Improvement to disktop.stp: how to find the full file name?

Improvement to disktop.stp: how to find the full file name?

[laurent]

Hi,

I'd like to add disltop.stp the capability to print which file are 
being read/written by each process. It's quite easy to get the filename 
by using the provided __file_pathname function (eg: "kern.log"), but 
I'm unable to figure out how to find the full pathname (eg: 
"/var/log/kern.log"). Any idea on how to do that?

Thanks in advance,

Laurent

Re: Improvement to disktop.stp: how to find the full file name?

[Mark Wielaard]

On Sun, 2010-09-05 at 17:23 +0200, laurent@guerby.net wrote:
> I'd like to add disltop.stp the capability to print which file are 
> being read/written by each process. It's quite easy to get the filename 
> by using the provided __file_pathname function (eg: "kern.log"), but 
> I'm unable to figure out how to find the full pathname (eg: 
> "/var/log/kern.log"). Any idea on how to do that?

dentry.stp provides a function reverse_path_walk() that mostly seems to
do what you want. It takes a dentry, which you could get as follows:

$ stap -e 'probe vfs.read { if (file != 0 && devname != "N/A")
  { dentry = @cast(file, "file")->f_path->dentry;
    log(execname() . " " . devname . ":"
        . reverse_path_walk(dentry)); } }'

Don't know if there is an easy way to map the dev/devname to the mount
point to complete the full path name.

Cheers,

Mark

Re: Improvement to disktop.stp: how to find the full file name?

[Mark Wielaard]

On Mon, 2010-09-06 at 15:19 +0200, Mark Wielaard wrote:
> On Sun, 2010-09-05 at 17:23 +0200, laurent@guerby.net wrote:
> > I'd like to add disltop.stp the capability to print which file are 
> > being read/written by each process. It's quite easy to get the filename 
> > by using the provided __file_pathname function (eg: "kern.log"), but 
> > I'm unable to figure out how to find the full pathname (eg: 
> > "/var/log/kern.log"). Any idea on how to do that?
> 
> dentry.stp provides a function reverse_path_walk() that mostly seems to
> do what you want. It takes a dentry, which you could get as follows:
> 
> $ stap -e 'probe vfs.read { if (file != 0 && devname != "N/A")
>   { dentry = @cast(file, "file")->f_path->dentry;
>     log(execname() . " " . devname . ":"
>         . reverse_path_walk(dentry)); } }'
> 
> Don't know if there is an easy way to map the dev/devname to the mount
> point to complete the full path name.

Actually, it wasn't to hard to come up with something that is pretty
close:
$ stap -e 'probe vfs.read
  { if (file != 0 && devname != "N/A")
    { mountpoint = @cast(file, "file")->f_path->mnt->mnt_mountpoint;
      parent = @cast(file, "file")->f_path->dentry->d_parent;
      name = @cast(file, "file")->f_path->dentry;
      log(execname() . " " . reverse_path_walk(mountpoint)
          . reverse_path_walk(parent) . d_name(name)); } }'

You need to tweak this a little to get the slashes right at the start,
but it seems to mostly do what you want.

Cheers,

Mark