SystemTap Tapset Reference Manual

SystemTap

SystemTap Tapset Reference Manual

by SystemTap

Copyright © 2008-2015 Red Hat, Inc. and others

This documentation is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License version 2 aspublished by the Free Software Foundation.

This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty ofMERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details.

You should have received a copy of the GNU General Public License along with this program; if not, write to the Free Software Foundation, Inc.,51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.

For more details see the file COPYING in the source distribution of Linux.

Table of Contents

• 1.Introduction
• 2.Context Functions
  • function::addr
  • function::asmlinkage
  • function::backtrace
  • function::caller
  • function::caller_addr
  • function::callers
  • function::cmdline_arg
  • function::cmdline_args
  • function::cmdline_str
  • function::cpu
  • function::cpuid
  • function::egid
  • function::env_var
  • function::euid
  • function::execname
  • function::fastcall
  • function::gid
  • function::int_arg
  • function::is_myproc
  • function::is_return
  • function::long_arg
  • function::longlong_arg
  • function::modname
  • function::module_name
  • function::ns_egid
  • function::ns_euid
  • function::ns_gid
  • function::ns_pgrp
  • function::ns_pid
  • function::ns_ppid
  • function::ns_sid
  • function::ns_tid
  • function::ns_uid
  • function::pexecname
  • function::pgrp
  • function::pid
  • function::pid2execname
  • function::pid2task
  • function::pn
  • function::pnlabel
  • function::pointer_arg
  • function::pp
  • function::ppfunc
  • function::ppid
  • function::print_backtrace
  • function::print_regs
  • function::print_stack
  • function::print_syms
  • function::print_ubacktrace
  • function::print_ubacktrace_brief
  • function::print_ustack
  • function::print_usyms
  • function::probe_type
  • function::probefunc
  • function::probemod
  • function::pstrace
  • function::register
  • function::registers_valid
  • function::regparm
  • function::remote_id
  • function::remote_uri
  • function::s32_arg
  • function::s64_arg
  • function::sid
  • function::sprint_backtrace
  • function::sprint_stack
  • function::sprint_syms
  • function::sprint_ubacktrace
  • function::sprint_ustack
  • function::sprint_usyms
  • function::stack
  • function::stack_size
  • function::stack_unused
  • function::stack_used
  • function::stp_pid
  • function::symdata
  • function::symfile
  • function::symfileline
  • function::symline
  • function::symname
  • function::target
  • function::task_ancestry
  • function::task_backtrace
  • function::task_cpu
  • function::task_current
  • function::task_egid
  • function::task_euid
  • function::task_execname
  • function::task_fd_lookup
  • function::task_gid
  • function::task_max_file_handles
  • function::task_nice
  • function::task_ns_egid
  • function::task_ns_euid
  • function::task_ns_gid
  • function::task_ns_pid
  • function::task_ns_tid
  • function::task_ns_uid
  • function::task_open_file_handles
  • function::task_parent
  • function::task_pid
  • function::task_prio
  • function::task_state
  • function::task_tid
  • function::task_uid
  • function::tid
  • function::u32_arg
  • function::u64_arg
  • function::u_register
  • function::uaddr
  • function::ubacktrace
  • function::ucallers
  • function::uid
  • function::uint_arg
  • function::ulong_arg
  • function::ulonglong_arg
  • function::umodname
  • function::user_mode
  • function::ustack
  • function::usymdata
  • function::usymfile
  • function::usymfileline
  • function::usymline
  • function::usymname
• 3.Timestamp Functions
  • function::HZ
  • function::cpu_clock_ms
  • function::cpu_clock_ns
  • function::cpu_clock_s
  • function::cpu_clock_us
  • function::delete_stopwatch
  • function::get_cycles
  • function::gettimeofday_ms
  • function::gettimeofday_ns
  • function::gettimeofday_s
  • function::gettimeofday_us
  • function::jiffies
  • function::local_clock_ms
  • function::local_clock_ns
  • function::local_clock_s
  • function::local_clock_us
  • function::read_stopwatch_ms
  • function::read_stopwatch_ns
  • function::read_stopwatch_s
  • function::read_stopwatch_us
  • function::start_stopwatch
  • function::stop_stopwatch
• 4.Time utility functions
  • function::ctime
  • function::tz_ctime
  • function::tz_gmtoff
  • function::tz_name
• 5.Shell command functions
  • function::system
• 6.Memory Tapset
  • function::addr_to_node
  • function::bytes_to_string
  • function::mem_page_size
  • function::pages_to_string
  • function::proc_mem_data
  • function::proc_mem_data_pid
  • function::proc_mem_rss
  • function::proc_mem_rss_pid
  • function::proc_mem_shr
  • function::proc_mem_shr_pid
  • function::proc_mem_size
  • function::proc_mem_size_pid
  • function::proc_mem_string
  • function::proc_mem_string_pid
  • function::proc_mem_txt
  • function::proc_mem_txt_pid
  • function::vm_fault_contains
  • probe::vm.brk
  • probe::vm.kfree
  • probe::vm.kmalloc
  • probe::vm.kmalloc_node
  • probe::vm.kmem_cache_alloc
  • probe::vm.kmem_cache_alloc_node
  • probe::vm.kmem_cache_free
  • probe::vm.mmap
  • probe::vm.munmap
  • probe::vm.oom_kill
  • probe::vm.pagefault
  • probe::vm.pagefault.return
  • probe::vm.write_shared
  • probe::vm.write_shared_copy
• 7.Task Time Tapset
  • function::cputime_to_msecs
  • function::cputime_to_string
  • function::cputime_to_usecs
  • function::msecs_to_string
  • function::nsecs_to_string
  • function::task_start_time
  • function::task_stime
  • function::task_stime_tid
  • function::task_time_string
  • function::task_time_string_tid
  • function::task_utime
  • function::task_utime_tid
  • function::usecs_to_string
• 8.Scheduler Tapset
  • probe::scheduler.balance
  • probe::scheduler.cpu_off
  • probe::scheduler.cpu_on
  • probe::scheduler.ctxswitch
  • probe::scheduler.kthread_stop
  • probe::scheduler.kthread_stop.return
  • probe::scheduler.migrate
  • probe::scheduler.process_exit
  • probe::scheduler.process_fork
  • probe::scheduler.process_free
  • probe::scheduler.process_wait
  • probe::scheduler.signal_send
  • probe::scheduler.tick
  • probe::scheduler.wait_task
  • probe::scheduler.wakeup
  • probe::scheduler.wakeup_new
• 9.IO Scheduler and block IO Tapset
  • probe::ioblock.end
  • probe::ioblock.request
  • probe::ioblock_trace.bounce
  • probe::ioblock_trace.end
  • probe::ioblock_trace.request
  • probe::ioscheduler.elv_add_request
  • probe::ioscheduler.elv_add_request.kp
  • probe::ioscheduler.elv_add_request.tp
  • probe::ioscheduler.elv_completed_request
  • probe::ioscheduler.elv_next_request
  • probe::ioscheduler.elv_next_request.return
  • probe::ioscheduler_trace.elv_abort_request
  • probe::ioscheduler_trace.elv_completed_request
  • probe::ioscheduler_trace.elv_issue_request
  • probe::ioscheduler_trace.elv_requeue_request
  • probe::ioscheduler_trace.plug
  • probe::ioscheduler_trace.unplug_io
  • probe::ioscheduler_trace.unplug_timer
• 10.SCSI Tapset
  • probe::scsi.iocompleted
  • probe::scsi.iodispatching
  • probe::scsi.iodone
  • probe::scsi.ioentry
  • probe::scsi.ioexecute
  • probe::scsi.set_state
• 11.TTY Tapset
  • probe::tty.init
  • probe::tty.ioctl
  • probe::tty.open
  • probe::tty.poll
  • probe::tty.read
  • probe::tty.receive
  • probe::tty.register
  • probe::tty.release
  • probe::tty.resize
  • probe::tty.unregister
  • probe::tty.write
• 12.Interrupt Request (IRQ) Tapset
  • probe::irq_handler.entry
  • probe::irq_handler.exit
  • probe::softirq.entry
  • probe::softirq.exit
  • probe::workqueue.create
  • probe::workqueue.destroy
  • probe::workqueue.execute
  • probe::workqueue.insert
• 13.Networking Tapset
  • function::format_ipaddr
  • function::htonl
  • function::htonll
  • function::htons
  • function::ip_ntop
  • function::ntohl
  • function::ntohll
  • function::ntohs
  • probe::netdev.change_mac
  • probe::netdev.change_mtu
  • probe::netdev.change_rx_flag
  • probe::netdev.close
  • probe::netdev.get_stats
  • probe::netdev.hard_transmit
  • probe::netdev.ioctl
  • probe::netdev.open
  • probe::netdev.receive
  • probe::netdev.register
  • probe::netdev.rx
  • probe::netdev.set_promiscuity
  • probe::netdev.transmit
  • probe::netdev.unregister
  • probe::netfilter.arp.forward
  • probe::netfilter.arp.in
  • probe::netfilter.arp.out
  • probe::netfilter.bridge.forward
  • probe::netfilter.bridge.local_in
  • probe::netfilter.bridge.local_out
  • probe::netfilter.bridge.post_routing
  • probe::netfilter.bridge.pre_routing
  • probe::netfilter.ip.forward
  • probe::netfilter.ip.local_in
  • probe::netfilter.ip.local_out
  • probe::netfilter.ip.post_routing
  • probe::netfilter.ip.pre_routing
  • probe::sunrpc.clnt.bind_new_program
  • probe::sunrpc.clnt.call_async
  • probe::sunrpc.clnt.call_sync
  • probe::sunrpc.clnt.clone_client
  • probe::sunrpc.clnt.create_client
  • probe::sunrpc.clnt.restart_call
  • probe::sunrpc.clnt.shutdown_client
  • probe::sunrpc.sched.delay
  • probe::sunrpc.sched.execute
  • probe::sunrpc.sched.new_task
  • probe::sunrpc.sched.release_task
  • probe::sunrpc.svc.create
  • probe::sunrpc.svc.destroy
  • probe::sunrpc.svc.drop
  • probe::sunrpc.svc.process
  • probe::sunrpc.svc.recv
  • probe::sunrpc.svc.register
  • probe::sunrpc.svc.send
  • probe::tcp.disconnect
  • probe::tcp.disconnect.return
  • probe::tcp.receive
  • probe::tcp.recvmsg
  • probe::tcp.recvmsg.return
  • probe::tcp.sendmsg
  • probe::tcp.sendmsg.return
  • probe::tcp.setsockopt
  • probe::tcp.setsockopt.return
  • probe::udp.disconnect
  • probe::udp.disconnect.return
  • probe::udp.recvmsg
  • probe::udp.recvmsg.return
  • probe::udp.sendmsg
  • probe::udp.sendmsg.return
• 14.Socket Tapset
  • function::inet_get_ip_source
  • function::inet_get_local_port
  • function::sock_fam_num2str
  • function::sock_fam_str2num
  • function::sock_prot_num2str
  • function::sock_prot_str2num
  • function::sock_state_num2str
  • function::sock_state_str2num
  • probe::socket.aio_read
  • probe::socket.aio_read.return
  • probe::socket.aio_write
  • probe::socket.aio_write.return
  • probe::socket.close
  • probe::socket.close.return
  • probe::socket.create
  • probe::socket.create.return
  • probe::socket.read_iter
  • probe::socket.read_iter.return
  • probe::socket.readv
  • probe::socket.readv.return
  • probe::socket.receive
  • probe::socket.recvmsg
  • probe::socket.recvmsg.return
  • probe::socket.send
  • probe::socket.sendmsg
  • probe::socket.sendmsg.return
  • probe::socket.write_iter
  • probe::socket.write_iter.return
  • probe::socket.writev
  • probe::socket.writev.return
• 15.SNMP Information Tapset
  • function::ipmib_filter_key
  • function::ipmib_get_proto
  • function::ipmib_local_addr
  • function::ipmib_remote_addr
  • function::ipmib_tcp_local_port
  • function::ipmib_tcp_remote_port
  • function::linuxmib_filter_key
  • function::tcpmib_filter_key
  • function::tcpmib_get_state
  • function::tcpmib_local_addr
  • function::tcpmib_local_port
  • function::tcpmib_remote_addr
  • function::tcpmib_remote_port
  • probe::ipmib.ForwDatagrams
  • probe::ipmib.FragFails
  • probe::ipmib.FragOKs
  • probe::ipmib.InAddrErrors
  • probe::ipmib.InDiscards
  • probe::ipmib.InNoRoutes
  • probe::ipmib.InReceives
  • probe::ipmib.InUnknownProtos
  • probe::ipmib.OutRequests
  • probe::ipmib.ReasmReqds
  • probe::ipmib.ReasmTimeout
  • probe::linuxmib.DelayedACKs
  • probe::linuxmib.ListenDrops
  • probe::linuxmib.ListenOverflows
  • probe::linuxmib.TCPMemoryPressures
  • probe::tcpmib.ActiveOpens
  • probe::tcpmib.AttemptFails
  • probe::tcpmib.CurrEstab
  • probe::tcpmib.EstabResets
  • probe::tcpmib.InSegs
  • probe::tcpmib.OutRsts
  • probe::tcpmib.OutSegs
  • probe::tcpmib.PassiveOpens
  • probe::tcpmib.RetransSegs
• 16.Kernel Process Tapset
  • function::get_loadavg_index
  • function::sprint_loadavg
  • function::target_set_pid
  • function::target_set_report
  • probe::kprocess.create
  • probe::kprocess.exec
  • probe::kprocess.exec_complete
  • probe::kprocess.exit
  • probe::kprocess.release
  • probe::kprocess.start
• 17.Signal Tapset
  • function::get_sa_flags
  • function::get_sa_handler
  • function::is_sig_blocked
  • function::sa_flags_str
  • function::sa_handler_str
  • function::signal_str
  • function::sigset_mask_str
  • probe::signal.check_ignored
  • probe::signal.check_ignored.return
  • probe::signal.checkperm
  • probe::signal.checkperm.return
  • probe::signal.do_action
  • probe::signal.do_action.return
  • probe::signal.flush
  • probe::signal.force_segv
  • probe::signal.force_segv.return
  • probe::signal.handle
  • probe::signal.handle.return
  • probe::signal.pending
  • probe::signal.pending.return
  • probe::signal.procmask
  • probe::signal.procmask.return
  • probe::signal.send
  • probe::signal.send.return
  • probe::signal.send_sig_queue
  • probe::signal.send_sig_queue.return
  • probe::signal.sys_tgkill
  • probe::signal.sys_tgkill.return
  • probe::signal.sys_tkill
  • probe::signal.syskill
  • probe::signal.syskill.return
  • probe::signal.systkill.return
  • probe::signal.wakeup
• 18.Errno Tapset
  • function::errno_str
  • function::return_str
  • function::returnstr
  • function::returnval
• 19.RLIMIT Tapset
  • function::rlimit_from_str
• 20.Device Tapset
  • function::MAJOR
  • function::MINOR
  • function::MKDEV
  • function::usrdev2kerndev
• 21.Directory-entry (dentry) Tapset
  • function::d_name
  • function::d_path
  • function::fullpath_struct_file
  • function::fullpath_struct_nameidata
  • function::fullpath_struct_path
  • function::inode_name
  • function::inode_path
  • function::real_mount
  • function::reverse_path_walk
  • function::task_dentry_path
• 22.Logging Tapset
  • function::assert
  • function::error
  • function::exit
  • function::ftrace
  • function::log
  • function::printk
  • function::warn
• 23.Queue Statistics Tapset
  • function::qs_done
  • function::qs_run
  • function::qs_wait
  • function::qsq_blocked
  • function::qsq_print
  • function::qsq_service_time
  • function::qsq_start
  • function::qsq_throughput
  • function::qsq_utilization
  • function::qsq_wait_queue_length
  • function::qsq_wait_time
• 24.Random functions Tapset
  • function::randint
• 25.String and data retrieving functions Tapset
  • function::atomic_long_read
  • function::atomic_read
  • function::kernel_char
  • function::kernel_int
  • function::kernel_long
  • function::kernel_pointer
  • function::kernel_short
  • function::kernel_string
  • function::kernel_string2
  • function::kernel_string2_utf16
  • function::kernel_string2_utf32
  • function::kernel_string_n
  • function::kernel_string_quoted
  • function::kernel_string_utf16
  • function::kernel_string_utf32
  • function::user_char
  • function::user_char_warn
  • function::user_int
  • function::user_int16
  • function::user_int32
  • function::user_int64
  • function::user_int8
  • function::user_int_warn
  • function::user_long
  • function::user_long_warn
  • function::user_short
  • function::user_short_warn
  • function::user_string
  • function::user_string2
  • function::user_string2_n_warn
  • function::user_string2_utf16
  • function::user_string2_utf32
  • function::user_string2_warn
  • function::user_string_n
  • function::user_string_n2
  • function::user_string_n2_quoted
  • function::user_string_n_quoted
  • function::user_string_n_warn
  • function::user_string_quoted
  • function::user_string_utf16
  • function::user_string_utf32
  • function::user_string_warn
  • function::user_uint16
  • function::user_uint32
  • function::user_uint64
  • function::user_uint8
  • function::user_ulong
  • function::user_ulong_warn
  • function::user_ushort
  • function::user_ushort_warn
• 26.String and data writing functions Tapset
  • function::set_kernel_char
  • function::set_kernel_int
  • function::set_kernel_long
  • function::set_kernel_pointer
  • function::set_kernel_short
  • function::set_kernel_string
  • function::set_kernel_string_n
• 27.Guru tapsets
  • function::mdelay
  • function::panic
  • function::raise
  • function::udelay
• 28.A collection of standard string functions
  • function::isdigit
  • function::isinstr
  • function::str_replace
  • function::stringat
  • function::strlen
  • function::strtol
  • function::substr
  • function::text_str
  • function::text_strn
  • function::tokenize
• 29.Utility functions for using ansi control chars in logs
  • function::ansi_clear_screen
  • function::ansi_cursor_hide
  • function::ansi_cursor_move
  • function::ansi_cursor_restore
  • function::ansi_cursor_save
  • function::ansi_cursor_show
  • function::ansi_new_line
  • function::ansi_reset_color
  • function::ansi_set_color
  • function::ansi_set_color2
  • function::ansi_set_color3
  • function::indent
  • function::indent_depth
  • function::thread_indent
  • function::thread_indent_depth
• 30.SystemTap Translator Tapset
  • probe::stap.cache_add_mod
  • probe::stap.cache_add_nss
  • probe::stap.cache_add_src
  • probe::stap.cache_clean
  • probe::stap.cache_get
  • probe::stap.pass0
  • probe::stap.pass0.end
  • probe::stap.pass1.end
  • probe::stap.pass1a
  • probe::stap.pass1b
  • probe::stap.pass2
  • probe::stap.pass2.end
  • probe::stap.pass3
  • probe::stap.pass3.end
  • probe::stap.pass4
  • probe::stap.pass4.end
  • probe::stap.pass5
  • probe::stap.pass5.end
  • probe::stap.pass6
  • probe::stap.pass6.end
  • probe::stap.system
  • probe::stap.system.return
  • probe::stap.system.spawn
  • probe::stapio.receive_control_message
  • probe::staprun.insert_module
  • probe::staprun.remove_module
  • probe::staprun.send_control_message
• 31.Network File Storage Tapsets
  • function::nfsderror
  • probe::nfs.aop.readpage
  • probe::nfs.aop.readpages
  • probe::nfs.aop.release_page
  • probe::nfs.aop.set_page_dirty
  • probe::nfs.aop.write_begin
  • probe::nfs.aop.write_end
  • probe::nfs.aop.writepage
  • probe::nfs.aop.writepages
  • probe::nfs.fop.aio_read
  • probe::nfs.fop.aio_write
  • probe::nfs.fop.check_flags
  • probe::nfs.fop.flush
  • probe::nfs.fop.fsync
  • probe::nfs.fop.llseek
  • probe::nfs.fop.lock
  • probe::nfs.fop.mmap
  • probe::nfs.fop.open
  • probe::nfs.fop.read
  • probe::nfs.fop.read_iter
  • probe::nfs.fop.release
  • probe::nfs.fop.sendfile
  • probe::nfs.fop.write
  • probe::nfs.fop.write_iter
  • probe::nfs.proc.commit
  • probe::nfs.proc.commit_done
  • probe::nfs.proc.commit_setup
  • probe::nfs.proc.create
  • probe::nfs.proc.handle_exception
  • probe::nfs.proc.lookup
  • probe::nfs.proc.open
  • probe::nfs.proc.read
  • probe::nfs.proc.read_done
  • probe::nfs.proc.read_setup
  • probe::nfs.proc.release
  • probe::nfs.proc.remove
  • probe::nfs.proc.rename
  • probe::nfs.proc.rename_done
  • probe::nfs.proc.rename_setup
  • probe::nfs.proc.write
  • probe::nfs.proc.write_done
  • probe::nfs.proc.write_setup
  • probe::nfsd.close
  • probe::nfsd.commit
  • probe::nfsd.create
  • probe::nfsd.createv3
  • probe::nfsd.dispatch
  • probe::nfsd.lookup
  • probe::nfsd.open
  • probe::nfsd.proc.commit
  • probe::nfsd.proc.create
  • probe::nfsd.proc.lookup
  • probe::nfsd.proc.read
  • probe::nfsd.proc.remove
  • probe::nfsd.proc.rename
  • probe::nfsd.proc.write
  • probe::nfsd.read
  • probe::nfsd.rename
  • probe::nfsd.unlink
  • probe::nfsd.write
• 32.Speculation
  • function::commit
  • function::discard
  • function::speculate
  • function::speculation
• 33.JSON Tapset
  • function::json_add_array
  • function::json_add_array_numeric_metric
  • function::json_add_array_string_metric
  • function::json_add_numeric_metric
  • function::json_add_string_metric
  • function::json_set_prefix
  • macro::json_output_array_numeric_value
  • macro::json_output_array_string_value
  • macro::json_output_data_end
  • macro::json_output_data_start
  • macro::json_output_numeric_value
  • macro::json_output_string_value
  • probe::json_data
• 34.Output file switching Tapset
  • function::switch_file
• 35.syscalls

List of Tables

• 35.1.Syscalls list

Chapter 1. Introduction

SystemTap provides free software (GPL) infrastructure to simplify the gathering of information about the running Linux system. This assists diagnosis of a performance or functional problem. SystemTap eliminates the need for the developer to go through the tedious and disruptive instrument, recompile, install, and reboot sequence that may be otherwise required to collect data. SystemTap provides a simple command line interface and scripting language for writing instrumentation for a live running kernel. The instrumentation makes extensive use of the probe points and functions provided in the tapset library. This document describes the various probe points and functions.

