* monitoring files opened/closed by a process @ 2009-06-26 21:12 Bruno G. Sousa 2009-06-26 22:23 ` Malte Nuhn 0 siblings, 1 reply; 10+ messages in thread From: Bruno G. Sousa @ 2009-06-26 21:12 UTC (permalink / raw) To: systemtap I am trying to write a stap script that: list the activities of opening and closing files made by a given process (showing time and files being open/close) How it should be? -- View this message in context: http://www.nabble.com/monitoring-files-opened-closed-by-a-process-tp24227355p24227355.html Sent from the Sourceware - systemtap mailing list archive at Nabble.com. ^ permalink raw reply [flat|nested] 10+ messages in thread
* Re: monitoring files opened/closed by a process 2009-06-26 21:12 monitoring files opened/closed by a process Bruno G. Sousa @ 2009-06-26 22:23 ` Malte Nuhn 2009-06-27 3:20 ` Bruno G. Sousa 0 siblings, 1 reply; 10+ messages in thread From: Malte Nuhn @ 2009-06-26 22:23 UTC (permalink / raw) To: Bruno G. Sousa; +Cc: systemtap Have looked at http://sourceware.org/systemtap/examples/io/ iostats.stp ?? I guess it nearly does what you Need. Greets, malte Am 26.06.2009 um 23:12 schrieb "Bruno G. Sousa" <brgsousa@gmail.com>: > > I am trying to write a stap script that: > list the activities of opening and closing files made by a given > process > (showing time and files being open/close) > > How it should be? > -- > View this message in context: http://www.nabble.com/monitoring-files-opened-closed-by-a-process-tp24227355p24227355.html > Sent from the Sourceware - systemtap mailing list archive at Nabble.com > . > ^ permalink raw reply [flat|nested] 10+ messages in thread
* Re: monitoring files opened/closed by a process 2009-06-26 22:23 ` Malte Nuhn @ 2009-06-27 3:20 ` Bruno G. Sousa 2009-06-27 21:29 ` Mark Wielaard 0 siblings, 1 reply; 10+ messages in thread From: Bruno G. Sousa @ 2009-06-27 3:20 UTC (permalink / raw) To: systemtap thanks! i got it working! now I need to monitor strings that are being written to files by certain process. wrote this till now: probe begin { printf("STARTEDn") } probe syscall.write.return { if (pid() == target()) { printf("%s(%d) wrote %s\n", execname(),pid(),"something") } } Malte Nuhn wrote: > > Have looked at http://sourceware.org/systemtap/examples/io/ > iostats.stp ?? > > I guess it nearly does what you Need. > > > Greets, malte > > > > Am 26.06.2009 um 23:12 schrieb "Bruno G. Sousa" <brgsousa@gmail.com>: > >> >> I am trying to write a stap script that: >> list the activities of opening and closing files made by a given >> process >> (showing time and files being open/close) >> >> How it should be? >> -- >> View this message in context: >> http://www.nabble.com/monitoring-files-opened-closed-by-a-process-tp24227355p24227355.html >> Sent from the Sourceware - systemtap mailing list archive at Nabble.com >> . >> > > -- View this message in context: http://www.nabble.com/monitoring-files-opened-closed-by-a-process-tp24227355p24230120.html Sent from the Sourceware - systemtap mailing list archive at Nabble.com. ^ permalink raw reply [flat|nested] 10+ messages in thread
