Red Hat ENTERPRISE LINUX 5 - DEPLOYMENT Deployment Manual page 549

stapprobes man page for details. All these events are named using a unified syntax that looks like
dot-separated parameterized identifiers:
Event
begin
end
kernel.function("sys_open")
syscall.close.return
module("ext3").statement(0xdeadbeef)
timer.ms(200)
Table 37.1. SystemTap Events
We will use as a demonstration case that you would like to trace all function entries and exits in
a source file, for example net/socket.c in the kernel. The kernel.function probe point
lets you express that easily, since systemtap examines the kernel's debugging information to
relate object code to source code. It works like a debugger: if you can name or place it, you
can probe it. Use kernel.function("*@net/socket.c") for the function entries, and
kernel.function("*@net/socket.c").return for the exits. Note the use of wildcards in the
function name part, and the subsequent @FILENAME part. You can also put wildcards into the file
name, and even add a colon (:) and a line number, if you want to restrict the search that precisely.
Since systemtap will put a separate probe in every place that matches a probe point, a few wildcards
can expand to hundreds or thousands of probes, so be careful what you ask for.
Once you identify the probe points, the skeleton of the systemtap script appears. The probe keyword
introduces a probe point, or a comma-separated list of them. The following { and } braces enclose the
handler for all listed probe points.
You can run this script as is, though with empty handlers there will be no output. Put the two lines into
a new file. Run stap -v FILE. Terminate it any time with ^C. (The -v option tells systemtap to print
more verbose messages during its processing. Try the -h option to see more options.)
37.3.1.2. What to Print
Since you are interested in each function that was entered and exited, a line should be printed for
each, containing the function name. In order to make that list easy to read, systemtap should indent
the lines so that functions called by other traced functions are nested deeper. To tell each single
process apart from any others that may be running concurrently, systemtap should also print the
process ID in the line.
Description
The startup of the systemtap session.
The end of the systemtap session.
The entry to the function named sys_open in the
kernel.
The return from the close system call..
The addressed instruction in the ext3 filesystem
driver.
A timer that fires every 200 milliseconds.
Tracing
523