Chapter 2. Context Functions

The context functions provide additional information about where an event occurred. These functions can provide information such as a backtrace to where the event occurred and the current register values for the processor.

function::addr

function::addr — Address of the current probe point.

Synopsis

addr:long()

Arguments

None

Description

Returns the instruction pointer from the current probe's register state. Not all probe types have registers though, in which case zero is returned. The returned address is suitable for use with functions like symname and symdata.

function::asmlinkage

function::asmlinkage — Mark function as declared asmlinkage

Synopsis

asmlinkage()

Arguments

None

Description

Call this function before accessing Arguments using the *_arg functions if the probed kernel function was declared asmlinkage in the source.

function::backtrace

function::backtrace — Hex backtrace of current kernel stack

Synopsis

backtrace:string()

Arguments

None

Description

This function returns a string of hex addresses that are a backtrace of the kernel stack. Output may be truncated as per maximum string length (MAXSTRINGLEN). See ubacktrace for user-space backtrace.

function::caller

function::caller — Return name and address of calling function

Synopsis

caller:string()

Arguments

None

Description

This function returns the address and name of the calling function. This is equivalent to calling: sprintf(“s 0xx”, symname(caller_addr), caller_addr)

function:: caller_addr

function::caller_addr — Return caller address

Synopsis

caller_addr:long()

Arguments

None

Description

This function returns the address of the calling function.

function::callers

function::callers — Return first n elements of kernel stack backtrace

Synopsis

callers:string(n:long)

Arguments

n number of levels to descend in the stack (not counting the top level). If n is -1, print the entire stack.

Description

This function returns a string of the first n hex addresses from the backtrace of the kernel stack. Output may be truncated as per maximum string length (MAXSTRINGLEN).

function::cmdline_arg

function::cmdline_arg — Fetch a command line argument

Synopsis

cmdline_arg:string(n:long)

Arguments

n Argument to get (zero is the program itself)

Description

Returns argument the requested argument from the current process or the empty string when there are not that many Arguments or there is a problem retrieving the argument. Argument zero is traditionally the command itself.

function::cmdline_args

function::cmdline_args — Fetch command line Arguments from current process

Synopsis

cmdline_args:string(n:long,m:long,delim:string)

Arguments

n First argument to get (zero is normally the program itself) m Last argument to get (or minus one for all Arguments after n) delim String to use to separate Arguments when more than one.

Description

Returns Arguments from the current process starting with argument number n, up to argument m. If there are less than n Arguments, or the Arguments cannot be retrieved from the current process, the empty string is returned. If m is smaller than n then all Arguments starting from argument n are returned. Argument zero is traditionally the command itself.

function::cmdline_str

function::cmdline_str — Fetch all command line Arguments from current process

Synopsis

cmdline_str:string()

Arguments

None

Description

Returns all Arguments from the current process delimited by spaces. Returns the empty string when the Arguments cannot be retrieved.

function::cpu

function::cpu — Returns the current cpu number

Synopsis

cpu:long()

Arguments

None

Description

This function returns the current cpu number.

function::cpuid

function::cpuid — Returns the current cpu number

Synopsis

cpuid:long()

Arguments

None

Description

This function returns the current cpu number. Deprecated in SystemTap 1.4 and removed in SystemTap 1.5.

function::egid

function::egid — Returns the effective gid of a target process

Synopsis

egid:long()

Arguments

None

Description

This function returns the effective gid of a target process

function::env_var

function::env_var — Fetch environment variable from current process

Synopsis

env_var:string(name:string)

Arguments

name Name of the environment variable to fetch

Description

Returns the contents of the specified environment value for the current process. If the variable isn't set an empty string is returned.

function::euid

function::euid — Return the effective uid of a target process

Synopsis

euid:long()

Arguments

None

Description

Returns the effective user ID of the target process.

function::execname

function::execname — Returns the execname of a target process (or group of processes)

Synopsis

execname:string()

Arguments

None

Description

Returns the execname of a target process (or group of processes).

function::fastcall

function::fastcall — Mark function as declared fastcall

Synopsis

fastcall()

Arguments

None

Description

Call this function before accessing Arguments using the *_arg functions if the probed kernel function was declared fastcall in the source.

function::gid

function::gid — Returns the group ID of a target process

Synopsis

gid:long()

Arguments

None

Description

This function returns the group ID of a target process.

function::int_arg

function::int_arg — Return function argument as signed int

Synopsis

int_arg:long(n:long)

Arguments

nindex of argument to return

Description

Return the value of argument n as a signed int (i.e., a 32-bit integer sign-extended to 64 bits).

function::is_myproc

function::is_myproc — Determines if the current probe point has occurred in the user's own process

Synopsis

is_myproc:long()

Arguments

None

Description

This function returns 1 if the current probe point has occurred in the user's own process.

function::is_return

function::is_return — Whether the current probe context is a return probe

Synopsis

is_return:long()

Arguments

None

Description

Returns 1 if the current probe context is a return probe, returns 0 otherwise.

function::long_arg

function::long_arg — Return function argument as signed long

Synopsis

long_arg:long(n:long)

Arguments

nindex of argument to return

Description

Return the value of argument n as a signed long. On architectures where a long is 32 bits, the value is sign-extended to 64 bits.

function::longlong_arg

function::longlong_arg — Return function argument as 64-bit value

Synopsis

longlong_arg:long(n:long)

Arguments

nindex of argument to return

Description

Return the value of argument n as a 64-bit value.

function::modname

function::modname — Return the kernel module name loaded at the address

Synopsis

modname:string(addr:long)

Arguments

addr The address to map to a kernel module name

Description

Returns the module name associated with the given address if known. If not known it will raise an error. If the address was not in a kernel module, but in the kernel itself, then the string “kernel” will be returned.

function::module_name

function::module_name — The module name of the current script

Synopsis

module_name:string()

Arguments

None

Description

This function returns the name of the stap module. Either generated randomly (stap_[0-9a-f]+_[0-9a-f]+) or set by stap -m <module_name>.

function::ns_egid

function::ns_egid — Returns the effective gid of a target process as seen in a user namespace

Synopsis

ns_egid:long()

Arguments

None

Description

This function returns the effective gid of a target process as seen in the target user namespace if provided, or the stap process namespace

function::ns_euid

function::ns_euid — Returns the effective user ID of a target process as seen in a user namespace

Synopsis

ns_euid:long()

Arguments

None

Description

This function returns the effective user ID of the target process as seen in the target user namespace if provided, or the stap process namespace.

function::ns_gid

function::ns_gid — Returns the group ID of a target process as seen in a user namespace

Synopsis

ns_gid:long()

Arguments

None

Description

This function returns the group ID of a target process as seen in the target user namespace if provided, or the stap process namespace.

function::ns_pgrp

function::ns_pgrp — Returns the process group ID of the current process as seen in a pid namespace

Synopsis

ns_pgrp:long()

Arguments

None

Description

This function returns the process group ID of the current process as seen in the target pid namespace if provided, or the stap process namespace.

function::ns_pid

function::ns_pid — Returns the ID of a target process as seen in a pid namespace

Synopsis

ns_pid:long()

Arguments

None

Description

This function returns the ID of a target process as seen in the target pid namespace.

function::ns_ppid

function::ns_ppid — Returns the process ID of a target process's parent process as seen in a pid namespace

Synopsis

ns_ppid:long()

Arguments

None

Description

This function return the process ID of the target proccess's parent process as seen in the target pid namespace if provided, or the stap process namespace.

function::ns_sid

function::ns_sid — Returns the session ID of the current process as seen in a pid namespace

Synopsis

ns_sid:long()

Arguments

None

Description

The namespace-aware session ID of a process is the process group ID of the session leader as seen in the target pid namespace if provided, or the stap process namespace. Session ID is stored in the signal_struct since Kernel 2.6.0.

function::ns_tid

function::ns_tid — Returns the thread ID of a target process as seen in a pid namespace

Synopsis

ns_tid:long()

Arguments

None

Description

This function returns the thread ID of a target process as seen in the target pid namespace if provided, or the stap process namespace.

function::ns_uid

function::ns_uid — Returns the user ID of a target process as seen in a user namespace

Synopsis

ns_uid:long()

Arguments

None

Description

This function returns the user ID of the target process as seen in the target user namespace if provided, or the stap process namespace.

function::pexecname

function::pexecname — Returns the execname of a target process's parent process

Synopsis

pexecname:string()

Arguments

None

Description

This function returns the execname of a target process's parent procces.

function::pgrp

function::pgrp — Returns the process group ID of the current process

Synopsis

pgrp:long()

Arguments

None

Description

This function returns the process group ID of the current process.

function::pid

function::pid — Returns the ID of a target process

Synopsis

pid:long()

Arguments

None

Description

This function returns the ID of a target process.

function::pid2execname

function::pid2execname — The name of the given process identifier

Synopsis

pid2execname:string(pid:long)

Arguments

pid process identifier

Description

Return the name of the given process id.

function::pid2task

function::pid2task — The task_struct of the given process identifier

Synopsis

pid2task:long(pid:long)

Arguments

pid process identifier

Description

Return the task struct of the given process id.

function::pn

function::pn — Returns the active probe name

Synopsis

pn:string()

Arguments

None

Description

This function returns the script-level probe point associated with a currently running probe handler, including wild-card expansion effects. Context: The current probe point.

function::pnlabel

function::pnlabel — Returns the label name parsed from the probe name

Synopsis

pnlabel:string()

Arguments

None

Description

This returns the label name as parsed from the script-level probe point. This function will only work if called directly from the body of a '.label' probe point (i.e. no aliases).

Context

The current probe point.

function::pointer_arg

function::pointer_arg — Return function argument as pointer value

Synopsis

pointer_arg:long(n:long)

Arguments

nindex of argument to return

Description

Return the unsigned value of argument n, same as ulong_arg. Can be used with any type of pointer.

function::pp

function::pp — Returns the active probe point

Synopsis

pp:string()

Arguments

None

Description

This function returns the fully-resolved probe point associated with a currently running probe handler, including alias and wild-card expansion effects. Context: The current probe point.

function::ppfunc

function::ppfunc — Returns the function name parsed from pp

Synopsis

ppfunc:string()

Arguments

None

Description

This returns the function name from the current pp. Not all pp have functions in them, in which case "" is returned.

function::ppid

function::ppid — Returns the process ID of a target process's parent process

Synopsis

ppid:long()

Arguments

None

Description

This function return the process ID of the target proccess's parent process.

function::print_backtrace

function::print_backtrace — Print kernel stack back trace

Synopsis

print_backtrace()

Arguments

None

Description

This function is equivalent to print_stack(backtrace), except that deeper stack nesting may be supported. See print_ubacktrace for user-space backtrace. The function does not return a value.

function::print_regs

function::print_regs — Print a register dump

Synopsis

print_regs()

Arguments

None

Description

This function prints a register dump. Does nothing if no registers are available for the probe point.

function::print_stack

function::print_stack — Print out kernel stack from string

Synopsis

print_stack(stk:string)

Arguments

stk String with list of hexadecimal addresses

Description

This function performs a symbolic lookup of the addresses in the given string, which is assumed to be the result of a prior call to backtrace. Print one line per address, including the address, the name of the function containing the address, and an estimate of its position within that function. Return nothing.

NOTE

it is recommended to use print_syms instead of this function.

function::print_syms

function::print_syms — Print out kernel stack from string

Synopsis

print_syms(callers:string)

Arguments

callers String with list of hexadecimal (kernel) addresses

Description

This function performs a symbolic lookup of the addresses in the given string, which are assumed to be the result of prior calls to stack, callers, and similar functions. Prints one line per address, including the address, the name of the function containing the address, and an estimate of its position within that function, as obtained by symdata. Returns nothing.

function::print_ubacktrace

function::print_ubacktrace — Print stack back trace for current user-space task.

Synopsis

print_ubacktrace()

Arguments

None

Description

Equivalent to print_ustack(ubacktrace), except that deeper stack nesting may be supported. Returns nothing. See print_backtrace for kernel backtrace.

Note

To get (full) backtraces for user space applications and shared shared libraries not mentioned in the current script run stap with -d /path/to/exe-or-so and/or add --ldd to load all needed unwind data.

function::print_ubacktrace_brief

function::print_ubacktrace_brief — Print stack back trace for current user-space task.

Synopsis

print_ubacktrace_brief()

Arguments

None

Description

Equivalent to print_ubacktrace, but output for each symbol is shorter (just name and offset, or just the hex address of no symbol could be found).

Note

To get (full) backtraces for user space applications and shared shared libraries not mentioned in the current script run stap with -d /path/to/exe-or-so and/or add --ldd to load all needed unwind data.

function::print_ustack

function::print_ustack — Print out stack for the current task from string.

Synopsis

print_ustack(stk:string)

Arguments

stk String with list of hexadecimal addresses for the current task.

Description

Perform a symbolic lookup of the addresses in the given string, which is assumed to be the result of a prior call to ubacktrace for the current task. Print one line per address, including the address, the name of the function containing the address, and an estimate of its position within that function. Return nothing.

NOTE

it is recommended to use print_usyms instead of this function.

function::print_usyms

function::print_usyms — Print out user stack from string

Synopsis

print_usyms(callers:string)

Arguments

callers String with list of hexadecimal (user) addresses

Description

This function performs a symbolic lookup of the addresses in the given string, which are assumed to be the result of prior calls to ustack, ucallers, and similar functions. Prints one line per address, including the address, the name of the function containing the address, and an estimate of its position within that function, as obtained by usymdata. Returns nothing.

function::probe_type

function::probe_type — The low level probe handler type of the current probe.

Synopsis

probe_type:string()

Arguments

None

Description

Returns a short string describing the low level probe handler type for the current probe point. This is for informational purposes only. Depending on the low level probe handler different context functions can or cannot provide information about the current event (for example some probe handlers only trigger in user space and have no associated kernel context). High-level probes might map to the same or different low- level probes (depending on systemtap version and/or kernel used).

function::probefunc

function::probefunc — Return the probe point's function name, if known

Synopsis

probefunc:string()

Arguments

None

Description

This function returns the name of the function being probed based on the current address, as computed by symname(addr) or usymname(uaddr) depending on probe context (whether the probe is a user probe or a kernel probe).

Please note

this function's behaviour differs between SystemTap 2.0 and earlier versions. Prior to 2.0, probefunc obtained the function name from the probe point string as returned by pp, and used the current address as a fallback. Consider using ppfunc instead.

function::probemod

function::probemod — Return the probe point's kernel module name

Synopsis

probemod:string()

Arguments

None

Description

This function returns the name of the kernel module containing the probe point, if known.

function::pstrace

function::pstrace — Chain of processes and pids back to init(1)

Synopsis

pstrace:string(task:long)

Arguments

task Pointer to task struct of process

Description

This function returns a string listing execname and pid for each process starting from task back to the process ancestor that init(1) spawned.

function::register

function::register — Return the signed value of the named CPU register

Synopsis

register:long(name:string)

Arguments

name Name of the register to return

Description

Return the value of the named CPU register, as it was saved when the current probe point was hit. If the register is 32 bits, it is sign-extended to 64 bits. For the i386 architecture, the following names are recognized. (name1/name2 indicates that name1 and name2 are alternative names for the same register.) eax/ax, ebp/bp, ebx/bx, ecx/cx, edi/di, edx/dx, eflags/ flags, eip/ip, esi/si, esp/sp, orig_eax/orig_ax, xcs/cs, xds/ds, xes/es, xfs/fs, xss/ss. For the x86_64 architecture, the following names are recognized: 64-bit registers: r8, r9, r10, r11, r12, r13, r14, r15, rax/ax, rbp/bp, rbx/bx, rcx/cx, rdi/di, rdx/dx, rip/ip, rsi/si, rsp/sp; 32-bit registers: eax, ebp, ebx, ecx, edx, edi, edx, eip, esi, esp, flags/eflags, orig_eax; segment registers: xcs/cs, xss/ss. For powerpc, the following names are recognized: r0, r1, ... r31, nip, msr, orig_gpr3, ctr, link, xer, ccr, softe, trap, dar, dsisr, result. For s390x, the following names are recognized: r0, r1, ... r15, args, psw.mask, psw.addr, orig_gpr2, ilc, trap. For AArch64, the following names are recognized: x0, x1, ... x30, fp, lr, sp, pc, and orig_x0.

function::registers_valid

function::registers_valid — Determines validity of register and u_register in current context

Synopsis

registers_valid:long()

Arguments

None

Description

This function returns 1 if register and u_register can be used in the current context, or 0 otherwise. For example, registers_valid returns 0 when called from a begin or end probe.

function::regparm

function::regparm — Specify regparm value used to compile function

Synopsis

regparm(n:long)

Arguments

noriginal regparm value

Description

Call this function with argument n before accessing function Arguments using the *_arg function is the function was build with the gcc -mregparm=n option. (The i386 kernel is built with -mregparm=3, so systemtap considers regparm(3) the default for kernel functions on that architecture.) Only valid on i386 and x86_64 (when probing 32bit applications). Produces an error on other architectures.

function::remote_id

function::remote_id — The index of this instance in a remote execution.

Synopsis

remote_id:long()

Arguments

None

Description

This function returns a number 0..N, which is the unique index of this particular script execution from a swarm of “stap --remote A --remote B ...” runs, and is the same number “stap --remote-prefix” would print. The function returns -1 if the script was not launched with “stap --remote”, or if the remote staprun/ stapsh are older than version 1.7.

function::remote_uri

function::remote_uri — The name of this instance in a remote execution.

Synopsis

remote_uri:string()

Arguments

None

Description

This function returns the remote host used to invoke this particular script execution from a swarm of “stap --remote” runs. It may not be unique among the swarm. The function returns an empty string if the script was not launched with “stap --remote”.

function::s32_arg

function::s32_arg — Return function argument as signed 32-bit value

Synopsis

s32_arg:long(n:long)

Arguments

nindex of argument to return

Description

Return the signed 32-bit value of argument n, same as int_arg.

function::s64_arg

function::s64_arg — Return function argument as signed 64-bit value

Synopsis

s64_arg:long(n:long)

Arguments

nindex of argument to return

Description

Return the signed 64-bit value of argument n, same as longlong_arg.

function::sid

function::sid — Returns the session ID of the current process

Synopsis

sid:long()

Arguments

None

Description

The session ID of a process is the process group ID of the session leader. Session ID is stored in the signal_struct since Kernel 2.6.0.

function::sprint_backtrace

function::sprint_backtrace — Return stack back trace as string

Synopsis

sprint_backtrace:string()

Arguments

None

Description

Returns a simple (kernel) backtrace. One line per address. Includes the symbol name (or hex address if symbol couldn't be resolved) and module name (if found). Includes the offset from the start of the function if found, otherwise the offset will be added to the module (if found, between brackets). Returns the backtrace as string (each line terminated by a newline character). Note that the returned stack will be truncated to MAXSTRINGLEN, to print fuller and richer stacks use print_backtrace. Equivalent to sprint_stack(backtrace), but more efficient (no need to translate between hex strings and final backtrace string).

function::sprint_stack

function::sprint_stack — Return stack for kernel addresses from string

Synopsis

sprint_stack:string(stk:string)

Arguments

stk String with list of hexadecimal (kernel) addresses

Description

Perform a symbolic lookup of the addresses in the given string, which is assumed to be the result of a prior call to backtrace. Returns a simple backtrace from the given hex string. One line per address. Includes the symbol name (or hex address if symbol couldn't be resolved) and module name (if found). Includes the offset from the start of the function if found, otherwise the offset will be added to the module (if found, between brackets). Returns the backtrace as string (each line terminated by a newline character). Note that the returned stack will be truncated to MAXSTRINGLEN, to print fuller and richer stacks use print_stack.

NOTE

it is recommended to use sprint_syms instead of this function.

function::sprint_syms

function::sprint_syms — Return stack for kernel addresses from string

Synopsis

sprint_syms(callers:string)

Arguments

callers String with list of hexadecimal (kernel) addresses

Description

Perform a symbolic lookup of the addresses in the given string, which are assumed to be the result of a prior calls to stack, callers, and similar functions. Returns a simple backtrace from the given hex string. One line per address. Includes the symbol name (or hex address if symbol couldn't be resolved) and module name (if found), as obtained from symdata. Includes the offset from the start of the function if found, otherwise the offset will be added to the module (if found, between brackets). Returns the backtrace as string (each line terminated by a newline character). Note that the returned stack will be truncated to MAXSTRINGLEN, to print fuller and richer stacks use print_syms.

function::sprint_ubacktrace

function::sprint_ubacktrace — Return stack back trace for current user-space task as string.

Synopsis

sprint_ubacktrace:string()

Arguments

None

Description

Returns a simple backtrace for the current task. One line per address. Includes the symbol name (or hex address if symbol couldn't be resolved) and module name (if found). Includes the offset from the start of the function if found, otherwise the offset will be added to the module (if found, between brackets). Returns the backtrace as string (each line terminated by a newline character). Note that the returned stack will be truncated to MAXSTRINGLEN, to print fuller and richer stacks use print_ubacktrace. Equivalent to sprint_ustack(ubacktrace), but more efficient (no need to translate between hex strings and final backtrace string).

Note

To get (full) backtraces for user space applications and shared shared libraries not mentioned in the current script run stap with -d /path/to/exe-or-so and/or add --ldd to load all needed unwind data.

function::sprint_ustack

function::sprint_ustack — Return stack for the current task from string.

Synopsis

sprint_ustack:string(stk:string)

Arguments

stk String with list of hexadecimal addresses for the current task.

