SystemTap Tapset Reference Manual
|  | Next

# SystemTap Tapset Reference Manual

### SystemTap

Hackers

Copyright © 2008-2024 Red Hat, Inc. and others

This documentation is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License version 2 as published by the Free Software Foundation.

This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details.

You should have received a copy of the GNU General Public License along with this program; if not, write to the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.

For more details see the file COPYING in the source distribution of Linux.

Table of Contents

1. Introduction
2. Context Functions
  function::addr — Address of the current probe point.
  function::asmlinkage — Mark function as declared asmlinkage
  function::backtrace — Hex backtrace of current kernel stack
  function::caller — Return name and address of calling function
  function::caller_addr — Return caller address
  function::callers — Return first n elements of kernel stack backtrace
  function::cmdline_arg — Fetch a command line argument
  function::cmdline_args — Fetch command line arguments from current process
  function::cmdline_str — Fetch all command line arguments from current process
  function::cpu — Returns the current cpu number
  function::cpuid — Returns the current cpu number
  function::current_exe_file — get the file struct pointer for the current task's executable file
  function::egid — Returns the effective gid of a target process
  function::env_var — Fetch environment variable from current process
  function::euid — Return the effective uid of a target process
  function::execname — Returns the execname of a target process (or group of processes)
  function::fastcall — Mark function as declared fastcall
  function::gid — Returns the group ID of a target process
  function::int_arg — Return function argument as signed int
  function::is_myproc — Determines if the current probe point has occurred in the user's own process
  function::is_return — Whether the current probe context is a return probe
  function::long_arg — Return function argument as signed long
  function::longlong_arg — Return function argument as 64-bit value
  function::modname — Return the kernel module name loaded at the address
  function::module_name — The module name of the current script
  function::module_size — The module size of the current script
  function::ns_egid — Returns the effective gid of a target process as seen in a user namespace
  function::ns_euid — Returns the effective user ID of a target process as seen in a user namespace
  function::ns_gid — Returns the group ID of a target process as seen in a user namespace
  function::ns_pgrp — Returns the process group ID of the current process as seen in a pid namespace
  function::ns_pid — Returns the ID of a target process as seen in a pid namespace
  function::ns_ppid — Returns the process ID of a target process's parent process as seen in a pid namespace
  function::ns_sid — Returns the session ID of the current process as seen in a pid namespace
  function::ns_tid — Returns the thread ID of a target process as seen in a pid namespace
  function::ns_uid — Returns the user ID of a target process as seen in a user namespace
  function::pexecname — Returns the execname of a target process's parent process
  function::pgrp — Returns the process group ID of the current process
  function::pid — Returns the ID of a target process
  function::pid2execname — The name of the given process identifier
  function::pid2task — The task_struct of the given process identifier
  function::pn — Returns the active probe name
  function::pnlabel — Returns the label name parsed from the probe name
  function::pointer_arg — Return function argument as pointer value
  function::pp — Returns the active probe point
  function::ppfunc — Returns the function name parsed from `pp`
  function::ppid — Returns the process ID of a target process's parent process
  function::print_backtrace — Print kernel stack back trace
  function::print_backtrace_fileline — Print kernel stack back trace
  function::print_regs — Print a register dump
  function::print_stack — Print out kernel stack from string
  function::print_syms — Print out kernel stack from string
  function::print_ubacktrace — Print stack back trace for current user-space task.
  function::print_ubacktrace_brief — Print stack back trace for current user-space task.
  function::print_ubacktrace_fileline — Print stack back trace for current user-space task.
  function::print_ustack — Print out stack for the current task from string.
  function::print_usyms — Print out user stack from string
  function::probe_type — The low level probe handler type of the current probe.
  function::probefunc — Return the probe point's function name, if known
  function::probemod — Return the probe point's kernel module name
  function::pstrace — Chain of processes and pids back to init(1)
  function::register — Return the signed value of the named CPU register
  function::registers_valid — Determines validity of `register` and `u_register` in current context
  function::regparm — Specify regparm value used to compile function
  function::remote_id — The index of this instance in a remote execution.
  function::remote_uri — The name of this instance in a remote execution.
  function::s32_arg — Return function argument as signed 32-bit value
  function::s64_arg — Return function argument as signed 64-bit value
  function::set_int_arg — Set function argument as signed int
  function::set_long_arg — Set argument as signed long
  function::set_longlong_arg — Set function argument as 64-bit value
  function::set_pointer_arg — Set function argument as pointer value
  function::set_s32_arg — Set function argument as signed 32-bit value
  function::set_s64_arg — Set function argument as signed 64-bit value
  function::set_u32_arg — Set function argument as unsigned 32-bit value
  function::set_u64_arg — Set function argument as unsigned 64-bit value
  function::set_uint_arg — Set argument as unsigned int
  function::set_ulong_arg — Set function argument as unsigned long
  function::set_ulonglong_arg — Set function argument as 64-bit value
