SystemTap bpf begin probe doesn't work
Eytan Naim
eytanaim@gmail.com
Sun Jul 12 19:37:49 GMT 2020
Hi,
I'm trying to probe a userspace process with a 'begin' probe that doesn't
seem to do anything
begin.stp:
probe process("a.out").begin {
printf("%s %d\n", execname(), pid())
}
stp output:
[root@RHEL8 ~]# stap --bpf -v ~/begin.stp
Pass 1: parsed user script and 56 library scripts using
203356virt/48420res/12256shr/36024data kb, in 100usr/10sys/114real ms.
Pass 2: analyzed script: 2 probes, 3 functions, 0 embeds, 1 global
using 204676virt/50128res/12392shr/37344data kb, in 10usr/10sys/11real
ms.
Pass 3: pass skipped for stapbpf runtime in 0usr/0sys/0real ms.
Pass 4: compiled BPF into "stap_30984.bo" in 0usr/0sys/2real ms.
Pass 5: starting run.
When changing the probe to the main() function it seems to work:
function.stp
probe process("a.out").function("main") {
printf("%s %d\n", execname(), pid())
}
stap output:
[root@RHEL8 ~]# stap --bpf -v ~/222.stp
Pass 1: parsed user script and 56 library scripts using
203356virt/48364res/12200shr/36024data kb, in 290usr/50sys/404real ms.
Pass 2: analyzed script: 2 probes, 3 functions, 0 embeds, 1 global
using 204676virt/50996res/13068shr/37344data kb, in 20usr/0sys/25real
ms.
Pass 3: pass skipped for stapbpf runtime in 0usr/0sys/0real ms.
Pass 4: compiled BPF into "stap_31782.bo" in 0usr/0sys/3real ms.
Pass 5: starting run.
a.out 31806
a.out 31821
a.out 31827
a.out 31831
stap version
[root@RHEL8 ~]# stap --version
Systemtap translator/driver (version 4.2/0.178, rpm 4.2-6.el8)
Copyright (C) 2005-2019 Red Hat, Inc. and others
This is free software; see the source for copying conditions.
tested kernel versions: 2.6.32 ... 5.4-rc6
enabled features: AVAHI BOOST_STRING_REF DYNINST BPF JAVA PYTHON3
LIBRPM LIBSQLITE3 LIBVIRT LIBXML2 NLS NSS READLINE
Needless to say that using the default backend engine works.
Thanks,
Eytan.
More information about the Systemtap
mailing list