Description

Perform a symbolic lookup of the addresses in the given string, which is assumed to be the result of a prior call to ubacktrace for the current task. Returns a simple backtrace from the given hex string. One line per address. Includes the symbol name (or hex address if symbol couldn't be resolved) and module name (if found). Includes the offset from the start of the function if found, otherwise the offset will be added to the module (if found, between brackets). Returns the backtrace as string (each line terminated by a newline character). Note that the returned stack will be truncated to MAXSTRINGLEN, to print fuller and richer stacks use print_ustack.

NOTE

it is recommended to use sprint_usyms instead of this function.

function::sprint_usyms

function::sprint_usyms — Return stack for user addresses from string

Synopsis

sprint_usyms(callers:string)

Arguments

callers String with list of hexadecimal (user) addresses

Description

Perform a symbolic lookup of the addresses in the given string, which are assumed to be the result of a prior calls to ustack, ucallers, and similar functions. Returns a simple backtrace from the given hex string. One line per address. Includes the symbol name (or hex address if symbol couldn't be resolved) and module name (if found), as obtained from usymdata. Includes the offset from the start of the function if found, otherwise the offset will be added to the module (if found, between brackets). Returns the backtrace as string (each line terminated by a newline character). Note that the returned stack will be truncated to MAXSTRINGLEN, to print fuller and richer stacks use print_usyms.

function::stack

function::stack — Return address at given depth of kernel stack backtrace

Synopsis

stack:long(n:long)

Arguments

nnumber of levels to descend in the stack.

Description

Performs a simple (kernel) backtrace, and returns the element at the specified position. The results of the backtrace itself are cached, so that the backtrace computation is performed at most once no matter how many times stack is called, or in what order.

function::stack_size

function::stack_size — Return the size of the kernel stack

Synopsis

stack_size:long()

Arguments

None

Description

This function returns the size of the kernel stack.

function::stack_unused

function::stack_unused — Returns the amount of kernel stack currently available

Synopsis

stack_unused:long()

Arguments

None

Description

This function determines how many bytes are currently available in the kernel stack.

function::stack_used

function::stack_used — Returns the amount of kernel stack used

Synopsis

stack_used:long()

Arguments

None

Description

This function determines how many bytes are currently used in the kernel stack.

function::stp_pid

function::stp_pid — The process id of the stapio process

Synopsis

stp_pid:long()

Arguments

None

Description

This function returns the process id of the stapio process that launched this script. There could be other SystemTap scripts and stapio processes running on the system.

function::symdata

function::symdata — Return the kernel symbol and module offset for the address

Synopsis

symdata:string(addr:long)

Arguments

addr The address to translate

Description

Returns the (function) symbol name associated with the given address if known, the offset from the start and size of the symbol, plus module name (between brackets). If symbol is unknown, but module is known, the offset inside the module, plus the size of the module is added. If any element is not known it will be omitted and if the symbol name is unknown it will return the hex string for the given address.

function::symfile

function::symfile — Return the file name of a given address.

Synopsis

symfile:string(addr:long)

Arguments

addr The address to translate.

Description

Returns the file name of the given address, if known. If the file name cannot be found, the hex string representation of the address will be returned.

function::symfileline

function::symfileline — Return the file name and line number of an address.

Synopsis

symfileline:string(addr:long)

Arguments

addr The address to translate.

Description

Returns the file name and the (approximate) line number of the given address, if known. If the file name or the line number cannot be found, the hex string representation of the address will be returned.

function::symline

function::symline — Return the line number of an address.

Synopsis

symline:string(addr:long)

Arguments

addr The address to translate.

Description

Returns the (approximate) line number of the given address, if known. If the line number cannot be found, the hex string representation of the address will be returned.

function::symname

function::symname — Return the kernel symbol associated with the given address

Synopsis

symname:string(addr:long)

Arguments

addr The address to translate

Description

Returns the (function) symbol name associated with the given address if known. If not known it will return the hex string representation of addr.

function::target

function::target — Return the process ID of the target process

Synopsis

target:long()

Arguments

None

Description

This function returns the process ID of the target process. This is useful in conjunction with the -x PID or -c CMD command-line options to stap. An example of its use is to create scripts that filter on a specific process. -x <pid> target returns the pid specified by -x -c <command> target returns the pid for the executed command specified by -c

function::task_ancestry

function::task_ancestry — The ancestry of the given task

Synopsis

task_ancestry:string(task:long,with_time:long)

Arguments

task task_struct pointer with_time set to 1 to also print the start time of processes (given as a delta from boot time)

Description

Return the ancestry of the given task in the form of “grandparent_process=>parent_process=>process”.

function::task_backtrace

function::task_backtrace — Hex backtrace of an arbitrary task

Synopsis

task_backtrace:string(task:long)

Arguments

task pointer to task_struct

Description

This function returns a string of hex addresses that are a backtrace of the stack of a particular task Output may be truncated as per maximum string length. Deprecated in SystemTap 1.6.

function::task_cpu

function::task_cpu — The scheduled cpu of the task

Synopsis

task_cpu:long(task:long)

Arguments

task task_struct pointer

Description

This function returns the scheduled cpu for the given task.

function::task_current

function::task_current — The current task_struct of the current task

Synopsis

task_current:long()

Arguments

None

Description

This function returns the task_struct representing the current process. This address can be passed to the various task_*() functions to extract more task-specific data.

function::task_egid

function::task_egid — The effective group identifier of the task

Synopsis

task_egid:long(task:long)

Arguments

task task_struct pointer

Description

This function returns the effective group id of the given task.

function::task_euid

function::task_euid — The effective user identifier of the task

Synopsis

task_euid:long(task:long)

Arguments

task task_struct pointer

Description

This function returns the effective user id of the given task.

function::task_execname

function::task_execname — The name of the task

Synopsis

task_execname:string(task:long)

Arguments

task task_struct pointer

Description

Return the name of the given task.

function::task_fd_lookup

function::task_fd_lookup — get the file struct for a task's fd

Synopsis

task_fd_lookup:long(task:long,fd:long)

Arguments

task task_struct pointer. fd file descriptor number.

Description

Returns the file struct pointer for a task's file descriptor.

function::task_gid

function::task_gid — The group identifier of the task

Synopsis

task_gid:long(task:long)

Arguments

task task_struct pointer

Description

This function returns the group id of the given task.

function::task_max_file_handles

function::task_max_file_handles — The max number of open files for the task

Synopsis

task_max_file_handles:long(task:long)

Arguments

task task_struct pointer

Description

This function returns the maximum number of file handlers for the given task.

function::task_nice

function::task_nice — The nice value of the task

Synopsis

task_nice:long(task:long)

Arguments

task task_struct pointer

Description

This function returns the nice value of the given task.

function::task_ns_egid

function::task_ns_egid — The effective group identifier of the task

Synopsis

task_ns_egid:long(task:long)

Arguments

task task_struct pointer

Description

This function returns the effective group id of the given task.

function::task_ns_euid

function::task_ns_euid — The effective user identifier of the task

Synopsis

task_ns_euid:long(task:long)

Arguments

task task_struct pointer

Description

This function returns the effective user id of the given task.

function::task_ns_gid

function::task_ns_gid — The group identifier of the task as seen in a namespace

Synopsis

task_ns_gid:long(task:long)

Arguments

task task_struct pointer

Description

This function returns the group id of the given task as seen in in the given user namespace.

function::task_ns_pid

function::task_ns_pid — The process identifier of the task

Synopsis

task_ns_pid:long(task:long)

Arguments

task task_struct pointer

Description

This fucntion returns the process id of the given task based on the specified pid namespace..

function::task_ns_tid

function::task_ns_tid — The thread identifier of the task as seen in a namespace

Synopsis

task_ns_tid:long(task:long)

Arguments

task task_struct pointer

Description

This function returns the thread id of the given task as seen in the pid namespace.

function::task_ns_uid

function::task_ns_uid — The user identifier of the task

Synopsis

task_ns_uid:long(task:long)

Arguments

task task_struct pointer

Description

This function returns the user id of the given task.

function::task_open_file_handles

function::task_open_file_handles — The number of open files of the task

Synopsis

task_open_file_handles:long(task:long)

Arguments

task task_struct pointer

Description

This function returns the number of open file handlers for the given task.

function::task_parent

function::task_parent — The task_struct of the parent task

Synopsis

task_parent:long(task:long)

Arguments

task task_struct pointer

Description

This function returns the parent task_struct of the given task. This address can be passed to the various task_*() functions to extract more task-specific data.

function::task_pid

function::task_pid — The process identifier of the task

Synopsis

task_pid:long(task:long)

Arguments

task task_struct pointer

Description

This fucntion returns the process id of the given task.

function::task_prio

function::task_prio — The priority value of the task

Synopsis

task_prio:long(task:long)

Arguments

task task_struct pointer

Description

This function returns the priority value of the given task.

function::task_state

function::task_state — The state of the task

Synopsis

task_state:long(task:long)

Arguments

task task_struct pointer

Description

Return the state of the given task, one of: TASK_RUNNING (0), TASK_INTERRUPTIBLE (1), TASK_UNINTERRUPTIBLE (2), TASK_STOPPED (4), TASK_TRACED (8), EXIT_ZOMBIE (16), or EXIT_DEAD (32).

function::task_tid

function::task_tid — The thread identifier of the task

Synopsis

task_tid:long(task:long)

Arguments

task task_struct pointer

Description

This function returns the thread id of the given task.

function::task_uid

function::task_uid — The user identifier of the task

Synopsis

task_uid:long(task:long)

Arguments

task task_struct pointer

Description

This function returns the user id of the given task.

function::tid

function::tid — Returns the thread ID of a target process

Synopsis

tid:long()

Arguments

None

Description

This function returns the thread ID of the target process.

function::u32_arg

function::u32_arg — Return function argument as unsigned 32-bit value

Synopsis

u32_arg:long(n:long)

Arguments

nindex of argument to return

Description

Return the unsigned 32-bit value of argument n, same as uint_arg.

function::u64_arg

function::u64_arg — Return function argument as unsigned 64-bit value

Synopsis

u64_arg:long(n:long)

Arguments

nindex of argument to return

Description

Return the unsigned 64-bit value of argument n, same as ulonglong_arg.

function::u_register

function::u_register — Return the unsigned value of the named CPU register

Synopsis

u_register:long(name:string)

Arguments

name Name of the register to return

Description

Same as register(name), except that if the register is 32 bits wide, it is zero-extended to 64 bits.

function::uaddr

function::uaddr — User space address of current running task

Synopsis

uaddr:long()

Arguments

None

Description

Returns the address in userspace that the current task was at when the probe occurred. When the current running task isn't a user space thread, or the address cannot be found, zero is returned. Can be used to see where the current task is combined with usymname or usymdata. Often the task will be in the VDSO where it entered the kernel.

function::ubacktrace

function::ubacktrace — Hex backtrace of current user-space task stack.

Synopsis

ubacktrace:string()

Arguments

None

Description

Return a string of hex addresses that are a backtrace of the stack of the current task. Output may be truncated as per maximum string length. Returns empty string when current probe point cannot determine user backtrace. See backtrace for kernel traceback.

Note

To get (full) backtraces for user space applications and shared shared libraries not mentioned in the current script run stap with -d /path/to/exe-or-so and/or add --ldd to load all needed unwind data.

function::ucallers

function::ucallers — Return first n elements of user stack backtrace

Synopsis

ucallers:string(n:long)

Arguments

nnumber of levels to descend in the stack (not counting the top level). If n is -1, print the entire stack.

Description

This function returns a string of the first n hex addresses from the backtrace of the user stack. Output may be truncated as per maximum string length (MAXSTRINGLEN).

Note

To get (full) backtraces for user space applications and shared shared libraries not mentioned in the current script run stap with -d /path/to/exe-or-so and/or add --ldd to load all needed unwind data.

function::uid

function::uid — Returns the user ID of a target process

Synopsis

uid:long()

Arguments

None

Description

This function returns the user ID of the target process.

function::uint_arg

function::uint_arg — Return function argument as unsigned int

Synopsis

uint_arg:long(n:long)

Arguments

nindex of argument to return

Description

Return the value of argument n as an unsigned int (i.e., a 32-bit integer zero-extended to 64 bits).

function::ulong_arg

function::ulong_arg — Return function argument as unsigned long

Synopsis

ulong_arg:long(n:long)

Arguments

nindex of argument to return

Description

Return the value of argument n as an unsigned long. On architectures where a long is 32 bits, the value is zero-extended to 64 bits.

function::ulonglong_arg

function::ulonglong_arg — Return function argument as 64-bit value

Synopsis

ulonglong_arg:long(n:long)

Arguments

nindex of argument to return

Description

Return the value of argument n as a 64-bit value. (Same as longlong_arg.)

function::umodname

function::umodname — Returns the (short) name of the user module.

Synopsis

umodname:string(addr:long)

Arguments

addr User-space address

Description

Returns the short name of the user space module for the current task that that the given address is part of. Reports an error when the address isn't in a (mapped in) module, or the module cannot be found for some reason.

function::user_mode

function::user_mode — Determines if probe point occurs in user-mode

Synopsis

user_mode:long()

Arguments

None

Description

Return 1 if the probe point occurred in user-mode.

function::ustack

function::ustack — Return address at given depth of user stack backtrace

Synopsis

ustack:long(n:long)

Arguments

nnumber of levels to descend in the stack.

Description

Performs a simple (user space) backtrace, and returns the element at the specified position. The results of the backtrace itself are cached, so that the backtrace computation is performed at most once no matter how many times ustack is called, or in what order.

function::usymdata

function::usymdata — Return the symbol and module offset of an address.

Synopsis

usymdata:string(addr:long)

Arguments

addr The address to translate.

Description

Returns the (function) symbol name associated with the given address in the current task if known, the offset from the start and the size of the symbol, plus the module name (between brackets). If symbol is unknown, but module is known, the offset inside the module, plus the size of the module is added. If any element is not known it will be omitted and if the symbol name is unknown it will return the hex string for the given address.

function::usymfile

function::usymfile — Return the file name of a given address.

Synopsis

usymfile:string(addr:long)

Arguments

addr The address to translate.

Description

Returns the file name of the given address, if known. If the file name cannot be found, the hex string representation of the address will be returned.

function::usymfileline

function::usymfileline — Return the file name and line number of an address.

Synopsis

usymfileline:string(addr:long)

Arguments

addr The address to translate.

Description

Returns the file name and the (approximate) line number of the given address, if known. If the file name or the line number cannot be found, the hex string representation of the address will be returned.

function::usymline

function::usymline — Return the line number of an address.

Synopsis

usymline:string(addr:long)

Arguments

addr The address to translate.

Description

Returns the (approximate) line number of the given address, if known. If the line number cannot be found, the hex string representation of the address will be returned.

function::usymname

function::usymname — Return the symbol of an address in the current task.

Synopsis

usymname:string(addr:long)

Arguments

addr The address to translate.

Description

Returns the (function) symbol name associated with the given address if known. If not known it will return the hex string representation of addr.

Chapter 3. Timestamp Functions

Each timestamp function returns a value to indicate when a function is executed. These returned values can then be used to indicate when an event occurred, provide an ordering for events, or compute the amount of time elapsed between two time stamps.

function::HZ

function::HZ — Kernel HZ

Synopsis

HZ:long()

Arguments

None

Description

This function returns the value of the kernel HZ macro, which corresponds to the rate of increase of the jiffies value.

function::cpu_clock_ms

function::cpu_clock_ms — Number of milliseconds on the given cpu's clock

Synopsis

cpu_clock_ms:long(cpu:long)

Arguments

cpu Which processor's clock to read

Description

This function returns the number of milliseconds on the given cpu's clock. This is always monotonic comparing on the same cpu, but may have some drift between cpus (within about a jiffy).

function::cpu_clock_ns

function::cpu_clock_ns — Number of nanoseconds on the given cpu's clock

Synopsis

cpu_clock_ns:long(cpu:long)

Arguments

cpu Which processor's clock to read

Description

This function returns the number of nanoseconds on the given cpu's clock. This is always monotonic comparing on the same cpu, but may have some drift between cpus (within about a jiffy).

function::cpu_clock_s

function::cpu_clock_s — Number of seconds on the given cpu's clock

Synopsis

cpu_clock_s:long(cpu:long)

Arguments

cpu Which processor's clock to read

Description

This function returns the number of seconds on the given cpu's clock. This is always monotonic comparing on the same cpu, but may have some drift between cpus (within about a jiffy).

function::cpu_clock_us

function::cpu_clock_us — Number of microseconds on the given cpu's clock

Synopsis

cpu_clock_us:long(cpu:long)

Arguments

cpu Which processor's clock to read

Description

This function returns the number of microseconds on the given cpu's clock. This is always monotonic comparing on the same cpu, but may have some drift between cpus (within about a jiffy).

function::delete_stopwatch

function::delete_stopwatch — Remove an existing stopwatch

Synopsis

delete_stopwatch(name:string)

Arguments

name the stopwatch name

Description

Remove stopwatch name.

function::get_cycles

function::get_cycles — Processor cycle count

Synopsis

get_cycles:long()

Arguments

None

Description

This function returns the processor cycle counter value if available, else it returns zero. The cycle counter is free running and unsynchronized on each processor. Thus, the order of events cannot determined by comparing the results of the get_cycles function on different processors.

function::gettimeofday_ms

function::gettimeofday_ms — Number of milliseconds since UNIX epoch

Synopsis

gettimeofday_ms:long()

Arguments

None

Description

This function returns the number of milliseconds since the UNIX epoch.

function::gettimeofday_ns

function::gettimeofday_ns — Number of nanoseconds since UNIX epoch

Synopsis

gettimeofday_ns:long()

Arguments

None

Description

This function returns the number of nanoseconds since the UNIX epoch.

function::gettimeofday_s

function::gettimeofday_s — Number of seconds since UNIX epoch

Synopsis

gettimeofday_s:long()

Arguments

None

Description

This function returns the number of seconds since the UNIX epoch.

function::gettimeofday_us

function::gettimeofday_us — Number of microseconds since UNIX epoch

Synopsis

gettimeofday_us:long()

Arguments

None

Description

This function returns the number of microseconds since the UNIX epoch.

function::jiffies

function::jiffies — Kernel jiffies count

Synopsis

jiffies:long()

Arguments

None

Description

This function returns the value of the kernel jiffies variable. This value is incremented periodically by timer interrupts, and may wrap around a 32-bit or 64-bit boundary. See HZ.

function::local_clock_ms

function::local_clock_ms — Number of milliseconds on the local cpu's clock

Synopsis

local_clock_ms:long()

Arguments

None

Description

This function returns the number of milliseconds on the local cpu's clock. This is always monotonic comparing on the same cpu, but may have some drift between cpus (within about a jiffy).

function::local_clock_ns

function::local_clock_ns — Number of nanoseconds on the local cpu's clock

Synopsis

local_clock_ns:long()

Arguments

None

Description

This function returns the number of nanoseconds on the local cpu's clock. This is always monotonic comparing on the same cpu, but may have some drift between cpus (within about a jiffy).

function::local_clock_s

function::local_clock_s — Number of seconds on the local cpu's clock

Synopsis

local_clock_s:long()

Arguments

None

Description

This function returns the number of seconds on the local cpu's clock. This is always monotonic comparing on the same cpu, but may have some drift between cpus (within about a jiffy).

function::local_clock_us

function::local_clock_us — Number of microseconds on the local cpu's clock

Synopsis

local_clock_us:long()

Arguments

None

Description

This function returns the number of microseconds on the local cpu's clock. This is always monotonic comparing on the same cpu, but may have some drift between cpus (within about a jiffy).

function::read_stopwatch_ms

function::read_stopwatch_ms — Reads the time in milliseconds for a stopwatch

Synopsis

read_stopwatch_ms:long(name:string)

Arguments

name stopwatch name

Description

Returns time in milliseconds for stopwatch name. Creates stopwatch name if it does not currently exist.

function::read_stopwatch_ns

function::read_stopwatch_ns — Reads the time in nanoseconds for a stopwatch

Synopsis

read_stopwatch_ns:long(name:string)

Arguments

name stopwatch name

Description

Returns time in nanoseconds for stopwatch name. Creates stopwatch name if it does not currently exist.

function::read_stopwatch_s

function::read_stopwatch_s — Reads the time in seconds for a stopwatch

Synopsis

read_stopwatch_s:long(name:string)

Arguments

name stopwatch name

Description

Returns time in seconds for stopwatch name. Creates stopwatch name if it does not currently exist.

function::read_stopwatch_us

function::read_stopwatch_us — Reads the time in microseconds for a stopwatch

Synopsis

read_stopwatch_us:long(name:string)

Arguments

name stopwatch name

Description

Returns time in microseconds for stopwatch name. Creates stopwatch name if it does not currently exist.

function::start_stopwatch

function::start_stopwatch — Start a stopwatch

Synopsis

start_stopwatch(name:string)

Arguments

name the stopwatch name

Description

Start stopwatch name. Creates stopwatch name if it does not currently exist.

function::stop_stopwatch

function::stop_stopwatch — Stop a stopwatch

Synopsis

stop_stopwatch(name:string)

Arguments

name the stopwatch name

Description

Stop stopwatch name. Creates stopwatch name if it does not currently exist.

