Using Systemtap; Tracing - Red Hat ENTERPRISE LINUX 5 - DEPLOYMENT Deployment Manual

Chapter 37. SystemTap
Figure 37.1. Flow of Data in SystemTap

37.3. Using SystemTap

Systemtap works by translating a SystemTap script to C, running the system C compiler to create a
kernel module from that. When the module is loaded, it activates all the probed events by hooking
into the kernel. Then, as events occur on any processor, the compiled handlers run. Eventually, the
session stops, the hooks are disconnected, and the module removed. This entire process is driven
from a single command-line program, stap.

37.3.1. Tracing

The simplest kind of probe is simply to trace an event. This is the effect of inserting strategically
located print statements into a program. This is often the first step of problem solving: explore by
seeing a history of what has happened.
This style of instrumentation is the simplest. It just asks systemtap to print something at each event.
To express this in the script language, you need to say where to probe and what to print there.
37.3.1.1. Where to Probe
Systemtap supports a number of built-in events. The library of scripts that comes with systemtap,
each called a "tapset", may define additional ones defined in terms of the built-in family. See the
522