rethinking syscall tapset

[James Dickens]

On 1/31/06, Martin Hunt <hunt@redhat.com> wrote:
> On Tue, 2006-01-31 at 18:43 +0000, Daniel P. Berrange wrote:
>
> > > I've created another variable all return probes set called "returnp".
> >
> > I'm not clear on the intended use of this, besides enabling both the
> > call & return to be written in one block, using a conditional ?
>
> Basically that's it. It's not a big deal.
>
I don't see a reason to combine both call and return in one block, but
I think it would be nice to be able to access all the arguments used
to call a syscall, in a way that require each syscall written
individually and that is architecturally transparent.

probe syscall.* {
    printf(%s ( "%s called with %X(%d), %X(%d) ",   probename,  arg0,
arg0, arg1, arg1 );
}

this type of script can be quite useful and is much lighter on the
system than strace that only plays games  stopping the application at
each syscall.


James Dickens
uadmin.blogspot.com

[snip]