Chapter 4. Time utility functions

Utility functions to turn seconds since the epoch (as returned by the timestamp function gettimeofday_s()) into a human readable date/time strings.

function::ctime

function::ctime — Convert seconds since epoch into human readable date/time string

Synopsis

ctime:string(epochsecs:long)

Arguments

epochsecs Number of seconds since epoch (as returned by gettimeofday_s)

Description

Takes an argument of seconds since the epoch as returned by gettimeofday_s. Returns a string of the form “Wed Jun 30 21:49:08 1993” The string will always be exactly 24 characters. If the time would be unreasonable far in the past (before what can be represented with a 32 bit offset in seconds from the epoch) an error will occur (which can be avoided with try/catch). If the time would be unreasonable far in the future, an error will also occur. Note that the epoch (zero) corresponds to “Thu Jan 1 00:00:00 1970” The earliest full date given by ctime, corresponding to epochsecs -2147483648 is “Fri Dec 13 20:45:52 1901”. The latest full date given by ctime, corresponding to epochsecs 2147483647 is “Tue Jan 19 03:14:07 2038”. The abbreviations for the days of the week are ‘Sun’, ‘Mon’, ‘Tue’, ‘Wed’, ‘Thu’, ‘Fri’, and ‘Sat’. The abbreviations for the months are ‘Jan’, ‘Feb’, ‘Mar’, ‘Apr’, ‘May’, ‘Jun’, ‘Jul’, ‘Aug’, ‘Sep’, ‘Oct’, ‘Nov’, and ‘Dec’. Note that the real C library ctime function puts a newline ('\n') character at the end of the string that this function does not. Also note that since the kernel has no concept of timezones, the returned time is always in GMT.

function::tz_ctime

function::tz_ctime — Convert seconds since epoch into human readable date/time string, with local time zone

Synopsis

tz_ctime(epochsecs:)

Arguments

epochsecs number of seconds since epoch (as returned by gettimeofday_s)

Description

Takes an argument of seconds since the epoch as returned by gettimeofday_s. Returns a string of the same form as ctime, but offsets the epoch time for the local time zone, and appends the name of the local time zone. The string length may vary. The time zone information is passed by staprun at script startup only.

function::tz_gmtoff

function::tz_gmtoff — Return local time zone offset

Synopsis

tz_gmtoff()

Arguments

None

Description

Returns the local time zone offset (seconds west of UTC), as passed by staprun at script startup only.

function::tz_name

function::tz_name — Return local time zone name

Synopsis

tz_name()

Arguments

None

Description

Returns the local time zone name, as passed by staprun at script startup only.

Chapter 5. Shell command functions

Utility functions to enqueue shell commands.

function::system

function::system — Issue a command to the system

Synopsis

system(cmd:string)

Arguments

cmd the command to issue to the system

Description

This function runs a command on the system. The command is started in the background some time after the current probe completes. The command is run with the same UID as the user running the stap or staprun command.

Chapter 6. Memory Tapset

This family of probe points is used to probe memory-related events or query the memory usage of the current process. It contains the following probe points:

function::addr_to_node

function::addr_to_node — Returns which node a given address belongs to within a NUMA system

Synopsis

addr_to_node:long(addr:long)

Arguments

addr the address of the faulting memory access

Description

This function accepts an address, and returns the node that the given address belongs to in a NUMA system.

function::bytes_to_string

function::bytes_to_string — Human readable string for given bytes

Synopsis

bytes_to_string:string(bytes:long)

Arguments

bytes Number of bytes to translate.

Description

Returns a string representing the number of bytes (up to 1024 bytes), the number of kilobytes (when less than 1024K) postfixed by 'K', the number of megabytes (when less than 1024M) postfixed by 'M' or the number of gigabytes postfixed by 'G'. If representing K, M or G, and the number is amount is less than 100, it includes a '.' plus the remainer. The returned string will be 5 characters wide (padding with whitespace at the front) unless negative or representing more than 9999G bytes.

function::mem_page_size

function::mem_page_size — Number of bytes in a page for this architecture

Synopsis

mem_page_size:long()

Arguments

None

function::pages_to_string

function::pages_to_string — Turns pages into a human readable string

Synopsis

pages_to_string:string(pages:long)

Arguments

pages Number of pages to translate.

Description

Multiplies pages by page_size to get the number of bytes and returns the result of bytes_to_string.

function::proc_mem_data

function::proc_mem_data — Program data size (data + stack) in pages

Synopsis

proc_mem_data:long()

Arguments

None

Description

Returns the current process data size (data + stack) in pages, or zero when there is no current process or the number of pages couldn't be retrieved.

function::proc_mem_data_pid

function::proc_mem_data_pid — Program data size (data + stack) in pages

Synopsis

proc_mem_data_pid:long(pid:long)

Arguments

pid The pid of process to examine

Description

Returns the given process data size (data + stack) in pages, or zero when the process doesn't exist or the number of pages couldn't be retrieved.

function::proc_mem_rss

function::proc_mem_rss — Program resident set size in pages

Synopsis

proc_mem_rss:long()

Arguments

None

Description

Returns the resident set size in pages of the current process, or zero when there is no current process or the number of pages couldn't be retrieved.

function::proc_mem_rss_pid

function::proc_mem_rss_pid — Program resident set size in pages

Synopsis

proc_mem_rss_pid:long(pid:long)

Arguments

pid The pid of process to examine

Description

Returns the resident set size in pages of the given process, or zero when the process doesn't exist or the number of pages couldn't be retrieved.

function::proc_mem_shr

function::proc_mem_shr — Program shared pages (from shared mappings)

Synopsis

proc_mem_shr:long()

Arguments

None

Description

Returns the shared pages (from shared mappings) of the current process, or zero when there is no current process or the number of pages couldn't be retrieved.

function::proc_mem_shr_pid

function::proc_mem_shr_pid — Program shared pages (from shared mappings)

Synopsis

proc_mem_shr_pid:long(pid:long)

Arguments

pid The pid of process to examine

Description

Returns the shared pages (from shared mappings) of the given process, or zero when the process doesn't exist or the number of pages couldn't be retrieved.

function::proc_mem_size

function::proc_mem_size — Total program virtual memory size in pages

Synopsis

proc_mem_size:long()

Arguments

None

Description

Returns the total virtual memory size in pages of the current process, or zero when there is no current process or the number of pages couldn't be retrieved.

function::proc_mem_size_pid

function::proc_mem_size_pid — Total program virtual memory size in pages

Synopsis

proc_mem_size_pid:long(pid:long)

Arguments

pid The pid of process to examine

Description

Returns the total virtual memory size in pages of the given process, or zero when that process doesn't exist or the number of pages couldn't be retrieved.

function::proc_mem_string

function::proc_mem_string — Human readable string of current proc memory usage

Synopsis

proc_mem_string:string()

Arguments

None

Description

Returns a human readable string showing the size, rss, shr, txt and data of the memory used by the current process. For example “size: 301m, rss: 11m, shr: 8m, txt: 52k, data: 2248k”.

function::proc_mem_string_pid

function::proc_mem_string_pid — Human readable string of process memory usage

Synopsis

proc_mem_string_pid:string(pid:long)

Arguments

pid The pid of process to examine

Description

Returns a human readable string showing the size, rss, shr, txt and data of the memory used by the given process. For example “size: 301m, rss: 11m, shr: 8m, txt: 52k, data: 2248k”.

function::proc_mem_txt

function::proc_mem_txt — Program text (code) size in pages

Synopsis

proc_mem_txt:long()

Arguments

None

Description

Returns the current process text (code) size in pages, or zero when there is no current process or the number of pages couldn't be retrieved.

function::proc_mem_txt_pid

function::proc_mem_txt_pid — Program text (code) size in pages

Synopsis

proc_mem_txt_pid:long(pid:long)

Arguments

pid The pid of process to examine

Description

Returns the given process text (code) size in pages, or zero when the process doesn't exist or the number of pages couldn't be retrieved.

function::vm_fault_contains

function::vm_fault_contains — Test return value for page fault reason

Synopsis

vm_fault_contains:long(value:long,test:long)

Arguments

value the fault_type returned by vm.page_fault.return test the type of fault to test for (VM_FAULT_OOM or similar)

probe::vm.brk

probe::vm.brk — Fires when a brk is requested (i.e. the heap will be resized)

Synopsis

vm.brk

Values

name name of the probe point address the requested address length the length of the memory segment

Context

The process calling brk.

probe::vm.kfree

probe::vm.kfree — Fires when kfree is requested

Synopsis

vm.kfree

Values

name name of the probe point call_site address of the function calling this kmemory function caller_function name of the caller function. ptr pointer to the kmemory allocated which is returned by kmalloc

probe::vm.kmalloc

probe::vm.kmalloc — Fires when kmalloc is requested

Synopsis

vm.kmalloc

Values

gfp_flags type of kmemory to allocate bytes_alloc allocated Bytes bytes_req requested Bytes ptr pointer to the kmemory allocated gfp_flag_name type of kmemory to allocate (in String format) name name of the probe point call_site address of the kmemory function caller_function name of the caller function

probe::vm.kmalloc_node

probe::vm.kmalloc_node — Fires when kmalloc_node is requested

Synopsis

vm.kmalloc_node

Values

ptr pointer to the kmemory allocated bytes_req requested Bytes bytes_alloc allocated Bytes gfp_flags type of kmemory to allocate caller_function name of the caller function call_site address of the function caling this kmemory function name name of the probe point gfp_flag_name type of kmemory to allocate(in string format)

probe::vm.kmem_cache_alloc

probe::vm.kmem_cache_alloc — Fires when kmem_cache_alloc is requested

Synopsis

vm.kmem_cache_alloc

Values

gfp_flags type of kmemory to allocate bytes_alloc allocated Bytes bytes_req requested Bytes ptr pointer to the kmemory allocated gfp_flag_name type of kmemory to allocate(in string format) name name of the probe point caller_function name of the caller function. call_site address of the function calling this kmemory function.

probe::vm.kmem_cache_alloc_node

probe::vm.kmem_cache_alloc_node — Fires when kmem_cache_alloc_node is requested

Synopsis

vm.kmem_cache_alloc_node

Values

name name of the probe point gfp_flag_name type of kmemory to allocate(in string format) call_site address of the function calling this kmemory function caller_function name of the caller function bytes_alloc allocated Bytes gfp_flags type of kmemory to allocate ptr pointer to the kmemory allocated bytes_req requested Bytes

probe::vm.kmem_cache_free

probe::vm.kmem_cache_free — Fires when kmem_cache_free is requested

Synopsis

vm.kmem_cache_free

Values

name Name of the probe point caller_function Name of the caller function. call_site Address of the function calling this kmemory function ptr Pointer to the kmemory allocated which is returned by kmem_cache

probe::vm.mmap

probe::vm.mmap — Fires when an mmap is requested

Synopsis

vm.mmap

Values

length the length of the memory segment name name of the probe point address the requested address

Context

The process calling mmap.

probe::vm.munmap

probe::vm.munmap — Fires when an munmap is requested

Synopsis

vm.munmap

Values

length the length of the memory segment name name of the probe point address the requested address

Context

The process calling munmap.

probe::vm.oom_kill

probe::vm.oom_kill — Fires when a thread is selected for termination by the OOM killer

Synopsis

vm.oom_kill

Values

name name of the probe point task the task being killed

Context

The process that tried to consume excessive memory, and thus triggered the OOM.

probe::vm.pagefault

probe::vm.pagefault — Records that a page fault occurred

Synopsis

vm.pagefault

Values

address the address of the faulting memory access; i.e. the address that caused the page fault name name of the probe point write_access indicates whether this was a write or read access; 1 indicates a write, while 0 indicates a read

Context

The process which triggered the fault

probe::vm.pagefault.return

probe::vm.pagefault.return — Indicates what type of fault occurred

Synopsis

vm.pagefault.return

Values

fault_type returns either 0 (VM_FAULT_OOM) for out of memory faults, 2 (VM_FAULT_MINOR) for minor faults, 3 (VM_FAULT_MAJOR) for major faults, or 1 (VM_FAULT_SIGBUS) if the fault was neither OOM, minor fault, nor major fault. name name of the probe point

probe::vm.write_shared

probe::vm.write_shared — Attempts at writing to a shared page

Synopsis

vm.write_shared

Values

address the address of the shared write name name of the probe point

Context

The context is the process attempting the write.

Description

Fires when a process attempts to write to a shared page. If a copy is necessary, this will be followed by a vm.write_shared_copy.

probe::vm.write_shared_copy

probe::vm.write_shared_copy — Page copy for shared page write

Synopsis

vm.write_shared_copy

Values

zero boolean indicating whether it is a zero page (can do a clear instead of a copy) name Name of the probe point address The address of the shared write

Context

The process attempting the write.

Description

Fires when a write to a shared page requires a page copy. This is always preceded by a vm.write_shared.

Chapter 7. Task Time Tapset

This tapset defines utility functions to query time related properties of the current tasks, translate those in miliseconds and human readable strings.

function::cputime_to_msecs

function::cputime_to_msecs — Translates the given cputime into milliseconds

Synopsis

cputime_to_msecs:long(cputime:long)

Arguments

cputime Time to convert to milliseconds.

function::cputime_to_string

function::cputime_to_string — Human readable string for given cputime

Synopsis

cputime_to_string:string(cputime:long)

Arguments

cputime Time to translate.

Description

Equivalent to calling: msec_to_string (cputime_to_msecs (cputime).

function::cputime_to_usecs

function::cputime_to_usecs — Translates the given cputime into microseconds

Synopsis

cputime_to_usecs:long(cputime:long)

Arguments

cputime Time to convert to microseconds.

function::msecs_to_string

function::msecs_to_string — Human readable string for given milliseconds

Synopsis

msecs_to_string:string(msecs:long)

Arguments

msecs Number of milliseconds to translate.

Description

Returns a string representing the number of milliseconds as a human readable string consisting of “XmY.ZZZs”, where X is the number of minutes, Y is the number of seconds and ZZZ is the number of milliseconds.

function::nsecs_to_string

function::nsecs_to_string — Human readable string for given nanoseconds

Synopsis

nsecs_to_string:string(nsecs:long)

Arguments

nsecs Number of nanoseconds to translate.

Description

Returns a string representing the number of nanoseconds as a human readable string consisting of “XmY.ZZZZZZs”, where X is the number of minutes, Y is the number of seconds and ZZZZZZZZZ is the number of nanoseconds.

function::task_start_time

function::task_start_time — Start time of the given task

Synopsis

task_start_time:long(tid:long)

Arguments

tid Thread id of the given task

Description

Returns the start time of the given task in nanoseconds since boot time or 0 if the task does not exist.

function::task_stime

function::task_stime — System time of the current task

Synopsis

task_stime:long()

Arguments

None

Description

Returns the system time of the current task in cputime. Does not include any time used by other tasks in this process, nor does it include any time of the children of this task.

function::task_stime_tid

function::task_stime_tid — System time of the given task

Synopsis

task_stime_tid:long(tid:long)

Arguments

tid Thread id of the given task

Description

Returns the system time of the given task in cputime, or zero if the task doesn't exist. Does not include any time used by other tasks in this process, nor does it include any time of the children of this task.

function::task_time_string

function::task_time_string — Human readable string of task time usage

Synopsis

task_time_string:string()

Arguments

None

Description

Returns a human readable string showing the user and system time the current task has used up to now. For example “usr: 0m12.908s, sys: 1m6.851s”.

function::task_time_string_tid

function::task_time_string_tid — Human readable string of task time usage

Synopsis

task_time_string_tid:string(tid:long)

Arguments

tid Thread id of the given task

Description

Returns a human readable string showing the user and system time the given task has used up to now. For example “usr: 0m12.908s, sys: 1m6.851s”.

function::task_utime

function::task_utime — User time of the current task

Synopsis

task_utime:long()

Arguments

None

Description

Returns the user time of the current task in cputime. Does not include any time used by other tasks in this process, nor does it include any time of the children of this task.

function::task_utime_tid

function::task_utime_tid — User time of the given task

Synopsis

task_utime_tid:long(tid:long)

Arguments

tid Thread id of the given task

Description

Returns the user time of the given task in cputime, or zero if the task doesn't exist. Does not include any time used by other tasks in this process, nor does it include any time of the children of this task.

function::usecs_to_string

function::usecs_to_string — Human readable string for given microseconds

Synopsis

usecs_to_string:string(usecs:long)

Arguments

usecs Number of microseconds to translate.

Description

Returns a string representing the number of microseconds as a human readable string consisting of “XmY.ZZZZZZs”, where X is the number of minutes, Y is the number of seconds and ZZZZZZ is the number of microseconds.

Chapter 8. Scheduler Tapset

This family of probe points is used to probe the task scheduler activities. It contains the following probe points:

probe::scheduler.balance

probe::scheduler.balance — A cpu attempting to find more work.

Synopsis

scheduler.balance

Values

name name of the probe point

Context

The cpu looking for more work.

probe::scheduler.cpu_off

probe::scheduler.cpu_off — Process is about to stop running on a cpu

Synopsis

scheduler.cpu_off

Values

idle boolean indicating whether current is the idle process task_next the process replacing current task_prev the process leaving the cpu (same as current) name name of the probe point

Context

The process leaving the cpu.

probe::scheduler.cpu_on

probe::scheduler.cpu_on — Process is beginning execution on a cpu

Synopsis

scheduler.cpu_on

Values

idle - boolean indicating whether current is the idle process name name of the probe point task_prev the process that was previously running on this cpu

Context

The resuming process.

probe::scheduler.ctxswitch

probe::scheduler.ctxswitch — A context switch is occuring.

Synopsis

scheduler.ctxswitch

Values

prevtsk_state the state of the process to be switched out prev_pid The PID of the process to be switched out prev_priority The priority of the process to be switched out nexttsk_state the state of the process to be switched in next_pid The PID of the process to be switched in next_priority The priority of the process to be switched in name name of the probe point next_task_name The name of the process to be switched in next_tid The TID of the process to be switched in prev_tid The TID of the process to be switched out prev_task_name The name of the process to be switched out

probe::scheduler.kthread_stop

probe::scheduler.kthread_stop — A thread created by kthread_create is being stopped

Synopsis

scheduler.kthread_stop

Values

thread_pid PID of the thread being stopped thread_priority priority of the thread

probe::scheduler.kthread_stop.return

probe::scheduler.kthread_stop.return — A kthread is stopped and gets the return value

Synopsis

scheduler.kthread_stop.return

Values

name name of the probe point return_value return value after stopping the thread

probe::scheduler.migrate

probe::scheduler.migrate — Task migrating across cpus

Synopsis

scheduler.migrate

Values

cpu_to the destination cpu task the process that is being migrated name name of the probe point pid PID of the task being migrated cpu_from the original cpu priority priority of the task being migrated

probe::scheduler.process_exit

probe::scheduler.process_exit — Process exiting

Synopsis

scheduler.process_exit

Values

pid PID of the process exiting priority priority of the process exiting name name of the probe point

probe::scheduler.process_fork

probe::scheduler.process_fork — Process forked

Synopsis

scheduler.process_fork

Values

name name of the probe point parent_pid PID of the parent process child_pid PID of the child process

probe::scheduler.process_free

probe::scheduler.process_free — Scheduler freeing a data structure for a process

Synopsis

scheduler.process_free

Values

name name of the probe point pid PID of the process getting freed priority priority of the process getting freed

probe::scheduler.process_wait

probe::scheduler.process_wait — Scheduler starting to wait on a process

Synopsis

scheduler.process_wait

Values

name name of the probe point pid PID of the process scheduler is waiting on

probe::scheduler.signal_send

probe::scheduler.signal_send — Sending a signal

Synopsis

scheduler.signal_send

Values

pid pid of the process sending signal signal_number signal number name name of the probe point

probe::scheduler.tick

probe::scheduler.tick — Schedulers internal tick, a processes timeslice accounting is updated

Synopsis

scheduler.tick

Values

name name of the probe point idle boolean indicating whether current is the idle process

Context

The process whose accounting will be updated.

probe::scheduler.wait_task

probe::scheduler.wait_task — Waiting on a task to unschedule (become inactive)

Synopsis

scheduler.wait_task

Values

task_pid PID of the task the scheduler is waiting on name name of the probe point task_priority priority of the task

probe::scheduler.wakeup

probe::scheduler.wakeup — Task is woken up

Synopsis

scheduler.wakeup

Values

task_state state of the task being woken up task_priority priority of the task being woken up task_cpu cpu of the task being woken up task_tid tid of the task being woken up name name of the probe point task_pid PID of the task being woken up

probe::scheduler.wakeup_new

probe::scheduler.wakeup_new — Newly created task is woken up for the first time

Synopsis

scheduler.wakeup_new

Values

task_pid PID of the new task woken up name name of the probe point task_tid TID of the new task woken up task_cpu cpu of the task woken up task_priority priority of the new task task_state state of the task woken up

Chapter 9. IO Scheduler and block IO Tapset

This family of probe points is used to probe block IO layer and IO scheduler activities. It contains the following probe points:

probe::ioblock.end

probe::ioblock.end — Fires whenever a block I/O transfer is complete.

Synopsis

ioblock.end

Values

devname block device name size total size in bytes error 0 on success flags see below BIO_UPTODATE 0 ok after I/O completion BIO_RW_BLOCK 1 RW_AHEAD set, and read/write would block BIO_EOF 2 out-out-bounds error BIO_SEG_VALID 3 nr_hw_seg valid BIO_CLONED 4 doesn't own data BIO_BOUNCED 5 bio is a bounce bio BIO_USER_MAPPED 6 contains user pages BIO_EOPNOTSUPP 7 not supported rw binary trace for read/write request name name of the probe point sector beginning sector for the entire bio ino i-node number of the mapped file phys_segments number of segments in this bio after physical address coalescing is performed. bytes_done number of bytes transferred idx offset into the bio vector array vcnt bio vector count which represents number of array element (page, offset, length) which makes up this I/O request hw_segments number of segments after physical and DMA remapping hardware coalescing is performed

Context

The process signals the transfer is done.

probe::ioblock.request

probe::ioblock.request — Fires whenever making a generic block I/O request.

Synopsis

ioblock.request

Values

devname block device name bdev_contains points to the device object which contains the partition (when bio structure represents a partition) size total size in bytes rw binary trace for read/write request sector beginning sector for the entire bio name name of the probe point flags see below BIO_UPTODATE 0 ok after I/O completion BIO_RW_BLOCK 1 RW_AHEAD set, and read/write would block BIO_EOF 2 out-out-bounds error BIO_SEG_VALID 3 nr_hw_seg valid BIO_CLONED 4 doesn't own data BIO_BOUNCED 5 bio is a bounce bio BIO_USER_MAPPED 6 contains user pages BIO_EOPNOTSUPP 7 not supported p_start_sect points to the start sector of the partition structure of the device ino i-node number of the mapped file vcnt bio vector count which represents number of array element (page, offset, length) which make up this I/O request hw_segments number of segments after physical and DMA remapping hardware coalescing is performed bdev target block device phys_segments number of segments in this bio after physical address coalescing is performed idx offset into the bio vector array

Context

The process makes block I/O request

probe::ioblock_trace.bounce

probe::ioblock_trace.bounce — Fires whenever a buffer bounce is needed for at least one page of a block IO request.