* Re: monitoring files opened/closed by a process 2009-06-27 3:20 ` Bruno G. Sousa @ 2009-06-27 21:29 ` Mark Wielaard [not found] ` <068101c9f85f$534d3480$f9e79d80$@ac.cn> 0 siblings, 1 reply; 10+ messages in thread From: Mark Wielaard @ 2009-06-27 21:29 UTC (permalink / raw) To: Bruno G. Sousa; +Cc: systemtap Hi Bruno, On Fri, 2009-06-26 at 20:20 -0700, Bruno G. Sousa wrote: > now I need to monitor strings that are being written to files by certain > process. > [...] > probe syscall.write.return > { > if (pid() == target()) { > printf("%s(%d) wrote %s\n", execname(),pid(),"something") > } > } So the syscall.write probe (like all syscall probes) also makes available the variable 'argstr'. This contains a string representation of the syscall arguments (it also, as all other syscall probes, defines the variable name, which is the name of the syscall). So you can get most information about such a syscall you can do something like: probe syscall.write { if (pid() == target()) { printf("%s(%d) %s: %s\n", execname(), pid(), name, argstr) } } You want this at the syscall.write.return. return does make available the retstr, which gives you are string representation of the return value. Since you don't have the argstr (nor the buf_uaddr) that the syscall call probe defines, you will have to construct something yourself. Look in tapset/syscalls2.stp, where you can see syscall.write makes available buf_uaddr (a pointer to a buffer into user space), that is then used with (see string.stp) the user_string() function, which fetches the string (up to a MAXSTRINGLEN), and the text_str() function, which escapes any non-printable characters. You can do the same in the return probe. But you will have to use the source variable name $buf. You can use the special return probe value $return to get the number of bytes written: probe syscall.write.return { if (pid() == target()) { printf("%s(%d) wrote %s\n", execname(), pid(), text_str(user_string_n($buf, $return))); } } (Sidenote, the $buf variable is actually read at the syscall entry call, and then cached for use in the return probe. This doesn't matter in this case, but might surprise you if the variable used is changed in the function you probe. At least it surprised me.) Hope that helps, Mark ^ permalink raw reply [flat|nested] 10+ messages in thread
[parent not found: <068101c9f85f$534d3480$f9e79d80$@ac.cn>]
* Re: 答复: monitoring files opened/closed by a process [not found] ` <068101c9f85f$534d3480$f9e79d80$@ac.cn> @ 2009-06-29 6:04 ` Mark Wielaard 2009-06-29 7:54 ` 答复: " tgh 2009-06-29 11:34 ` question about resource usage for each process tgh 0 siblings, 2 replies; 10+ messages in thread From: Mark Wielaard @ 2009-06-29 6:04 UTC (permalink / raw) To: tgh; +Cc: 'Bruno G. Sousa', systemtap On Mon, 2009-06-29 at 10:14 +0800, tgh wrote: > What is version of kernal do you use for this scripts, 2.6.29.5-191.fc11.x86_64 > I try it , error What is the error you are seeing? ^ permalink raw reply [flat|nested] 10+ messages in thread
* 答复: 答复: monitoring files opened/closed by a process 2009-06-29 6:04 ` 答复: " Mark Wielaard @ 2009-06-29 7:54 ` tgh 2009-06-29 8:00 ` Mark Wielaard 2009-06-29 11:34 ` question about resource usage for each process tgh 1 sibling, 1 reply; 10+ messages in thread From: tgh @ 2009-06-29 7:54 UTC (permalink / raw) To: 'Mark Wielaard'; +Cc: 'Bruno G. Sousa', systemtap I have subcribe systemtap mail list, but I can only receive mail, could not send mail to list, what is the reason , -----邮件原件----- 发件人: Mark Wielaard [mailto:mjw@redhat.com] 发送时间: 2009年6月29日 14:04 收件人: tgh 抄送: 'Bruno G. Sousa'; systemtap@sourceware.org 主题: Re: 答复: monitoring files opened/closed by a process On Mon, 2009-06-29 at 10:14 +0800, tgh wrote: > What is version of kernal do you use for this scripts, 2.6.29.5-191.fc11.x86_64 > I try it , error What is the error you are seeing? ^ permalink raw reply [flat|nested] 10+ messages in thread
