Systemtap

The main idea of ​​SystemTap is to label events and assign handlers to them.

During the execution of the script, SystemTap monitors events and, as soon as an event occurs, the kernel of the system will execute a handler.

Events can be the beginning or end of a SystemTap session, a timer, and others.

A handler is a sequence of script statements that will be executed after an event is triggered. Typically, handlers extract information from the context of an event or display information on the screen.

The SystemTap session begins when we execute the script. At this time, the following sequence of actions occurs:

1. First, SystemTap checks the library of “tapsets” for the ones used in the script;
2. Then SystemTap translates the script into C and runs the system compiler to create the kernel module from the script;
3. SystemTap loads the module and activates all events in the script;
4. As soon as an event occurs, the event handler is executed;
5. When all events are completed, the module is unloaded and the session ends.

Events

Synchronous Events

Synchronous events are bound to an instruction in a specific place in the kernel code.

Examples of synchronous events:

• syscall.system_call
• vfs.file_operation
• kernel.function ("function")
• module ("module"). function ("function")

Asynchronous Events

Asynchronous events are not tied to a specific instruction or a specific place in the kernel code.

Examples of asynchronous events:

• begin - start of a SystemTap session
• end - end of the SystemTap session
• timer.event () - timer countdown (timer.s (4) - the event will fire every 4 seconds)

Handlers

The event handler is enclosed in braces ({}).

To display the screen, use the printf format output function ("format string \ n", arguments), which is similar to a similar function in C.

Some SystemTap functions to use with printf ():

• pid () - process ID
• uid () - user ID
• execname () - process name
• cpu () - processor number

Script Example

Script:

  probe syscall.open
  {
      printf ("% s (% d) open \ n", execname (), pid ())
  }

Result:

  vmware-guestd (2206) open
  hald (2360) open
  hald (2360) open
  hald (2360) open
  df (3433) open
  df (3433) open
  df (3433) open
  hald (2360) open

• Dtrace

SystemTap Home