Synopsis

ioblock_trace.bounce

Values

sector beginning sector for the entire bio name name of the probe point rw binary trace for read/write request flags see below BIO_UPTODATE 0 ok after I/O completion BIO_RW_BLOCK 1 RW_AHEAD set, and read/write would block BIO_EOF 2 out-out-bounds error BIO_SEG_VALID 3 nr_hw_seg valid BIO_CLONED 4 doesn't own data BIO_BOUNCED 5 bio is a bounce bio BIO_USER_MAPPED 6 contains user pages BIO_EOPNOTSUPP 7 not supported size total size in bytes devname device for which a buffer bounce was needed. bdev_contains points to the device object which contains the partition (when bio structure represents a partition) bdev target block device vcnt bio vector count which represents number of array element (page, offset, length) which makes up this I/O request idx offset into the bio vector array phys_segments - number of segments in this bio after physical address coalescing is performed. bytes_done number of bytes transferred q request queue on which this bio was queued. p_start_sect points to the start sector of the partition structure of the device ino i-node number of the mapped file

Context

The process creating a block IO request.

probe::ioblock_trace.end

probe::ioblock_trace.end — Fires whenever a block I/O transfer is complete.

Synopsis

ioblock_trace.end

Values

idx offset into the bio vector array phys_segments - number of segments in this bio after physical address coalescing is performed. bytes_done number of bytes transferred bdev target block device vcnt bio vector count which represents number of array element (page, offset, length) which makes up this I/O request ino i-node number of the mapped file p_start_sect points to the start sector of the partition structure of the device q request queue on which this bio was queued. flags see below BIO_UPTODATE 0 ok after I/O completion BIO_RW_BLOCK 1 RW_AHEAD set, and read/write would block BIO_EOF 2 out-out-bounds error BIO_SEG_VALID 3 nr_hw_seg valid BIO_CLONED 4 doesn't own data BIO_BOUNCED 5 bio is a bounce bio BIO_USER_MAPPED 6 contains user pages BIO_EOPNOTSUPP 7 not supported name name of the probe point sector beginning sector for the entire bio rw binary trace for read/write request size total size in bytes devname block device name bdev_contains points to the device object which contains the partition (when bio structure represents a partition)

Context

The process signals the transfer is done.

probe::ioblock_trace.request

probe::ioblock_trace.request — Fires just as a generic block I/O request is created for a bio.

Synopsis

ioblock_trace.request

Values

q request queue on which this bio was queued. p_start_sect points to the start sector of the partition structure of the device ino i-node number of the mapped file bdev target block device vcnt bio vector count which represents number of array element (page, offset, length) which make up this I/O request idx offset into the bio vector array phys_segments - number of segments in this bio after physical address coalescing is performed. bytes_done number of bytes transferred size total size in bytes devname block device name bdev_contains points to the device object which contains the partition (when bio structure represents a partition) name name of the probe point sector beginning sector for the entire bio rw binary trace for read/write request flags see below BIO_UPTODATE 0 ok after I/O completion BIO_RW_BLOCK 1 RW_AHEAD set, and read/write would block BIO_EOF 2 out-out-bounds error BIO_SEG_VALID 3 nr_hw_seg valid BIO_CLONED 4 doesn't own data BIO_BOUNCED 5 bio is a bounce bio BIO_USER_MAPPED 6 contains user pages BIO_EOPNOTSUPP 7 not supported

Context

The process makes block I/O request

probe::ioscheduler.elv_add_request

probe::ioscheduler.elv_add_request — probe to indicate request is added to the request queue.

Synopsis

ioscheduler.elv_add_request

Values

disk_major Disk major no of request. disk_minor Disk minor number of request. q Pointer to request queue. rq Address of request. rq_flags Request flags. elevator_name The type of I/O elevator currently enabled.

probe::ioscheduler.elv_add_request.kp

probe::ioscheduler.elv_add_request.kp — kprobe based probe to indicate that a request was added to the request queue

Synopsis

ioscheduler.elv_add_request.kp

Values

rq Address of the request rq_flags Request flags elevator_name The type of I/O elevator currently enabled q pointer to request queue name Name of the probe point disk_minor Disk minor number of the request disk_major Disk major number of the request

probe::ioscheduler.elv_add_request.tp

probe::ioscheduler.elv_add_request.tp — tracepoint based probe to indicate a request is added to the request queue.

Synopsis

ioscheduler.elv_add_request.tp

Values

disk_minor Disk minor number of request. disk_major Disk major no of request. elevator_name The type of I/O elevator currently enabled. rq_flags Request flags. rq Address of request. name Name of the probe point q Pointer to request queue.

probe::ioscheduler.elv_completed_request

probe::ioscheduler.elv_completed_request — Fires when a request is completed

Synopsis

ioscheduler.elv_completed_request

Values

name Name of the probe point rq_flags Request flags rq Address of the request elevator_name The type of I/O elevator currently enabled disk_major Disk major number of the request disk_minor Disk minor number of the request

probe::ioscheduler.elv_next_request

probe::ioscheduler.elv_next_request — Fires when a request is retrieved from the request queue

Synopsis

ioscheduler.elv_next_request

Values

elevator_name The type of I/O elevator currently enabled name Name of the probe point

probe::ioscheduler.elv_next_request.return

probe::ioscheduler.elv_next_request.return — Fires when a request retrieval issues a return signal

Synopsis

ioscheduler.elv_next_request.return

Values

name Name of the probe point rq_flags Request flags rq Address of the request disk_major Disk major number of the request disk_minor Disk minor number of the request

probe::ioscheduler_trace.elv_abort_request

probe::ioscheduler_trace.elv_abort_request — Fires when a request is aborted.

Synopsis

ioscheduler_trace.elv_abort_request

Values

name Name of the probe point elevator_name The type of I/O elevator currently enabled. rq_flags Request flags. rq Address of request. disk_major Disk major no of request. disk_minor Disk minor number of request.

probe::ioscheduler_trace.elv_completed_request

probe::ioscheduler_trace.elv_completed_request — Fires when a request is

Synopsis

ioscheduler_trace.elv_completed_request

Values

rq Address of request. rq_flags Request flags. elevator_name The type of I/O elevator currently enabled. name Name of the probe point disk_minor Disk minor number of request. disk_major Disk major no of request.

Description

completed.

probe::ioscheduler_trace.elv_issue_request

probe::ioscheduler_trace.elv_issue_request — Fires when a request is

Synopsis

ioscheduler_trace.elv_issue_request

Values

rq Address of request. rq_flags Request flags. elevator_name The type of I/O elevator currently enabled. name Name of the probe point disk_minor Disk minor number of request. disk_major Disk major no of request.

Description

scheduled.

probe::ioscheduler_trace.elv_requeue_request

probe::ioscheduler_trace.elv_requeue_request — Fires when a request is

Synopsis

ioscheduler_trace.elv_requeue_request

Values

name Name of the probe point rq_flags Request flags. elevator_name The type of I/O elevator currently enabled. rq Address of request. disk_major Disk major no of request. disk_minor Disk minor number of request.

Description

put back on the queue, when the hadware cannot accept more requests.

probe::ioscheduler_trace.plug

probe::ioscheduler_trace.plug — Fires when a request queue is plugged;

Synopsis

ioscheduler_trace.plug

Values

rq_queue request queue name Name of the probe point

Description

ie, requests in the queue cannot be serviced by block driver.

probe::ioscheduler_trace.unplug_io

probe::ioscheduler_trace.unplug_io — Fires when a request queue is unplugged;

Synopsis

ioscheduler_trace.unplug_io

Values

name Name of the probe point rq_queue request queue

Description

Either, when number of pending requests in the queue exceeds threshold or, upon expiration of timer that was activated when queue was plugged.

probe::ioscheduler_trace.unplug_timer

probe::ioscheduler_trace.unplug_timer — Fires when unplug timer associated

Synopsis

ioscheduler_trace.unplug_timer

Values

name Name of the probe point rq_queue request queue

Description

with a request queue expires.

Chapter 10. SCSI Tapset

This family of probe points is used to probe SCSI activities. It contains the following probe points:

probe::scsi.iocompleted

probe::scsi.iocompleted — SCSI mid-layer running the completion processing for block device I/O requests

Synopsis

scsi.iocompleted

Values

data_direction The data_direction specifies whether this command is from/ to the device goodbytes The bytes completed data_direction_str Data direction, as a string device_state_str The current state of the device, as a string host_no The host number channel The channel number req_addr The current struct request pointer, as a number device_state The current state of the device lun The lun number dev_id The scsi device id

probe::scsi.iodispatching

probe::scsi.iodispatching — SCSI mid-layer dispatched low-level SCSI command

Synopsis

scsi.iodispatching

Values

dev_id The scsi device id lun The lun number request_buffer The request buffer address device_state The current state of the device req_addr The current struct request pointer, as a number channel The channel number host_no The host number data_direction The data_direction specifies whether this command is from/to the device 0 (DMA_BIDIRECTIONAL), 1 (DMA_TO_DEVICE), 2 (DMA_FROM_DEVICE), 3 (DMA_NONE) device_state_str The current state of the device, as a string data_direction_str Data direction, as a string request_bufflen The request buffer length

probe::scsi.iodone

probe::scsi.iodone — SCSI command completed by low level driver and enqueued into the done queue.

Synopsis

scsi.iodone

Values

channel The channel number req_addr The current struct request pointer, as a number data_direction The data_direction specifies whether this command is from/ to the device. data_direction_str Data direction, as a string device_state_str The current state of the device, as a string host_no The host number lun The lun number dev_id The scsi device id scsi_timer_pending 1 if a timer is pending on this request device_state The current state of the device

probe::scsi.ioentry

probe::scsi.ioentry — Prepares a SCSI mid-layer request

Synopsis

scsi.ioentry

Values

device_state_str The current state of the device, as a string device_state The current state of the device disk_major The major number of the disk (-1 if no information) disk_minor The minor number of the disk (-1 if no information) req_addr The current struct request pointer, as a number

probe::scsi.ioexecute

probe::scsi.ioexecute — Create mid-layer SCSI request and wait for the result

Synopsis

scsi.ioexecute

Values

data_direction The data_direction specifies whether this command is from/ to the device. data_direction_str Data direction, as a string device_state_str The current state of the device, as a string host_no The host number request_bufflen The data buffer buffer length channel The channel number device_state The current state of the device timeout Request timeout in seconds retries Number of times to retry request request_buffer The data buffer address lun The lun number dev_id The scsi device id

probe::scsi.set_state

probe::scsi.set_state — Order SCSI device state change

Synopsis

scsi.set_state

Values

channel The channel number state_str The new state of the device, as a string old_state The current state of the device state The new state of the device host_no The host number lun The lun number dev_id The scsi device id old_state_str The current state of the device, as a string

Chapter 11. TTY Tapset

This family of probe points is used to probe TTY (Teletype) activities. It contains the following probe points:

probe::tty.init

probe::tty.init — Called when a tty is being initalized

Synopsis

tty.init

Values

module the module name driver_name the driver name name the driver .dev_name name

probe::tty.ioctl

probe::tty.ioctl — called when a ioctl is request to the tty

Synopsis

tty.ioctl

Values

cmd the ioctl command name the file name arg the ioctl argument

probe::tty.open

probe::tty.open — Called when a tty is opened

Synopsis

tty.open

Values

file_mode the file mode inode_state the inode state file_name the file name inode_number the inode number file_flags the file flags inode_flags the inode flags

probe::tty.poll

probe::tty.poll — Called when a tty device is being polled

Synopsis

tty.poll

Values

wait_key the wait queue key file_name the tty file name

probe::tty.read

probe::tty.read — called when a tty line will be read

Synopsis

tty.read

Values

buffer the buffer that will receive the characters file_name the file name lreated to the tty driver_name the driver name nr The amount of characters to be read

probe::tty.receive

probe::tty.receive — called when a tty receives a message

Synopsis

tty.receive

Values

id the tty id index The tty Index cp the buffer that was received count The amount of characters received fp The flag buffer name the name of the module file driver_name the driver name

probe::tty.register

probe::tty.register — Called when a tty device is registred

Synopsis

tty.register

Values

index the tty index requested name the driver .dev_name name module the module name driver_name the driver name

probe::tty.release

probe::tty.release — Called when the tty is closed

Synopsis

tty.release

Values

inode_state the inode state file_name the file name inode_number the inode number file_flags the file flags inode_flags the inode flags file_mode the file mode

probe::tty.resize

probe::tty.resize — Called when a terminal resize happens

Synopsis

tty.resize

Values

old_ypixel the old ypixel new_row the new row value old_col the old col value name the tty name new_xpixel the new xpixel value new_ypixel the new ypixel value old_xpixel the old xpixel old_row the old row value new_col the new col value

probe::tty.unregister

probe::tty.unregister — Called when a tty device is being unregistered

Synopsis

tty.unregister

Values

driver_name the driver name module the module name name the driver .dev_name name index the tty index requested

probe::tty.write

probe::tty.write — write to the tty line

Synopsis

tty.write

Values

driver_name the driver name nr The amount of characters buffer the buffer that will be written file_name the file name lreated to the tty

Chapter 12. Interrupt Request (IRQ) Tapset

This family of probe points is used to probe interrupt request (IRQ) activities. It contains the following probe points:

probe::irq_handler.entry

probe::irq_handler.entry — Execution of interrupt handler starting

Synopsis

irq_handler.entry

Values

thread_fn interrupt handler function for threaded interrupts flags_str symbolic string representation of IRQ flags next_irqaction pointer to next irqaction for shared interrupts thread thread pointer for threaded interrupts dir pointer to the proc/irq/NN/name entry dev_id Cookie to identify device dev_name name of device action struct irqaction* for this interrupt num thread_flags Flags related to thread flags Flags for IRQ handler handler interrupt handler function irq irq number

probe::irq_handler.exit

probe::irq_handler.exit — Execution of interrupt handler completed

Synopsis

irq_handler.exit

Values

thread_flags Flags related to thread action struct irqaction* dev_name name of device irq interrupt number handler interrupt handler function that was executed flags flags for IRQ handler dir pointer to the proc/irq/NN/name entry thread thread pointer for threaded interrupts next_irqaction pointer to next irqaction for shared interrupts thread_fn interrupt handler function for threaded interrupts flags_str symbolic string representation of IRQ flags ret return value of the handler dev_id Cookie to identify device

probe::softirq.entry

probe::softirq.entry — Execution of handler for a pending softirq starting

Synopsis

softirq.entry

Values

h struct softirq_action* for current pending softirq vec softirq_action vector vec_nr softirq vector number action pointer to softirq handler just about to execute

probe::softirq.exit

probe::softirq.exit — Execution of handler for a pending softirq completed

Synopsis

softirq.exit

Values

h struct softirq_action* for just executed softirq vec_nr softirq vector number vec softirq_action vector action pointer to softirq handler that just finished execution

probe::workqueue.create

probe::workqueue.create — Creating a new workqueue

Synopsis

workqueue.create

Values

wq_thread task_struct of the workqueue thread cpu cpu for which the worker thread is created

probe::workqueue.destroy

probe::workqueue.destroy — Destroying workqueue

Synopsis

workqueue.destroy

Values

wq_thread task_struct of the workqueue thread

probe::workqueue.execute

probe::workqueue.execute — Executing deferred work

Synopsis

workqueue.execute

Values

wq_thread task_struct of the workqueue thread work work_struct* being executed work_func pointer to handler function

probe::workqueue.insert

probe::workqueue.insert — Queuing work on a workqueue

Synopsis

workqueue.insert

Values

work_func pointer to handler function work work_struct* being queued wq_thread task_struct of the workqueue thread

Chapter 13. Networking Tapset

This family of probe points is used to probe the activities of the network device and protocol layers.

function::format_ipaddr

function::format_ipaddr — Returns a string representation for an IP address

Synopsis

format_ipaddr:string(addr:long,family:long)

Arguments

addr the IP address family the IP address family (either AF_INET or AF_INET6)

function::htonl

function::htonl — Convert 32-bit long from host to network order

Synopsis

htonl:long(x:long)

Arguments

xValue to convert

function::htonll

function::htonll — Convert 64-bit long long from host to network order

Synopsis

htonll:long(x:long)

Arguments

xValue to convert

function::htons

function::htons — Convert 16-bit short from host to network order

Synopsis

htons:long(x:long)

Arguments

xValue to convert

function::ip_ntop

function::ip_ntop — Returns a string representation for an IPv4 address

Synopsis

ip_ntop:string(addr:long)

Arguments

addr the IPv4 address represented as an integer

function::ntohl

function::ntohl — Convert 32-bit long from network to host order

Synopsis

ntohl:long(x:long)

Arguments

xValue to convert

function::ntohll

function::ntohll — Convert 64-bit long long from network to host order

Synopsis

ntohll:long(x:long)

Arguments

xValue to convert

function::ntohs

function::ntohs — Convert 16-bit short from network to host order

Synopsis

ntohs:long(x:long)

Arguments

xValue to convert

probe::netdev.change_mac

probe::netdev.change_mac — Called when the netdev_name has the MAC changed

Synopsis

netdev.change_mac

Values

mac_len The MAC length dev_name The device that will have the MAC changed new_mac The new MAC address old_mac The current MAC address

probe::netdev.change_mtu

probe::netdev.change_mtu — Called when the netdev MTU is changed

Synopsis

netdev.change_mtu

Values

new_mtu The new MTU old_mtu The current MTU dev_name The device that will have the MTU changed

probe::netdev.change_rx_flag

probe::netdev.change_rx_flag — Called when the device RX flag will be changed

Synopsis

netdev.change_rx_flag

Values

flags The new flags dev_name The device that will be changed

probe::netdev.close

probe::netdev.close — Called when the device is closed

Synopsis

netdev.close

Values

dev_name The device that is going to be closed

probe::netdev.get_stats

probe::netdev.get_stats — Called when someone asks the device statistics

Synopsis

netdev.get_stats

Values

dev_name The device that is going to provide the statistics

probe::netdev.hard_transmit

probe::netdev.hard_transmit — Called when the devices is going to TX (hard)

Synopsis

netdev.hard_transmit

Values

length The length of the transmit buffer. truesize The size of the data to be transmitted. dev_name The device scheduled to transmit protocol The protocol used in the transmission

probe::netdev.ioctl

probe::netdev.ioctl — Called when the device suffers an IOCTL

Synopsis

netdev.ioctl

Values

cmd The IOCTL request arg The IOCTL argument (usually the netdev interface)

probe::netdev.open

probe::netdev.open — Called when the device is opened

Synopsis

netdev.open

Values

dev_name The device that is going to be opened

probe::netdev.receive

probe::netdev.receive — Data received from network device.

Synopsis

netdev.receive

Values

protocol Protocol of received packet. dev_name The name of the device. e.g: eth0, ath1. length The length of the receiving buffer.

probe::netdev.register

probe::netdev.register — Called when the device is registered

Synopsis

netdev.register

Values

dev_name The device that is going to be registered

probe::netdev.rx

probe::netdev.rx — Called when the device is going to receive a packet

Synopsis

netdev.rx

Values

protocol The packet protocol dev_name The device received the packet

probe::netdev.set_promiscuity

probe::netdev.set_promiscuity — Called when the device enters/leaves promiscuity

Synopsis

netdev.set_promiscuity

Values

dev_name The device that is entering/leaving promiscuity mode disable If the device is leaving promiscuity mode inc Count the number of promiscuity openers enable If the device is entering promiscuity mode

probe::netdev.transmit

probe::netdev.transmit — Network device transmitting buffer

Synopsis

netdev.transmit

Values

dev_name The name of the device. e.g: eth0, ath1. protocol The protocol of this packet(defined in include/linux/if_ether.h). length The length of the transmit buffer. truesize The size of the data to be transmitted.

probe::netdev.unregister

probe::netdev.unregister — Called when the device is being unregistered

Synopsis

netdev.unregister

Values

dev_name The device that is going to be unregistered

probe::netfilter.arp.forward

probe::netfilter.arp.forward — - Called for each ARP packet to be forwarded

Synopsis

netfilter.arp.forward

Values

ar_tip Ethernet+IP only (ar_pro0x800): target IP address indev Address of net_device representing input device, 0 if unknown outdev Address of net_device representing output device, 0 if unknown length The length of the packet buffer contents, in bytes ar_sip Ethernet+IP only (ar_pro0x800): source IP address nf_queue Constant used to signify a 'queue' verdict nf_stop Constant used to signify a 'stop' verdict pf Protocol family -- always “arp” arphdr Address of ARP header nf_accept Constant used to signify an 'accept' verdict ar_data Address of ARP packet data region (after the header) ar_hln Length of hardware address outdev_name Name of network device packet will be routed to (if known) indev_name Name of network device packet was received on (if known) ar_pln Length of protocol address nf_drop Constant used to signify a 'drop' verdict nf_stolen Constant used to signify a 'stolen' verdict ar_pro Format of protocol address ar_hrd Format of hardware address ar_sha Ethernet+IP only (ar_pro0x800): source hardware (MAC) address ar_op ARP opcode (command) nf_repeat Constant used to signify a 'repeat' verdict ar_tha Ethernet+IP only (ar_pro0x800): target hardware (MAC) address

probe::netfilter.arp.in

probe::netfilter.arp.in — - Called for each incoming ARP packet

Synopsis

netfilter.arp.in

Values

ar_tha Ethernet+IP only (ar_pro0x800): target hardware (MAC) address nf_repeat Constant used to signify a 'repeat' verdict ar_op ARP opcode (command) ar_sha Ethernet+IP only (ar_pro0x800): source hardware (MAC) address ar_pro Format of protocol address ar_hrd Format of hardware address nf_stolen Constant used to signify a 'stolen' verdict nf_drop Constant used to signify a 'drop' verdict ar_pln Length of protocol address indev_name Name of network device packet was received on (if known) outdev_name Name of network device packet will be routed to (if known) ar_hln Length of hardware address ar_data Address of ARP packet data region (after the header) nf_accept Constant used to signify an 'accept' verdict arphdr Address of ARP header pf Protocol family -- always “arp” nf_stop Constant used to signify a 'stop' verdict nf_queue Constant used to signify a 'queue' verdict ar_sip Ethernet+IP only (ar_pro0x800): source IP address length The length of the packet buffer contents, in bytes indev Address of net_device representing input device, 0 if unknown outdev Address of net_device representing output device, 0 if unknown ar_tip Ethernet+IP only (ar_pro0x800): target IP address

probe::netfilter.arp.out

probe::netfilter.arp.out — - Called for each outgoing ARP packet

Synopsis

netfilter.arp.out

Values

nf_repeat Constant used to signify a 'repeat' verdict ar_tha Ethernet+IP only (ar_pro0x800): target hardware (MAC) address ar_sha Ethernet+IP only (ar_pro0x800): source hardware (MAC) address ar_op ARP opcode (command) ar_pro Format of protocol address ar_hrd Format of hardware address nf_stolen Constant used to signify a 'stolen' verdict ar_pln Length of protocol address indev_name Name of network device packet was received on (if known) nf_drop Constant used to signify a 'drop' verdict ar_hln Length of hardware address outdev_name Name of network device packet will be routed to (if known) nf_stop Constant used to signify a 'stop' verdict nf_queue Constant used to signify a 'queue' verdict nf_accept Constant used to signify an 'accept' verdict ar_data Address of ARP packet data region (after the header) arphdr Address of ARP header pf Protocol family -- always “arp” outdev Address of net_device representing output device, 0 if unknown indev Address of net_device representing input device, 0 if unknown ar_tip Ethernet+IP only (ar_pro0x800): target IP address length The length of the packet buffer contents, in bytes ar_sip Ethernet+IP only (ar_pro0x800): source IP address

probe::netfilter.bridge.forward

probe::netfilter.bridge.forward — Called on an incoming bridging packet destined for some other computer