* Re: 答复: 答复: monitoring files opened/closed by a process 2009-06-29 7:54 ` 答复: " tgh @ 2009-06-29 8:00 ` Mark Wielaard 0 siblings, 0 replies; 10+ messages in thread From: Mark Wielaard @ 2009-06-29 8:00 UTC (permalink / raw) To: tgh; +Cc: 'Bruno G. Sousa', systemtap On Mon, 2009-06-29 at 15:54 +0800, tgh wrote: > I have subcribe systemtap mail list, but I can only receive mail, > could not send mail to list, what is the reason , This message did get through to the list. You previous message had: > Content-type: text/plain; charset="gb2312" > Content-language: zh-cn That might have confused the mailinglist software. It might only expect English language messages. Cheers, Mark ^ permalink raw reply [flat|nested] 10+ messages in thread
* question about resource usage for each process 2009-06-29 6:04 ` 答复: " Mark Wielaard 2009-06-29 7:54 ` 答复: " tgh @ 2009-06-29 11:34 ` tgh 2009-07-02 13:21 ` question about cache miss tgh 1 sibling, 1 reply; 10+ messages in thread From: tgh @ 2009-06-29 11:34 UTC (permalink / raw) To: systemtap Hi I hear that linux2.6 has support to get the information about each process resource usage information, e.g., cpu usage or memory usage, I want to know how to get this information with systemtap, could some one give me an example, or where is example for it, Could you help me Thank you in advance ^ permalink raw reply [flat|nested] 10+ messages in thread
* question about cache miss 2009-06-29 11:34 ` question about resource usage for each process tgh @ 2009-07-02 13:21 ` tgh 2009-07-06 19:16 ` William Cohen 0 siblings, 1 reply; 10+ messages in thread From: tgh @ 2009-07-02 13:21 UTC (permalink / raw) To: systemtap Hi Does systemtap support cache miss instrumentation ? how to get it thanks ^ permalink raw reply [flat|nested] 10+ messages in thread
* Re: question about cache miss 2009-07-02 13:21 ` question about cache miss tgh @ 2009-07-06 19:16 ` William Cohen 0 siblings, 0 replies; 10+ messages in thread From: William Cohen @ 2009-07-06 19:16 UTC (permalink / raw) To: tgh; +Cc: systemtap tgh wrote: > Hi > Does systemtap support cache miss instrumentation ? how to get it > > thanks > You mean the processor's L1/L2/L3 cache? SystemTap doesn't have access to the performance monitoring hardware on the processors. You might look at the Performance Counters for Linux (PCL) which has been pulled into the 2.6.31 kernel: http://lwn.net/Articles/324775/ http://www.h-online.com/open/Kernel-Log-Main-development-phase-of-Linux-2-6-31-completed--/news/113614 The current PCL implementation doesn't have a interface available for the kernel calls. This makes it a bit difficult for SystemTap to use it. If you are talking about software caches in the kernel, you might be able to find the appropriate functions to probe to allow systemtap to observe those events. Something similar to the the vm.pagefault probe. -Will ^ permalink raw reply [flat|nested] 10+ messages in thread
end of thread, other threads:[~2009-07-06 19:16 UTC | newest] Thread overview: 10+ messages (download: mbox.gz / follow: Atom feed) -- links below jump to the message on this page -- 2009-06-26 21:12 monitoring files opened/closed by a process Bruno G. Sousa 2009-06-26 22:23 ` Malte Nuhn 2009-06-27 3:20 ` Bruno G. Sousa 2009-06-27 21:29 ` Mark Wielaard [not found] ` <068101c9f85f$534d3480$f9e79d80$@ac.cn> 2009-06-29 6:04 ` 答复: " Mark Wielaard 2009-06-29 7:54 ` 答复: " tgh 2009-06-29 8:00 ` Mark Wielaard 2009-06-29 11:34 ` question about resource usage for each process tgh 2009-07-02 13:21 ` question about cache miss tgh 2009-07-06 19:16 ` William Cohen
This is a public inbox, see mirroring instructions for how to clone and mirror all data and code used for this inbox; as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).