel.function("sys_close")
> {
>         print("sysclose: fd = " . string($fd) .
>                   ", file = " . get_fname($fd)    .
>                   ", proc = " . pexecname()       .
>                   ", pid = " . string(pid()) . "\n")
> }
> 

how does fd get set? and/or is there an easy way to access the
arguments of the kernel functions/syscalls that were sent to the
functions? in dtrace this is  done with arg0-arg9.

James Dickens

[... snip ...]
> --
> Kevin Stafford
> DES 2 | MS 2M3
> Beaverton - OR
> Linux Technology Center
> IBM Systems & Technology
> Phone: 1-503-578-3039
> Email: kevinrs@us.ibm.com
> 
> 
> 
>