Synopsis

netfilter.bridge.forward

Values

nf_stolen Constant used to signify a 'stolen' verdict llcproto_stp Constant used to signify Bridge Spanning Tree Protocol packet br_mac Bridge MAC address protocol Packet protocol br_rmac Root bridge MAC address br_poid Port identifier br_fd Forward delay in 1/256 secs br_type BPDU type nf_repeat Constant used to signify a 'repeat' verdict br_flags BPDU flags br_cost Total cost from transmitting bridge to root brhdr Address of bridge header outdev Address of net_device representing output device, 0 if unknown indev Address of net_device representing input device, 0 if unknown br_htime Hello time in 1/256 secs br_max Max age in 1/256 secs llcpdu Address of LLC Protocol Data Unit length The length of the packet buffer contents, in bytes br_prid Protocol identifier nf_queue Constant used to signify a 'queue' verdict br_rid Identity of root bridge nf_stop Constant used to signify a 'stop' verdict br_bid Identity of bridge pf Protocol family -- always “bridge” nf_accept Constant used to signify an 'accept' verdict outdev_name Name of network device packet will be routed to (if known) br_vid Protocol version identifier indev_name Name of network device packet was received on (if known) nf_drop Constant used to signify a 'drop' verdict br_msg Message age in 1/256 secs

probe::netfilter.bridge.local_in

probe::netfilter.bridge.local_in — Called on a bridging packet destined for the local computer

Synopsis

netfilter.bridge.local_in

Values

br_rid Identity of root bridge nf_queue Constant used to signify a 'queue' verdict br_prid Protocol identifier nf_stop Constant used to signify a 'stop' verdict br_bid Identity of bridge pf Protocol family -- always “bridge” nf_accept Constant used to signify an 'accept' verdict br_cost Total cost from transmitting bridge to root brhdr Address of bridge header outdev Address of net_device representing output device, 0 if unknown indev Address of net_device representing input device, 0 if unknown br_max Max age in 1/256 secs br_htime Hello time in 1/256 secs length The length of the packet buffer contents, in bytes llcpdu Address of LLC Protocol Data Unit indev_name Name of network device packet was received on (if known) br_vid Protocol version identifier nf_drop Constant used to signify a 'drop' verdict br_msg Message age in 1/256 secs outdev_name Name of network device packet will be routed to (if known) br_mac Bridge MAC address br_rmac Root bridge MAC address protocol Packet protocol br_poid Port identifier nf_stolen Constant used to signify a 'stolen' verdict llcproto_stp Constant used to signify Bridge Spanning Tree Protocol packet br_type BPDU type nf_repeat Constant used to signify a 'repeat' verdict br_flags BPDU flags br_fd Forward delay in 1/256 secs

probe::netfilter.bridge.local_out

probe::netfilter.bridge.local_out — Called on a bridging packet coming from a local process

Synopsis

netfilter.bridge.local_out

Values

br_vid Protocol version identifier indev_name Name of network device packet was received on (if known) br_msg Message age in 1/256 secs nf_drop Constant used to signify a 'drop' verdict outdev_name Name of network device packet will be routed to (if known) nf_stop Constant used to signify a 'stop' verdict br_bid Identity of bridge nf_queue Constant used to signify a 'queue' verdict br_rid Identity of root bridge br_prid Protocol identifier nf_accept Constant used to signify an 'accept' verdict pf Protocol family -- always “bridge” brhdr Address of bridge header outdev Address of net_device representing output device, 0 if unknown indev Address of net_device representing input device, 0 if unknown br_cost Total cost from transmitting bridge to root length The length of the packet buffer contents, in bytes llcpdu Address of LLC Protocol Data Unit br_max Max age in 1/256 secs br_htime Hello time in 1/256 secs nf_repeat Constant used to signify a 'repeat' verdict br_type BPDU type br_flags BPDU flags br_fd Forward delay in 1/256 secs br_mac Bridge MAC address br_poid Port identifier br_rmac Root bridge MAC address protocol Packet protocol nf_stolen Constant used to signify a 'stolen' verdict llcproto_stp Constant used to signify Bridge Spanning Tree Protocol packet

probe::netfilter.bridge.post_routing

probe::netfilter.bridge.post_routing — - Called before a bridging packet hits the wire

Synopsis

netfilter.bridge.post_routing

Values

indev_name Name of network device packet was received on (if known) br_vid Protocol version identifier nf_drop Constant used to signify a 'drop' verdict br_msg Message age in 1/256 secs outdev_name Name of network device packet will be routed to (if known) br_rid Identity of root bridge nf_queue Constant used to signify a 'queue' verdict br_prid Protocol identifier nf_stop Constant used to signify a 'stop' verdict br_bid Identity of bridge pf Protocol family -- always “bridge” nf_accept Constant used to signify an 'accept' verdict br_cost Total cost from transmitting bridge to root brhdr Address of bridge header outdev Address of net_device representing output device, 0 if unknown indev Address of net_device representing input device, 0 if unknown br_htime Hello time in 1/256 secs br_max Max age in 1/256 secs length The length of the packet buffer contents, in bytes llcpdu Address of LLC Protocol Data Unit br_type BPDU type nf_repeat Constant used to signify a 'repeat' verdict br_flags BPDU flags br_fd Forward delay in 1/256 secs br_mac Bridge MAC address protocol Packet protocol br_rmac Root bridge MAC address br_poid Port identifier nf_stolen Constant used to signify a 'stolen' verdict llcproto_stp Constant used to signify Bridge Spanning Tree Protocol packet

probe::netfilter.bridge.pre_routing

probe::netfilter.bridge.pre_routing — - Called before a bridging packet is routed

Synopsis

netfilter.bridge.pre_routing

Values

indev_name Name of network device packet was received on (if known) br_vid Protocol version identifier br_msg Message age in 1/256 secs nf_drop Constant used to signify a 'drop' verdict outdev_name Name of network device packet will be routed to (if known) nf_stop Constant used to signify a 'stop' verdict br_bid Identity of bridge br_rid Identity of root bridge nf_queue Constant used to signify a 'queue' verdict br_prid Protocol identifier nf_accept Constant used to signify an 'accept' verdict pf Protocol family -- always “bridge” outdev Address of net_device representing output device, 0 if unknown brhdr Address of bridge header indev Address of net_device representing input device, 0 if unknown br_cost Total cost from transmitting bridge to root llcpdu Address of LLC Protocol Data Unit length The length of the packet buffer contents, in bytes br_max Max age in 1/256 secs br_htime Hello time in 1/256 secs nf_repeat Constant used to signify a 'repeat' verdict br_type BPDU type br_flags BPDU flags br_fd Forward delay in 1/256 secs br_mac Bridge MAC address br_poid Port identifier protocol Packet protocol br_rmac Root bridge MAC address nf_stolen Constant used to signify a 'stolen' verdict llcproto_stp Constant used to signify Bridge Spanning Tree Protocol packet

probe::netfilter.ip.forward

probe::netfilter.ip.forward — Called on an incoming IP packet addressed to some other computer

Synopsis

netfilter.ip.forward

Values

family IP address family nf_stolen Constant used to signify a 'stolen' verdict ipproto_udp Constant used to signify that the packet protocol is UDP syn TCP SYN flag (if protocol is TCP; ipv4 only) fin TCP FIN flag (if protocol is TCP; ipv4 only) ack TCP ACK flag (if protocol is TCP; ipv4 only) protocol Packet protocol from driver (ipv4 only) daddr A string representing the destination IP address rst TCP RST flag (if protocol is TCP; ipv4 only) nf_repeat Constant used to signify a 'repeat' verdict dport TCP or UDP destination port (ipv4 only) outdev Address of net_device representing output device, 0 if unknown indev Address of net_device representing input device, 0 if unknown length The length of the packet buffer contents, in bytes saddr A string representing the source IP address ipproto_tcp Constant used to signify that the packet protocol is TCP psh TCP PSH flag (if protocol is TCP; ipv4 only) nf_stop Constant used to signify a 'stop' verdict nf_queue Constant used to signify a 'queue' verdict nf_accept Constant used to signify an 'accept' verdict pf Protocol family -- either “ipv4” or “ipv6” urg TCP URG flag (if protocol is TCP; ipv4 only) outdev_name Name of network device packet will be routed to (if known) sport TCP or UDP source port (ipv4 only) indev_name Name of network device packet was received on (if known) nf_drop Constant used to signify a 'drop' verdict iphdr Address of IP header

probe::netfilter.ip.local_in

probe::netfilter.ip.local_in — Called on an incoming IP packet addressed to the local computer

Synopsis

netfilter.ip.local_in

Values

daddr A string representing the destination IP address rst TCP RST flag (if protocol is TCP; ipv4 only) nf_repeat Constant used to signify a 'repeat' verdict dport TCP or UDP destination port (ipv4 only) family IP address family nf_stolen Constant used to signify a 'stolen' verdict ipproto_udp Constant used to signify that the packet protocol is UDP syn TCP SYN flag (if protocol is TCP; ipv4 only) fin TCP FIN flag (if protocol is TCP; ipv4 only) protocol Packet protocol from driver (ipv4 only) ack TCP ACK flag (if protocol is TCP; ipv4 only) urg TCP URG flag (if protocol is TCP; ipv4 only) outdev_name Name of network device packet will be routed to (if known) sport TCP or UDP source port (ipv4 only) indev_name Name of network device packet was received on (if known) iphdr Address of IP header nf_drop Constant used to signify a 'drop' verdict indev Address of net_device representing input device, 0 if unknown outdev Address of net_device representing output device, 0 if unknown saddr A string representing the source IP address ipproto_tcp Constant used to signify that the packet protocol is TCP length The length of the packet buffer contents, in bytes psh TCP PSH flag (if protocol is TCP; ipv4 only) nf_stop Constant used to signify a 'stop' verdict nf_queue Constant used to signify a 'queue' verdict nf_accept Constant used to signify an 'accept' verdict pf Protocol family -- either “ipv4” or “ipv6”

probe::netfilter.ip.local_out

probe::netfilter.ip.local_out — Called on an outgoing IP packet

Synopsis

netfilter.ip.local_out

Values

pf Protocol family -- either “ipv4” or “ipv6” nf_accept Constant used to signify an 'accept' verdict nf_queue Constant used to signify a 'queue' verdict nf_stop Constant used to signify a 'stop' verdict psh TCP PSH flag (if protocol is TCP; ipv4 only) saddr A string representing the source IP address length The length of the packet buffer contents, in bytes ipproto_tcp Constant used to signify that the packet protocol is TCP outdev Address of net_device representing output device, 0 if unknown indev Address of net_device representing input device, 0 if unknown nf_drop Constant used to signify a 'drop' verdict iphdr Address of IP header indev_name Name of network device packet was received on (if known) sport TCP or UDP source port (ipv4 only) outdev_name Name of network device packet will be routed to (if known) urg TCP URG flag (if protocol is TCP; ipv4 only) protocol Packet protocol from driver (ipv4 only) ack TCP ACK flag (if protocol is TCP; ipv4 only) fin TCP FIN flag (if protocol is TCP; ipv4 only) syn TCP SYN flag (if protocol is TCP; ipv4 only) ipproto_udp Constant used to signify that the packet protocol is UDP nf_stolen Constant used to signify a 'stolen' verdict family IP address family dport TCP or UDP destination port (ipv4 only) nf_repeat Constant used to signify a 'repeat' verdict rst TCP RST flag (if protocol is TCP; ipv4 only) daddr A string representing the destination IP address

probe::netfilter.ip.post_routing

probe::netfilter.ip.post_routing — Called immediately before an outgoing IP packet leaves the computer

Synopsis

netfilter.ip.post_routing

Values

rst TCP RST flag (if protocol is TCP; ipv4 only) daddr A string representing the destination IP address dport TCP or UDP destination port (ipv4 only) nf_repeat Constant used to signify a 'repeat' verdict syn TCP SYN flag (if protocol is TCP; ipv4 only) ipproto_udp Constant used to signify that the packet protocol is UDP nf_stolen Constant used to signify a 'stolen' verdict family IP address family ack TCP ACK flag (if protocol is TCP; ipv4 only) protocol Packet protocol from driver (ipv4 only) fin TCP FIN flag (if protocol is TCP; ipv4 only) outdev_name Name of network device packet will be routed to (if known) urg TCP URG flag (if protocol is TCP; ipv4 only) iphdr Address of IP header nf_drop Constant used to signify a 'drop' verdict indev_name Name of network device packet was received on (if known) sport TCP or UDP source port (ipv4 only) saddr A string representing the source IP address ipproto_tcp Constant used to signify that the packet protocol is TCP length The length of the packet buffer contents, in bytes outdev Address of net_device representing output device, 0 if unknown indev Address of net_device representing input device, 0 if unknown pf Protocol family -- either “ipv4” or “ipv6” nf_accept Constant used to signify an 'accept' verdict nf_queue Constant used to signify a 'queue' verdict psh TCP PSH flag (if protocol is TCP; ipv4 only) nf_stop Constant used to signify a 'stop' verdict

probe::netfilter.ip.pre_routing

probe::netfilter.ip.pre_routing — Called before an IP packet is routed

Synopsis

netfilter.ip.pre_routing

Values

pf Protocol family - either 'ipv4' or 'ipv6' nf_accept Constant used to signify an 'accept' verdict nf_queue Constant used to signify a 'queue' verdict psh TCP PSH flag (if protocol is TCP; ipv4 only) nf_stop Constant used to signify a 'stop' verdict saddr A string representing the source IP address length The length of the packet buffer contents, in bytes ipproto_tcp Constant used to signify that the packet protocol is TCP outdev Address of net_device representing output device, 0 if unknown indev Address of net_device representing input device, 0 if unknown nf_drop Constant used to signify a 'drop' verdict iphdr Address of IP header indev_name Name of network device packet was received on (if known) sport TCP or UDP source port (ipv4 only) outdev_name Name of network device packet will be routed to (if known) urg TCP URG flag (if protocol is TCP; ipv4 only) protocol Packet protocol from driver (ipv4 only) ack TCP ACK flag (if protocol is TCP; ipv4 only) fin TCP FIN flag (if protocol is TCP; ipv4 only) syn TCP SYN flag (if protocol is TCP; ipv4 only) ipproto_udp Constant used to signify that the packet protocol is UDP nf_stolen Constant used to signify a 'stolen' verdict family IP address family dport TCP or UDP destination port (ipv4 only) nf_repeat Constant used to signify a 'repeat' verdict rst TCP RST flag (if protocol is TCP; ipv4 only) daddr A string representing the destination IP address

probe::sunrpc.clnt.bind_new_program

probe::sunrpc.clnt.bind_new_program — Bind a new RPC program to an existing client

Synopsis

sunrpc.clnt.bind_new_program

Values

old_vers the version of old RPC program servername the server machine name old_prog the number of old RPC program prog the number of new RPC program old_progname the name of old RPC program vers the version of new RPC program progname the name of new RPC program

probe::sunrpc.clnt.call_async

probe::sunrpc.clnt.call_async — Make an asynchronous RPC call

Synopsis

sunrpc.clnt.call_async

Values

dead whether this client is abandoned servername the server machine name xid current transmission id flags flags prot the IP protocol number proc the procedure number in this RPC call procname the procedure name in this RPC call port the port number vers the RPC program version number progname the RPC program name prog the RPC program number

probe::sunrpc.clnt.call_sync

probe::sunrpc.clnt.call_sync — Make a synchronous RPC call

Synopsis

sunrpc.clnt.call_sync

Values

prog the RPC program number progname the RPC program name port the port number vers the RPC program version number procname the procedure name in this RPC call prot the IP protocol number proc the procedure number in this RPC call flags flags xid current transmission id dead whether this client is abandoned servername the server machine name

probe::sunrpc.clnt.clone_client

probe::sunrpc.clnt.clone_client — Clone an RPC client structure

Synopsis

sunrpc.clnt.clone_client

Values

prot the IP protocol number authflavor the authentication flavor progname the RPC program name prog the RPC program number servername the server machine name port the port number vers the RPC program version number

probe::sunrpc.clnt.create_client

probe::sunrpc.clnt.create_client — Create an RPC client

Synopsis

sunrpc.clnt.create_client

Values

prot the IP protocol number progname the RPC program name authflavor the authentication flavor port the port number vers the RPC program version number prog the RPC program number servername the server machine name

probe::sunrpc.clnt.restart_call

probe::sunrpc.clnt.restart_call — Restart an asynchronous RPC call

Synopsis

sunrpc.clnt.restart_call

Values

servername the server machine name tk_flags the task flags xid the transmission id tk_pid the debugging aid of task prog the RPC program number tk_priority the task priority tk_runstate the task run status

probe::sunrpc.clnt.shutdown_client

probe::sunrpc.clnt.shutdown_client — Shutdown an RPC client

Synopsis

sunrpc.clnt.shutdown_client

Values

om_execute the RPC execution jiffies servername the server machine name om_bytes_sent the count of bytes out clones the number of clones prot the IP protocol number om_ntrans the count of RPC transmissions om_ops the count of operations authflavor the authentication flavor om_bytes_recv the count of bytes in port the port number rpccnt the count of RPC calls vers the RPC program version number progname the RPC program name prog the RPC program number tasks the number of references om_queue the jiffies queued for xmit netreconn the count of reconnections om_rtt the RPC RTT jiffies

probe::sunrpc.sched.delay

probe::sunrpc.sched.delay — Delay an RPC task

Synopsis

sunrpc.sched.delay

Values

prog the program number in the RPC call vers the program version in the RPC call prot the IP protocol in the RPC call tk_flags the flags of the task xid the transmission id in the RPC call delay the time delayed tk_pid the debugging id of the task

probe::sunrpc.sched.execute

probe::sunrpc.sched.execute — Execute the RPC `scheduler'

Synopsis

sunrpc.sched.execute

Values

prot the IP protocol in the RPC call xid the transmission id in the RPC call tk_pid the debugging id of the task tk_flags the flags of the task prog the program number in the RPC call vers the program version in the RPC call

probe::sunrpc.sched.new_task

probe::sunrpc.sched.new_task — Create new task for the specified client

Synopsis

sunrpc.sched.new_task

Values

xid the transmission id in the RPC call tk_flags the flags of the task prot the IP protocol in the RPC call vers the program version in the RPC call prog the program number in the RPC call

probe::sunrpc.sched.release_task

probe::sunrpc.sched.release_task — Release all resources associated with a task

Synopsis

sunrpc.sched.release_task

Values

xid the transmission id in the RPC call tk_flags the flags of the task prot the IP protocol in the RPC call vers the program version in the RPC call prog the program number in the RPC call

Description

rpc_release_task function might not be found for a particular kernel. So, if we can't find it, just return '-1' for everything.

probe::sunrpc.svc.create

probe::sunrpc.svc.create — Create an RPC service

Synopsis

sunrpc.svc.create

Values

pg_nvers the number of supported versions prog the number of the program progname the name of the program bufsize the buffer size

probe::sunrpc.svc.destroy

probe::sunrpc.svc.destroy — Destroy an RPC service

Synopsis

sunrpc.svc.destroy

Values

netcnt the count of received RPC requests rpcbadfmt the count of requests dropped for bad formats nettcpconn the count of accepted TCP connections rpcbadauth the count of requests drooped for authentication failure sv_name the service name sv_prog the number of the program sv_progname the name of the program rpccnt the count of valid RPC requests sv_nrthreads the number of concurrent threads

probe::sunrpc.svc.drop

probe::sunrpc.svc.drop — Drop RPC request

Synopsis

sunrpc.svc.drop

Values

rq_prot the IP protocol of the reqeust rq_proc the procedure number in the request rq_vers the program version in the request sv_name the service name peer_ip the peer address where the request is from rq_prog the program number in the request rq_xid the transmission id in the request

probe::sunrpc.svc.process

probe::sunrpc.svc.process — Process an RPC request

Synopsis

sunrpc.svc.process

Values

rq_prot the IP protocol of the reqeust rq_proc the procedure number in the request sv_name the service name rq_vers the program version in the request sv_prog the number of the program rq_prog the program number in the request rq_xid the transmission id in the request peer_ip the peer address where the request is from sv_nrthreads the number of concurrent threads

probe::sunrpc.svc.recv

probe::sunrpc.svc.recv — Listen for the next RPC request on any socket

Synopsis

sunrpc.svc.recv

Values

sv_prog the number of the program sv_nrthreads the number of concurrent threads sv_name the service name timeout the timeout of waiting for data

probe::sunrpc.svc.register

probe::sunrpc.svc.register — Register an RPC service with the local portmapper

Synopsis

sunrpc.svc.register

Values

port the port number progname the name of the program sv_name the service name prog the number of the program prot the IP protocol number

Description

If proto and port are both 0, then unregister a service.

