problem when run tcp/udp probing script

problem when run tcp/udp probing script

[ch huang]

i write the following script ( from book 'Instrumenting the Linux
Kernel for Analyzing Performance and Functional Problems )

probe udp.recvmsg {
printf("%s: UDP: Receiving message. Socket %d. Size %d\n", execname(),
sock, size)
}
probe tcp.recvmsg {
printf("%s: TCP: Receiving message. Socket %d. Size %d\n", execname(),
sock, size)
}
probe udp.sendmsg {
printf("%s: UDP: Sending message. Flags %d. Size %d\n", execname(),
$sk->sk_flags, size)
}
probe tcp.sendmsg {
printf("%s: TCP: Sending message. Flags %d. Size %d\n", execname(),
$sk->sk_flags, size)
}
probe udp.disconnect {
printf("%s: UDP: Disconnected %d with flags %d\n", execname(), sock,
flags)
}
probe tcp.disconnect {
printf("%s: TCP: Disconnected %d with flags %d\n", execname(), sock,
flags)
}

but why the value of socket is negative?

mysqld: TCP: Receiving message. Socket -131937697852800. Size 4
mysqld: TCP: Receiving message. Socket -131937398508736. Size 16384
mysqld: TCP: Receiving message. Socket -131938374336384. Size 1
mysqld: TCP: Receiving message. Socket -131937398508736. Size 16384

Re: problem when run tcp/udp probing script

[Mark Wielaard]

On Mon, Mar 19, 2012 at 01:25:06PM +0800, ch huang wrote:
> i write the following script ( from book 'Instrumenting the Linux
> Kernel for Analyzing Performance and Functional Problems )
> 
> probe udp.recvmsg {
> printf("%s: UDP: Receiving message. Socket %d. Size %d\n", execname(),
> sock, size)
> }
> [...] 
> but why the value of socket is negative?

sock is a pointer of type struct sock*.
So it is better to print it as an hex value with:

  printf("%s: UDP: Receiving message. Socket ptr 0x%x. Size %d\n", execname(),
         sock, size);

When you print is as %d, it is interpreted as an signed long value and so
can also be negative.

If you are interested in the actual struct sock value you can also try pretty
printing it using @cast and adding $ at the end. e.g.

probe tcp.recvmsg {
  printf("%s: TCP: Receiving message %s.\n", execname(),
         @cast(sock, "struct sock")$)
}

Cheers,

Mark

Re: problem when run tcp/udp probing script

[Frank Ch. Eigler]

ch huang <justlooks@gmail.com> writes:

> [...]
> probe tcp.recvmsg {
> printf("%s: TCP: Receiving message. Socket %d. Size %d\n", execname(),
> sock, size)
> }
> [...]
> but why the value of socket is negative?
>
> mysqld: TCP: Receiving message. Socket -131937697852800. Size 4
> mysqld: TCP: Receiving message. Socket -131937398508736. Size 16384
> mysqld: TCP: Receiving message. Socket -131938374336384. Size 1
> mysqld: TCP: Receiving message. Socket -131937398508736. Size 16384

Because sock is a pointer to a kernel structure.  If you print it as
%p, you'll see them as pretty reasonable values 0xffff8800b410c080
etc.

- FChE