probe::sunrpc.svc.send

probe::sunrpc.svc.send — Return reply to RPC client

Synopsis

sunrpc.svc.send

Values

rq_prot the IP protocol of the reqeust peer_ip the peer address where the request is from rq_prog the program number in the request rq_xid the transmission id in the request rq_proc the procedure number in the request rq_vers the program version in the request sv_name the service name

probe::tcp.disconnect

probe::tcp.disconnect — TCP socket disconnection

Synopsis

tcp.disconnect

Values

flags TCP flags (e.g. FIN, etc) daddr A string representing the destination IP address family IP address family sock Network socket saddr A string representing the source IP address name Name of this probe dport TCP destination port sport TCP source port

Context

The process which disconnects tcp

probe::tcp.disconnect.return

probe::tcp.disconnect.return — TCP socket disconnection complete

Synopsis

tcp.disconnect.return

Values

ret Error code (0: no error) name Name of this probe

Context

The process which disconnects tcp

probe::tcp.receive

probe::tcp.receive — Called when a TCP packet is received

Synopsis

tcp.receive

Values

rst TCP RST flag urg TCP URG flag fin TCP FIN flag syn TCP SYN flag ack TCP ACK flag protocol Packet protocol from driver daddr A string representing the destination IP address saddr A string representing the source IP address family IP address family psh TCP PSH flag name Name of the probe point sport TCP source port iphdr IP header address dport TCP destination port

probe::tcp.recvmsg

probe::tcp.recvmsg — Receiving TCP message

Synopsis

tcp.recvmsg

Values

saddr A string representing the source IP address family IP address family sock Network socket sport TCP source port dport TCP destination port name Name of this probe size Number of bytes to be received daddr A string representing the destination IP address

Context

The process which receives a tcp message

probe::tcp.recvmsg.return

probe::tcp.recvmsg.return — Receiving TCP message complete

Synopsis

tcp.recvmsg.return

Values

size Number of bytes received or error code if an error occurred. daddr A string representing the destination IP address saddr A string representing the source IP address family IP address family name Name of this probe sport TCP source port dport TCP destination port

Context

The process which receives a tcp message

probe::tcp.sendmsg

probe::tcp.sendmsg — Sending a tcp message

Synopsis

tcp.sendmsg

Values

name Name of this probe family IP address family size Number of bytes to send sock Network socket

Context

The process which sends a tcp message

probe::tcp.sendmsg.return

probe::tcp.sendmsg.return — Sending TCP message is done

Synopsis

tcp.sendmsg.return

Values

size Number of bytes sent or error code if an error occurred. name Name of this probe

Context

The process which sends a tcp message

probe::tcp.setsockopt

probe::tcp.setsockopt — Call to setsockopt

Synopsis

tcp.setsockopt

Values

optstr Resolves optname to a human-readable format optlen Used to access values for setsockopt level The level at which the socket options will be manipulated name Name of this probe optname TCP socket options (e.g. TCP_NODELAY, TCP_MAXSEG, etc) sock Network socket family IP address family

Context

The process which calls setsockopt

probe::tcp.setsockopt.return

probe::tcp.setsockopt.return — Return from setsockopt

Synopsis

tcp.setsockopt.return

Values

ret Error code (0: no error) name Name of this probe

Context

The process which calls setsockopt

probe::udp.disconnect

probe::udp.disconnect — Fires when a process requests for a UDP disconnection

Synopsis

udp.disconnect

Values

name The name of this probe sport UDP source port flags Flags (e.g. FIN, etc) saddr A string representing the source IP address family IP address family dport UDP destination port sock Network socket used by the process daddr A string representing the destination IP address

Context

The process which requests a UDP disconnection

probe::udp.disconnect.return

probe::udp.disconnect.return — UDP has been disconnected successfully

Synopsis

udp.disconnect.return

Values

daddr A string representing the destination IP address ret Error code (0: no error) family IP address family dport UDP destination port saddr A string representing the source IP address sport UDP source port name The name of this probe

Context

The process which requested a UDP disconnection

probe::udp.recvmsg

probe::udp.recvmsg — Fires whenever a UDP message is received

Synopsis

udp.recvmsg

Values

sock Network socket used by the process daddr A string representing the destination IP address family IP address family dport UDP destination port size Number of bytes received by the process sport UDP source port name The name of this probe saddr A string representing the source IP address

Context

The process which received a UDP message

probe::udp.recvmsg.return

probe::udp.recvmsg.return — Fires whenever an attempt to receive a UDP message received is completed

Synopsis

udp.recvmsg.return

Values

family IP address family dport UDP destination port size Number of bytes received by the process sport UDP source port name The name of this probe saddr A string representing the source IP address daddr A string representing the destination IP address

Context

The process which received a UDP message

probe::udp.sendmsg

probe::udp.sendmsg — Fires whenever a process sends a UDP message

Synopsis

udp.sendmsg

Values

sock Network socket used by the process daddr A string representing the destination IP address family IP address family dport UDP destination port size Number of bytes sent by the process name The name of this probe sport UDP source port saddr A string representing the source IP address

Context

The process which sent a UDP message

probe::udp.sendmsg.return

probe::udp.sendmsg.return — Fires whenever an attempt to send a UDP message is completed

Synopsis

udp.sendmsg.return

Values

name The name of this probe size Number of bytes sent by the process

Context

The process which sent a UDP message

Chapter 14. Socket Tapset

This family of probe points is used to probe socket activities. It contains the following probe points:

function::inet_get_ip_source

function::inet_get_ip_source — Provide IP source address string for a kernel socket

Synopsis

inet_get_ip_source:string(sock:long)

Arguments

sock pointer to the kernel socket

function::inet_get_local_port

function::inet_get_local_port — Provide local port number for a kernel socket

Synopsis

inet_get_local_port:long(sock:long)

Arguments

sock pointer to the kernel socket

function::sock_fam_num2str

function::sock_fam_num2str — Given a protocol family number, return a string representation

Synopsis

sock_fam_num2str:string(family:long)

Arguments

family The family number

function::sock_fam_str2num

function::sock_fam_str2num — Given a protocol family name (string), return the corresponding protocol family number

Synopsis

sock_fam_str2num:long(family:string)

Arguments

family The family name

function::sock_prot_num2str

function::sock_prot_num2str — Given a protocol number, return a string representation

Synopsis

sock_prot_num2str:string(proto:long)

Arguments

proto The protocol number

function::sock_prot_str2num

function::sock_prot_str2num — Given a protocol name (string), return the corresponding protocol number

Synopsis

sock_prot_str2num:long(proto:string)

Arguments

proto The protocol name

function::sock_state_num2str

function::sock_state_num2str — Given a socket state number, return a string representation

Synopsis

sock_state_num2str:string(state:long)

Arguments

state The state number

function::sock_state_str2num

function::sock_state_str2num — Given a socket state string, return the corresponding state number

Synopsis

sock_state_str2num:long(state:string)

Arguments

state The state name

probe::socket.aio_read

probe::socket.aio_read — Receiving message via sock_aio_read

Synopsis

socket.aio_read

Values

protocol Protocol value size Message size in bytes state Socket state value name Name of this probe type Socket type value family Protocol family value flags Socket flags value

Context

The message sender

Description

Fires at the beginning of receiving a message on a socket via the sock_aio_read function

probe::socket.aio_read.return

probe::socket.aio_read.return — Conclusion of message received via sock_aio_read

Synopsis

socket.aio_read.return

Values

protocol Protocol value size Size of message received (in bytes) or error code if success = 0 state Socket state value type Socket type value family Protocol family value success Was receive successful? (1 = yes, 0 = no) name Name of this probe flags Socket flags value

Context

The message receiver.

Description

Fires at the conclusion of receiving a message on a socket via the sock_aio_read function

probe::socket.aio_write

probe::socket.aio_write — Message send via sock_aio_write

Synopsis

socket.aio_write

Values

protocol Protocol value state Socket state value size Message size in bytes family Protocol family value type Socket type value name Name of this probe flags Socket flags value

Context

The message sender

Description

Fires at the beginning of sending a message on a socket via the sock_aio_write function

probe::socket.aio_write.return

probe::socket.aio_write.return — Conclusion of message send via sock_aio_write

Synopsis

socket.aio_write.return

Values

size Size of message received (in bytes) or error code if success = 0 state Socket state value protocol Protocol value flags Socket flags value success Was receive successful? (1 = yes, 0 = no) name Name of this probe type Socket type value family Protocol family value

Context

The message receiver.

Description

Fires at the conclusion of sending a message on a socket via the sock_aio_write function

probe::socket.close

probe::socket.close — Close a socket

Synopsis

socket.close

Values

name Name of this probe family Protocol family value type Socket type value flags Socket flags value protocol Protocol value state Socket state value

Context

The requester (user process or kernel)

Description

Fires at the beginning of closing a socket.

probe::socket.close.return

probe::socket.close.return — Return from closing a socket

Synopsis

socket.close.return

Values

name Name of this probe

Context

The requester (user process or kernel)

Description

Fires at the conclusion of closing a socket.

probe::socket.create

probe::socket.create — Creation of a socket

Synopsis

socket.create

Values

protocol Protocol value family Protocol family value type Socket type value name Name of this probe requester Requested by user process or the kernel (1 = kernel, 0 = user)

Context

The requester (see requester variable)

Description

Fires at the beginning of creating a socket.

probe::socket.create.return

probe::socket.create.return — Return from Creation of a socket

Synopsis

socket.create.return

Values

requester Requested by user process or the kernel (1 = kernel, 0 = user) success Was socket creation successful? (1 = yes, 0 = no) err Error code if success == 0 name Name of this probe type Socket type value family Protocol family value protocol Protocol value

Context

The requester (user process or kernel)

Description

Fires at the conclusion of creating a socket.

probe::socket.read_iter

probe::socket.read_iter — Receiving message via sock_read_iter

Synopsis

socket.read_iter

Values

protocol Protocol value size Message size in bytes state Socket state value name Name of this probe type Socket type value family Protocol family value flags Socket flags value

Context

The message sender

Description

Fires at the beginning of receiving a message on a socket via the sock_read_iter function

probe::socket.read_iter.return

probe::socket.read_iter.return — Conclusion of message received via sock_read_iter

Synopsis

socket.read_iter.return

Values

protocol Protocol value size Size of message received (in bytes) or error code if success = 0 state Socket state value type Socket type value family Protocol family value success Was receive successful? (1 = yes, 0 = no) name Name of this probe flags Socket flags value

Context

The message receiver.

Description

Fires at the conclusion of receiving a message on a socket via the sock_read_iter function

probe::socket.readv

probe::socket.readv — Receiving a message via sock_readv

Synopsis

socket.readv

Values

state Socket state value size Message size in bytes protocol Protocol value flags Socket flags value family Protocol family value type Socket type value name Name of this probe

Context

The message sender

Description

Fires at the beginning of receiving a message on a socket via the sock_readv function

probe::socket.readv.return

probe::socket.readv.return — Conclusion of receiving a message via sock_readv

Synopsis

socket.readv.return

Values

state Socket state value size Size of message received (in bytes) or error code if success = 0 protocol Protocol value flags Socket flags value name Name of this probe success Was receive successful? (1 = yes, 0 = no) family Protocol family value type Socket type value

Context

The message receiver.

Description

Fires at the conclusion of receiving a message on a socket via the sock_readv function

probe::socket.receive

probe::socket.receive — Message received on a socket.

Synopsis

socket.receive

Values

type Socket type value family Protocol family value success Was send successful? (1 = yes, 0 = no) name Name of this probe flags Socket flags value protocol Protocol value size Size of message received (in bytes) or error code if success = 0 state Socket state value

Context

The message receiver

probe::socket.recvmsg

probe::socket.recvmsg — Message being received on socket

Synopsis

socket.recvmsg

Values

protocol Protocol value size Message size in bytes state Socket state value type Socket type value family Protocol family value name Name of this probe flags Socket flags value

Context

The message receiver.

Description

Fires at the beginning of receiving a message on a socket via the sock_recvmsg function

probe::socket.recvmsg.return

probe::socket.recvmsg.return — Return from Message being received on socket

Synopsis

socket.recvmsg.return

Values

protocol Protocol value state Socket state value size Size of message received (in bytes) or error code if success = 0 name Name of this probe success Was receive successful? (1 = yes, 0 = no) family Protocol family value type Socket type value flags Socket flags value

Context

The message receiver.

Description

Fires at the conclusion of receiving a message on a socket via the sock_recvmsg function.

probe::socket.send

probe::socket.send — Message sent on a socket.

Synopsis

socket.send

Values

family Protocol family value type Socket type value name Name of this probe success Was send successful? (1 = yes, 0 = no) flags Socket flags value protocol Protocol value state Socket state value size Size of message sent (in bytes) or error code if success = 0

Context

The message sender

probe::socket.sendmsg

probe::socket.sendmsg — Message is currently being sent on a socket.

Synopsis

socket.sendmsg

Values

state Socket state value size Message size in bytes protocol Protocol value flags Socket flags value name Name of this probe family Protocol family value type Socket type value

Context

The message sender

Description

Fires at the beginning of sending a message on a socket via the sock_sendmsg function

probe::socket.sendmsg.return

probe::socket.sendmsg.return — Return from socket.sendmsg.

Synopsis

socket.sendmsg.return

Values

flags Socket flags value type Socket type value family Protocol family value success Was send successful? (1 = yes, 0 = no) name Name of this probe size Size of message sent (in bytes) or error code if success = 0 state Socket state value protocol Protocol value

Context

The message sender.

Description

Fires at the conclusion of sending a message on a socket via the sock_sendmsg function

probe::socket.write_iter

probe::socket.write_iter — Message send via sock_write_iter

Synopsis

socket.write_iter

Values

name Name of this probe type Socket type value family Protocol family value flags Socket flags value protocol Protocol value size Message size in bytes state Socket state value

Context

The message sender

Description

Fires at the beginning of sending a message on a socket via the sock_write_iter function

probe::socket.write_iter.return

probe::socket.write_iter.return — Conclusion of message send via sock_write_iter

Synopsis

socket.write_iter.return

Values

size Size of message received (in bytes) or error code if success = 0 state Socket state value protocol Protocol value flags Socket flags value success Was receive successful? (1 = yes, 0 = no) name Name of this probe type Socket type value family Protocol family value

Context

The message receiver.

Description

Fires at the conclusion of sending a message on a socket via the sock_write_iter function

probe::socket.writev

probe::socket.writev — Message sent via socket_writev

Synopsis

socket.writev

Values

protocol Protocol value size Message size in bytes state Socket state value type Socket type value family Protocol family value name Name of this probe flags Socket flags value

Context

The message sender

Description

Fires at the beginning of sending a message on a socket via the sock_writev function

probe::socket.writev.return

probe::socket.writev.return — Conclusion of message sent via socket_writev

Synopsis

socket.writev.return

Values

size Size of message sent (in bytes) or error code if success = 0 state Socket state value protocol Protocol value flags Socket flags value type Socket type value family Protocol family value success Was send successful? (1 = yes, 0 = no) name Name of this probe

Context

The message receiver.

Description

Fires at the conclusion of sending a message on a socket via the sock_writev function

Chapter 15. SNMP Information Tapset

This family of probe points is used to probe socket activities to provide SNMP type information. It contains the following functions and probe points:

function::ipmib_filter_key

function::ipmib_filter_key — Default filter function for ipmib.* probes

Synopsis

ipmib_filter_key:long(skb:long,op:long,SourceIsLocal:long)

Arguments

skb pointer to the struct sk_buff op value to be counted if skb passes the filter SourceIsLocal 1 is local operation and 0 is non-local operation

Description

This function is a default filter function. The user can replace this function with their own. The user- supplied filter function returns an index key based on the values in skb. A return value of 0 means this particular skb should be not be counted.

function::ipmib_get_proto

function::ipmib_get_proto — Get the protocol value

Synopsis

ipmib_get_proto:long(skb:long)

Arguments

skb pointer to a struct sk_buff

Description

Returns the protocol value from skb.

function::ipmib_local_addr

function::ipmib_local_addr — Get the local ip address

Synopsis

ipmib_local_addr:long(skb:long,SourceIsLocal:long)

Arguments

skb pointer to a struct sk_buff SourceIsLocal flag to indicate whether local operation

Description

Returns the local ip address skb.

function::ipmib_remote_addr

function::ipmib_remote_addr — Get the remote ip address

Synopsis

ipmib_remote_addr:long(skb:long,SourceIsLocal:long)

Arguments

skb pointer to a struct sk_buff SourceIsLocal flag to indicate whether local operation

Description

Returns the remote ip address from skb.

function::ipmib_tcp_local_port

function::ipmib_tcp_local_port — Get the local tcp port

Synopsis

ipmib_tcp_local_port:long(skb:long,SourceIsLocal:long)

Arguments

skb pointer to a struct sk_buff SourceIsLocal flag to indicate whether local operation

Description

Returns the local tcp port from skb.

function::ipmib_tcp_remote_port

function::ipmib_tcp_remote_port — Get the remote tcp port

Synopsis

ipmib_tcp_remote_port:long(skb:long,SourceIsLocal:long)

Arguments

skb pointer to a struct sk_buff SourceIsLocal flag to indicate whether local operation

Description

Returns the remote tcp port from skb.

function::linuxmib_filter_key

function::linuxmib_filter_key — Default filter function for linuxmib.* probes

Synopsis

linuxmib_filter_key:long(sk:long,op:long)

Arguments

sk pointer to the struct sock op value to be counted if sk passes the filter

Description

This function is a default filter function. The user can replace this function with their own. The user- supplied filter function returns an index key based on the values in sk. A return value of 0 means this particular sk should be not be counted.

function::tcpmib_filter_key

function::tcpmib_filter_key — Default filter function for tcpmib.* probes

Synopsis

tcpmib_filter_key:long(sk:long,op:long)

Arguments

sk pointer to the struct sock being acted on op value to be counted if sk passes the filter

Description

This function is a default filter function. The user can replace this function with their own. The user- supplied filter function returns an index key based on the values in sk. A return value of 0 means this particular sk should be not be counted.

function::tcpmib_get_state

function::tcpmib_get_state — Get a socket's state

Synopsis

tcpmib_get_state:long(sk:long)

Arguments

sk pointer to a struct sock

Description

Returns the sk_state from a struct sock.

function::tcpmib_local_addr

function::tcpmib_local_addr — Get the source address

Synopsis

tcpmib_local_addr:long(sk:long)

Arguments

sk pointer to a struct inet_sock

Description

Returns the saddr from a struct inet_sock in host order.

function::tcpmib_local_port

function::tcpmib_local_port — Get the local port

Synopsis

tcpmib_local_port:long(sk:long)

Arguments

sk pointer to a struct inet_sock

Description

Returns the sport from a struct inet_sock in host order.

function::tcpmib_remote_addr

function::tcpmib_remote_addr — Get the remote address

Synopsis

tcpmib_remote_addr:long(sk:long)

Arguments

sk pointer to a struct inet_sock

Description

Returns the daddr from a struct inet_sock in host order.

function::tcpmib_remote_port

function::tcpmib_remote_port — Get the remote port

Synopsis

tcpmib_remote_port:long(sk:long)

Arguments

sk pointer to a struct inet_sock

Description

Returns the dport from a struct inet_sock in host order.

probe::ipmib.ForwDatagrams

probe::ipmib.ForwDatagrams — Count forwarded packet

Synopsis

ipmib.ForwDatagrams

Values

op value to be added to the counter (default value of 1) skb pointer to the struct sk_buff being acted on

Description

The packet pointed to by skb is filtered by the function ipmib_filter_key. If the packet passes the filter is is counted in the global ForwDatagrams (equivalent to SNMP's MIB IPSTATS_MIB_OUTFORWDATAGRAMS)

probe::ipmib.FragFails

probe::ipmib.FragFails — Count datagram fragmented unsuccessfully

Synopsis

ipmib.FragFails

Values

skb pointer to the struct sk_buff being acted on op Value to be added to the counter (default value of 1)

Description

The packet pointed to by skb is filtered by the function ipmib_filter_key. If the packet passes the filter is is counted in the global FragFails (equivalent to SNMP's MIB IPSTATS_MIB_FRAGFAILS)

probe::ipmib.FragOKs

probe::ipmib.FragOKs — Count datagram fragmented successfully

Synopsis

ipmib.FragOKs

Values

skb pointer to the struct sk_buff being acted on op value to be added to the counter (default value of 1)

Description

The packet pointed to by skb is filtered by the function ipmib_filter_key. If the packet passes the filter is is counted in the global FragOKs (equivalent to SNMP's MIB IPSTATS_MIB_FRAGOKS)

probe::ipmib.InAddrErrors

probe::ipmib.InAddrErrors — Count arriving packets with an incorrect address

Synopsis

ipmib.InAddrErrors

Values

op value to be added to the counter (default value of 1) skb pointer to the struct sk_buff being acted on

Description

The packet pointed to by skb is filtered by the function ipmib_filter_key. If the packet passes the filter is is counted in the global InAddrErrors (equivalent to SNMP's MIB IPSTATS_MIB_INADDRERRORS)

probe::ipmib.InDiscards

probe::ipmib.InDiscards — Count discarded inbound packets

Synopsis

ipmib.InDiscards

Values

op value to be added to the counter (default value of 1) skb pointer to the struct sk_buff being acted on

Description

The packet pointed to by skb is filtered by the function ipmib_filter_key. If the packet passes the filter is is counted in the global InDiscards (equivalent to SNMP's MIB STATS_MIB_INDISCARDS)

probe::ipmib.InNoRoutes

probe::ipmib.InNoRoutes — Count an arriving packet with no matching socket

Synopsis

ipmib.InNoRoutes

Values

skb pointer to the struct sk_buff being acted on op value to be added to the counter (default value of 1)

Description

The packet pointed to by skb is filtered by the function ipmib_filter_key. If the packet passes the filter is is counted in the global InNoRoutes (equivalent to SNMP's MIB IPSTATS_MIB_INNOROUTES)

probe::ipmib.InReceives

probe::ipmib.InReceives — Count an arriving packet

Synopsis

ipmib.InReceives

Values

skb pointer to the struct sk_buff being acted on op value to be added to the counter (default value of 1)

Description

The packet pointed to by skb is filtered by the function ipmib_filter_key. If the packet passes the filter is is counted in the global InReceives (equivalent to SNMP's MIB IPSTATS_MIB_INRECEIVES)

probe::ipmib.InUnknownProtos

probe::ipmib.InUnknownProtos — Count arriving packets with an unbound proto

Synopsis

ipmib.InUnknownProtos

Values

skb pointer to the struct sk_buff being acted on op value to be added to the counter (default value of 1)

Description

The packet pointed to by skb is filtered by the function ipmib_filter_key. If the packet passes the filter is is counted in the global InUnknownProtos (equivalent to SNMP's MIB IPSTATS_MIB_INUNKNOWNPROTOS)

probe::ipmib.OutRequests

probe::ipmib.OutRequests — Count a request to send a packet

Synopsis

ipmib.OutRequests

Values

op value to be added to the counter (default value of 1) skb pointer to the struct sk_buff being acted on

Description

The packet pointed to by skb is filtered by the function ipmib_filter_key. If the packet passes the filter is is counted in the global OutRequests (equivalent to SNMP's MIB IPSTATS_MIB_OUTREQUESTS)

probe::ipmib.ReasmReqds

probe::ipmib.ReasmReqds — Count number of packet fragments reassembly requests

Synopsis

ipmib.ReasmReqds

Values

op value to be added to the counter (default value of 1) skb pointer to the struct sk_buff being acted on

Description

The packet pointed to by skb is filtered by the function ipmib_filter_key. If the packet passes the filter is is counted in the global ReasmReqds (equivalent to SNMP's MIB IPSTATS_MIB_REASMREQDS)

probe::ipmib.ReasmTimeout

probe::ipmib.ReasmTimeout — Count Reassembly Timeouts

Synopsis

ipmib.ReasmTimeout

Values

skb pointer to the struct sk_buff being acted on op value to be added to the counter (default value of 1)

Description

The packet pointed to by skb is filtered by the function ipmib_filter_key. If the packet passes the filter is is counted in the global ReasmTimeout (equivalent to SNMP's MIB IPSTATS_MIB_REASMTIMEOUT)

probe::linuxmib.DelayedACKs

probe::linuxmib.DelayedACKs — Count of delayed acks

Synopsis

linuxmib.DelayedACKs

Values

sk Pointer to the struct sock being acted on op Value to be added to the counter (default value of 1)

Description

The packet pointed to by skb is filtered by the function linuxmib_filter_key. If the packet passes the filter is is counted in the global DelayedACKs (equivalent to SNMP's MIB LINUX_MIB_DELAYEDACKS)

probe::linuxmib.ListenDrops

probe::linuxmib.ListenDrops — Count of times conn request that were dropped

Synopsis

linuxmib.ListenDrops

Values

sk Pointer to the struct sock being acted on op Value to be added to the counter (default value of 1)

Description

The packet pointed to by skb is filtered by the function linuxmib_filter_key. If the packet passes the filter is is counted in the global ListenDrops (equivalent to SNMP's MIB LINUX_MIB_LISTENDROPS)

probe::linuxmib.ListenOverflows

probe::linuxmib.ListenOverflows — Count of times a listen queue overflowed

Synopsis

linuxmib.ListenOverflows

Values

sk Pointer to the struct sock being acted on op Value to be added to the counter (default value of 1)

Description

The packet pointed to by skb is filtered by the function linuxmib_filter_key. If the packet passes the filter is is counted in the global ListenOverflows (equivalent to SNMP's MIB LINUX_MIB_LISTENOVERFLOWS)

probe::linuxmib.TCPMemoryPressures

probe::linuxmib.TCPMemoryPressures — Count of times memory pressure was used

Synopsis

linuxmib.TCPMemoryPressures

Values

op Value to be added to the counter (default value of 1) sk Pointer to the struct sock being acted on

Description

The packet pointed to by skb is filtered by the function linuxmib_filter_key. If the packet passes the filter is is counted in the global TCPMemoryPressures (equivalent to SNMP's MIB LINUX_MIB_TCPMEMORYPRESSURES)

probe::tcpmib.ActiveOpens

probe::tcpmib.ActiveOpens — Count an active opening of a socket

Synopsis

tcpmib.ActiveOpens

Values

op value to be added to the counter (default value of 1) sk pointer to the struct sock being acted on

Description

The packet pointed to by skb is filtered by the function tcpmib_filter_key. If the packet passes the filter is is counted in the global ActiveOpens (equivalent to SNMP's MIB TCP_MIB_ACTIVEOPENS)

probe::tcpmib.AttemptFails

probe::tcpmib.AttemptFails — Count a failed attempt to open a socket

Synopsis

tcpmib.AttemptFails

Values

sk pointer to the struct sock being acted on op value to be added to the counter (default value of 1)

Description

The packet pointed to by skb is filtered by the function tcpmib_filter_key. If the packet passes the filter is is counted in the global AttemptFails (equivalent to SNMP's MIB TCP_MIB_ATTEMPTFAILS)

probe::tcpmib.CurrEstab

probe::tcpmib.CurrEstab — Update the count of open sockets

Synopsis

tcpmib.CurrEstab

Values

sk pointer to the struct sock being acted on op value to be added to the counter (default value of 1)

Description

The packet pointed to by skb is filtered by the function tcpmib_filter_key. If the packet passes the filter is is counted in the global CurrEstab (equivalent to SNMP's MIB TCP_MIB_CURRESTAB)

probe::tcpmib.EstabResets

probe::tcpmib.EstabResets — Count the reset of a socket

Synopsis

tcpmib.EstabResets

Values

sk pointer to the struct sock being acted on op value to be added to the counter (default value of 1)

Description

The packet pointed to by skb is filtered by the function tcpmib_filter_key. If the packet passes the filter is is counted in the global EstabResets (equivalent to SNMP's MIB TCP_MIB_ESTABRESETS)

probe::tcpmib.InSegs

probe::tcpmib.InSegs — Count an incoming tcp segment

Synopsis

tcpmib.InSegs

Values

sk pointer to the struct sock being acted on op value to be added to the counter (default value of 1)

Description

The packet pointed to by skb is filtered by the function tcpmib_filter_key (or ipmib_filter_key for tcp v4). If the packet passes the filter is is counted in the global InSegs (equivalent to SNMP's MIB TCP_MIB_INSEGS)

probe::tcpmib.OutRsts

probe::tcpmib.OutRsts — Count the sending of a reset packet

Synopsis

tcpmib.OutRsts

Values

op value to be added to the counter (default value of 1) sk pointer to the struct sock being acted on

Description

The packet pointed to by skb is filtered by the function tcpmib_filter_key. If the packet passes the filter is is counted in the global OutRsts (equivalent to SNMP's MIB TCP_MIB_OUTRSTS)

probe::tcpmib.OutSegs

probe::tcpmib.OutSegs — Count the sending of a TCP segment

Synopsis

tcpmib.OutSegs

Values

sk pointer to the struct sock being acted on op value to be added to the counter (default value of 1)

Description

The packet pointed to by skb is filtered by the function tcpmib_filter_key. If the packet passes the filter is is counted in the global OutSegs (equivalent to SNMP's MIB TCP_MIB_OUTSEGS)

probe::tcpmib.PassiveOpens

probe::tcpmib.PassiveOpens — Count the passive creation of a socket

Synopsis

tcpmib.PassiveOpens

Values

sk pointer to the struct sock being acted on op value to be added to the counter (default value of 1)

Description

The packet pointed to by skb is filtered by the function tcpmib_filter_key. If the packet passes the filter is is counted in the global PassiveOpens (equivalent to SNMP's MIB TCP_MIB_PASSIVEOPENS)

probe::tcpmib.RetransSegs

probe::tcpmib.RetransSegs — Count the retransmission of a TCP segment

Synopsis

tcpmib.RetransSegs

Values

op value to be added to the counter (default value of 1) sk pointer to the struct sock being acted on

Description

The packet pointed to by skb is filtered by the function tcpmib_filter_key. If the packet passes the filter is is counted in the global RetransSegs (equivalent to SNMP's MIB TCP_MIB_RETRANSSEGS)

Chapter 16. Kernel Process Tapset

This family of probe points is used to probe process-related activities. It contains the following probe points:

function::get_loadavg_index

function::get_loadavg_index — Get the load average for a specified interval

Synopsis

get_loadavg_index:long(indx:long)

Arguments

indx The load average interval to capture.

Description

This function returns the load average at a specified interval. The three load average values 1, 5 and 15 minute average corresponds to indexes 0, 1 and 2 of the avenrun array - see linux/sched.h. Please note that the truncated-integer portion of the load average is returned. If the specified index is out-of-bounds, then an error message and exception is thrown.

function::sprint_loadavg

function::sprint_loadavg — Report a pretty-printed load average

Synopsis

sprint_loadavg:string()

Arguments

None

Description

Returns the a string with three decimal numbers in the usual format for 1-, 5- and 15-minute load averages.

function::target_set_pid

function::target_set_pid — Does pid descend from target process?

Synopsis

target_set_pid(pid:)

Arguments

pid The pid of the process to query

Description

This function returns whether the given process-id is within the “target set”, that is whether it is a descendant of the top-level target process.

function::target_set_report

function::target_set_report — Print a report about the target set

Synopsis

target_set_report()

Arguments

None

Description

This function prints a report about the processes in the target set, and their ancestry.

probe::kprocess.create

probe::kprocess.create — Fires whenever a new process or thread is successfully created

Synopsis

kprocess.create

Values

new_pid The PID of the newly created process new_tid The TID of the newly created task

Context

Parent of the created process.

Description

Fires whenever a new process is successfully created, either as a result of fork (or one of its syscall variants), or a new kernel thread.

probe::kprocess.exec

probe::kprocess.exec — Attempt to exec to a new program

Synopsis

kprocess.exec

Values

name Name of the system call (“execve”) (SystemTap v2.5+) args The Arguments to pass to the new executable, including the 0th arg (SystemTap v2.5+) filename The path to the new executable argstr A string containing the filename followed by the Arguments to pass, excluding 0th arg (SystemTap v2.5+)

Context

The caller of exec.

Description

Fires whenever a process attempts to exec to a new program. Aliased to the syscall.execve probe in SystemTap v2.5+.

probe::kprocess.exec_complete

probe::kprocess.exec_complete — Return from exec to a new program

Synopsis

kprocess.exec_complete

Values

name Name of the system call (“execve”) (SystemTap v2.5+) errno The error number resulting from the exec success A boolean indicating whether the exec was successful retstr A string representation of errno (SystemTap v2.5+)

Context

On success, the context of the new executable. On failure, remains in the context of the caller.

Description

Fires at the completion of an exec call. Aliased to the syscall.execve.return probe in SystemTap v2.5+.

probe::kprocess.exit

probe::kprocess.exit — Exit from process

Synopsis

kprocess.exit

Values

code The exit code of the process

Context

The process which is terminating.

Description

Fires when a process terminates. This will always be followed by a kprocess.release, though the latter may be delayed if the process waits in a zombie state.

probe::kprocess.release

probe::kprocess.release — Process released

Synopsis

kprocess.release

Values

task A task handle to the process being released released_pid PID of the process being released pid Same as released_pid for compatibility (deprecated) released_tid TID of the task being released

Context

The context of the parent, if it wanted notification of this process' termination, else the context of the process itself.

Description

Fires when a process is released from the kernel. This always follows a kprocess.exit, though it may be delayed somewhat if the process waits in a zombie state.

probe::kprocess.start

probe::kprocess.start — Starting new process

Synopsis

kprocess.start

Values

None

Context

Newly created process.

Description

Fires immediately before a new process begins execution.

Chapter 17. Signal Tapset

This family of probe points is used to probe signal activities. It contains the following probe points:

function::get_sa_flags

function::get_sa_flags — Returns the numeric value of sa_flags

Synopsis

get_sa_flags:long(act:long)

Arguments

act address of the sigaction to query.

function::get_sa_handler

function::get_sa_handler — Returns the numeric value of sa_handler

Synopsis

get_sa_handler:long(act:long)

Arguments

act address of the sigaction to query.

function::is_sig_blocked

function::is_sig_blocked — Returns 1 if the signal is currently blocked, or 0 if it is not

Synopsis

is_sig_blocked:long(task:long,sig:long)

Arguments

task address of the task_struct to query. sig the signal number to test.

function::sa_flags_str

function::sa_flags_str — Returns the string representation of sa_flags

Synopsis

sa_flags_str:string(sa_flags:long)

Arguments

sa_flags the set of flags to convert to string.

function::sa_handler_str

function::sa_handler_str — Returns the string representation of an sa_handler

Synopsis

sa_handler_str(handler:)

Arguments

handler the sa_handler to convert to string.

Description

Returns the string representation of an sa_handler. If it is not SIG_DFL, SIG_IGN or SIG_ERR, it will return the address of the handler.

function::signal_str

function::signal_str — Returns the string representation of a signal number

Synopsis

signal_str(num:)

Arguments

num the signal number to convert to string.

function::sigset_mask_str

function::sigset_mask_str — Returns the string representation of a sigset

Synopsis

sigset_mask_str:string(mask:long)

Arguments

mask the sigset to convert to string.

probe::signal.check_ignored

probe::signal.check_ignored — Checking to see signal is ignored

Synopsis

signal.check_ignored

Values

pid_name Name of the process receiving the signal sig The number of the signal sig_name A string representation of the signal sig_pid The PID of the process receiving the signal

probe::signal.check_ignored.return

probe::signal.check_ignored.return — Check to see signal is ignored completed

Synopsis

signal.check_ignored.return

Values

retstr Return value as a string name Name of the probe point

probe::signal.checkperm

probe::signal.checkperm — Check being performed on a sent signal

Synopsis

signal.checkperm

Values

name Name of the probe point sig_name A string representation of the signal sig_pid The PID of the process receiving the signal si_code Indicates the signal type sinfo The address of the siginfo structure pid_name Name of the process receiving the signal task A task handle to the signal recipient sig The number of the signal

probe::signal.checkperm.return

probe::signal.checkperm.return — Check performed on a sent signal completed

Synopsis

signal.checkperm.return

Values

retstr Return value as a string name Name of the probe point

probe::signal.do_action

probe::signal.do_action — Examining or changing a signal action

Synopsis

signal.do_action

Values

sig_name A string representation of the signal name Name of the probe point sa_handler The new handler of the signal sa_mask The new mask of the signal oldsigact_addr The address of the old sigaction struct associated with the signal sig The signal to be examined/changed sigact_addr The address of the new sigaction struct associated with the signal

probe::signal.do_action.return

probe::signal.do_action.return — Examining or changing a signal action completed

Synopsis

signal.do_action.return

Values

retstr Return value as a string name Name of the probe point

probe::signal.flush

probe::signal.flush — Flushing all pending signals for a task

Synopsis

signal.flush

Values

sig_pid The PID of the process associated with the task performing the flush name Name of the probe point task The task handler of the process performing the flush pid_name The name of the process associated with the task performing the flush

probe::signal.force_segv

probe::signal.force_segv — Forcing send of SIGSEGV

Synopsis

signal.force_segv

Values

sig The number of the signal pid_name Name of the process receiving the signal name Name of the probe point sig_pid The PID of the process receiving the signal sig_name A string representation of the signal

probe::signal.force_segv.return

probe::signal.force_segv.return — Forcing send of SIGSEGV complete

Synopsis

signal.force_segv.return

Values

name Name of the probe point retstr Return value as a string

probe::signal.handle

probe::signal.handle — Signal handler being invoked

Synopsis

signal.handle

Values

sig The signal number that invoked the signal handler regs The address of the kernel-mode stack area (deprecated in SystemTap 2.1) oldset_addr The address of the bitmask array of blocked signals (deprecated in SystemTap 2.1) sinfo The address of the siginfo table sig_mode Indicates whether the signal was a user-mode or kernel-mode signal name Name of the probe point sig_code The si_code value of the siginfo signal ka_addr The address of the k_sigaction table associated with the signal sig_name A string representation of the signal

probe::signal.handle.return

probe::signal.handle.return — Signal handler invocation completed

Synopsis

signal.handle.return

Values

retstr Return value as a string name Name of the probe point

Description

(deprecated in SystemTap 2.1)

probe::signal.pending

probe::signal.pending — Examining pending signal

Synopsis

signal.pending

Values

sigset_size The size of the user-space signal set name Name of the probe point sigset_add The address of the user-space signal set (sigset_t)

Description

This probe is used to examine a set of signals pending for delivery to a specific thread. This normally occurs when the do_sigpending kernel function is executed.

probe::signal.pending.return

probe::signal.pending.return — Examination of pending signal completed

Synopsis

signal.pending.return

Values

name Name of the probe point retstr Return value as a string

probe::signal.procmask

probe::signal.procmask — Examining or changing blocked signals

Synopsis

signal.procmask

Values

name Name of the probe point how Indicates how to change the blocked signals; possible values are SIG_BLOCK=0 (for blocking signals), SIG_UNBLOCK=1 (for unblocking signals), and SIG_SETMASK=2 for setting the signal mask. oldsigset_addr The old address of the signal set (sigset_t) sigset The actual value to be set for sigset_t (correct?) sigset_addr The address of the signal set (sigset_t) to be implemented

probe::signal.procmask.return

probe::signal.procmask.return — Examining or changing blocked signals completed

Synopsis

signal.procmask.return

Values

retstr Return value as a string name Name of the probe point

probe::signal.send

probe::signal.send — Signal being sent to a process

Synopsis

signal.send

Values

task A task handle to the signal recipient shared Indicates whether the signal is shared by the thread group sinfo The address of siginfo struct pid_name The name of the signal recipient si_code Indicates the signal type sig The number of the signal send2queue Indicates whether the signal is sent to an existing sigqueue (deprecated in SystemTap 2.1) sig_name A string representation of the signal sig_pid The PID of the process receiving the signal name The name of the function used to send out the signal

Context

The signal's sender.

probe::signal.send.return

probe::signal.send.return — Signal being sent to a process completed (deprecated in SystemTap 2.1)

Synopsis

signal.send.return

Values

send2queue Indicates whether the sent signal was sent to an existing sigqueue retstr The return value to either __group_send_sig_info, specific_send_sig_info, or send_sigqueue name The name of the function used to send out the signal shared Indicates whether the sent signal is shared by the thread group.

Context

The signal's sender. (correct?)

Description

Possible __group_send_sig_info and specific_send_sig_info return values are as follows; 0 -- The signal is successfully sent to a process, which means that, (1) the signal was ignored by the receiving process, (2) this is a non-RT signal and the system already has one queued, and (3) the signal was successfully added to the sigqueue of the receiving process. -EAGAIN -- The sigqueue of the receiving process is overflowing, the signal was RT, and the signal was sent by a user using something other than kill. Possible send_group_sigqueue and send_sigqueue return values are as follows; 0 -- The signal was either successfully added into the sigqueue of the receiving process, or a SI_TIMER entry is already queued (in which case, the overrun count will be simply incremented). 1 -- The signal was ignored by the receiving process. -1 -- (send_sigqueue only) The task was marked exiting, allowing * posix_timer_event to redirect it to the group leader.

probe::signal.send_sig_queue

probe::signal.send_sig_queue — Queuing a signal to a process

Synopsis

signal.send_sig_queue

Values

sigqueue_addr The address of the signal queue sig_pid The PID of the process to which the signal is queued sig_name A string representation of the signal name Name of the probe point pid_name Name of the process to which the signal is queued sig The queued signal

probe::signal.send_sig_queue.return

probe::signal.send_sig_queue.return — Queuing a signal to a process completed

Synopsis

signal.send_sig_queue.return

Values

retstr Return value as a string name Name of the probe point

probe::signal.sys_tgkill

probe::signal.sys_tgkill — Sending kill signal to a thread group

Synopsis

signal.sys_tgkill

Values

tgid The thread group ID of the thread receiving the kill signal sig The specific kill signal sent to the process pid_name The name of the signal recipient task A task handle to the signal recipient name Name of the probe point sig_pid The PID of the thread receiving the kill signal sig_name A string representation of the signal

Description

The tgkill call is similar to tkill, except that it also allows the caller to specify the thread group ID of the thread to be signalled. This protects against TID reuse.

probe::signal.sys_tgkill.return

probe::signal.sys_tgkill.return — Sending kill signal to a thread group completed

Synopsis

signal.sys_tgkill.return

Values

name Name of the probe point retstr The return value to either __group_send_sig_info,

probe::signal.sys_tkill

probe::signal.sys_tkill — Sending a kill signal to a thread

Synopsis

signal.sys_tkill

Values

task A task handle to the signal recipient pid_name The name of the signal recipient sig The specific signal sent to the process sig_pid The PID of the process receiving the kill signal sig_name A string representation of the signal name Name of the probe point

Description

The tkill call is analogous to kill(2), except that it also allows a process within a specific thread group to be targeted. Such processes are targeted through their unique thread IDs (TID).

probe::signal.syskill

probe::signal.syskill — Sending kill signal to a process

Synopsis

signal.syskill

Values

name Name of the probe point sig_name A string representation of the signal sig_pid The PID of the process receiving the signal pid_name The name of the signal recipient task A task handle to the signal recipient sig The specific signal sent to the process

probe::signal.syskill.return

probe::signal.syskill.return — Sending kill signal completed

Synopsis

signal.syskill.return

Values

None

probe::signal.systkill.return

probe::signal.systkill.return — Sending kill signal to a thread completed

Synopsis

signal.systkill.return

Values

name Name of the probe point retstr The return value to either __group_send_sig_info,

probe::signal.wakeup

probe::signal.wakeup — Sleeping process being wakened for signal

Synopsis

signal.wakeup

Values

pid_name Name of the process to wake state_mask A string representation indicating the mask of task states to wake. Possible values are TASK_INTERRUPTIBLE, TASK_STOPPED, TASK_TRACED, TASK_WAKEKILL, and TASK_INTERRUPTIBLE. sig_pid The PID of the process to wake resume Indicates whether to wake up a task in a STOPPED or TRACED state

Chapter 18. Errno Tapset

This set of functions is used to handle errno number values. It contains the following functions:

function::errno_str

function::errno_str — Symbolic string associated with error code

Synopsis

errno_str:string(err:long)

Arguments

err The error number received

Description

This function returns the symbolic string associated with the giver error code, such as ENOENT for the number 2, or E#3333 for an out-of-range value such as 3333.