  function::sid — Returns the session ID of the current process
  function::sprint_backtrace — Return stack back trace as string
  function::sprint_stack — Return stack for kernel addresses from string
  function::sprint_syms — Return stack for kernel addresses from string
  function::sprint_ubacktrace — Return stack back trace for current user-space task as string.
  function::sprint_ustack — Return stack for the current task from string.
  function::sprint_usyms — Return stack for user addresses from string
  function::stack — Return address at given depth of kernel stack backtrace
  function::stack_size — Return the size of the kernel stack
  function::stack_unused — Returns the amount of kernel stack currently available
  function::stack_used — Returns the amount of kernel stack used
  function::stp_pid — The process id of the stapio process
  function::symdata — Return the kernel symbol and module offset for the address
  function::symfile — Return the file name of a given address.
  function::symfileline — Return the file name and line number of an address.
  function::symline — Return the line number of an address.
  function::symname — Return the kernel symbol associated with the given address
  function::target — Return the process ID of the target process
  function::task_ancestry — The ancestry of the given task
  function::task_backtrace — Hex backtrace of an arbitrary task
  function::task_cpu — The scheduled cpu of the task
  function::task_current — The current task_struct of the current task
  function::task_cwd_path — get the path struct pointer for a task's current working directory
  function::task_egid — The effective group identifier of the task
  function::task_euid — The effective user identifier of the task
  function::task_exe_file — get the file struct pointer for a task's executable file
  function::task_execname — The name of the task
  function::task_fd_lookup — get the file struct for a task's fd
  function::task_gid — The group identifier of the task
  function::task_max_file_handles — The max number of open files for the task
  function::task_nice — The nice value of the task
  function::task_ns_egid — The effective group identifier of the task
  function::task_ns_euid — The effective user identifier of the task
  function::task_ns_gid — The group identifier of the task as seen in a namespace
  function::task_ns_pid — The process identifier of the task
  function::task_ns_tid — The thread identifier of the task as seen in a namespace
  function::task_ns_uid — The user identifier of the task
  function::task_open_file_handles — The number of open files of the task
  function::task_parent — The task_struct of the parent task
  function::task_pid — The process identifier of the task
  function::task_prio — The priority value of the task
  function::task_state — The state of the task
  function::task_tid — The thread identifier of the task
  function::task_uid — The user identifier of the task
  function::tid — Returns the thread ID of a target process
  function::u32_arg — Return function argument as unsigned 32-bit value
  function::u64_arg — Return function argument as unsigned 64-bit value
  function::u_register — Return the unsigned value of the named CPU register
  function::uaddr — User space address of current running task
  function::ubacktrace — Hex backtrace of current user-space task stack.
  function::ucallers — Return first n elements of user stack backtrace
  function::uid — Returns the user ID of a target process
  function::uint_arg — Return function argument as unsigned int
  function::ulong_arg — Return function argument as unsigned long
  function::ulonglong_arg — Return function argument as 64-bit value
  function::umodname — Returns the (short) name of the user module.
  function::user_mode — Determines if probe point occurs in user-mode
  function::ustack — Return address at given depth of user stack backtrace
  function::usymdata — Return the symbol and module offset of an address.
  function::usymfile — Return the file name of a given address.
  function::usymfileline — Return the file name and line number of an address.
  function::usymline — Return the line number of an address.
  function::usymname — Return the symbol of an address in the current task.
3. Timestamp Functions
  function::HZ — Kernel HZ
  function::cpu_clock_ms — Number of milliseconds on the given cpu's clock
  function::cpu_clock_ns — Number of nanoseconds on the given cpu's clock
  function::cpu_clock_s — Number of seconds on the given cpu's clock
  function::cpu_clock_us — Number of microseconds on the given cpu's clock
  function::delete_stopwatch — Remove an existing stopwatch
  function::get_cycles — Processor cycle count
  function::gettimeofday_ms — Number of milliseconds since UNIX epoch
  function::gettimeofday_ns — Number of nanoseconds since UNIX epoch
  function::gettimeofday_s — Number of seconds since UNIX epoch
  function::gettimeofday_us — Number of microseconds since UNIX epoch
  function::jiffies — Kernel jiffies count
  function::ktime_get_ns — Number of nanoseconds since boot
  function::local_clock_ms — Number of milliseconds on the local cpu's clock
  function::local_clock_ns — Number of nanoseconds on the local cpu's clock
  function::local_clock_s — Number of seconds on the local cpu's clock
  function::local_clock_us — Number of microseconds on the local cpu's clock
  function::read_stopwatch_ms — Reads the time in milliseconds for a stopwatch
  function::read_stopwatch_ns — Reads the time in nanoseconds for a stopwatch
  function::read_stopwatch_s — Reads the time in seconds for a stopwatch
  function::read_stopwatch_us — Reads the time in microseconds for a stopwatch
  function::start_stopwatch — Start a stopwatch
  function::stop_stopwatch — Stop a stopwatch
4. Time utility functions
  function::ctime — Convert seconds since epoch into human readable date/time string
  function::tz_ctime — Convert seconds since epoch into human readable date/time string, with local time zone
  function::tz_gmtoff — Return local time zone offset
  function::tz_name — Return local time zone name
5. Shell command functions
  function::system — Issue a command to the system
6. Memory Tapset
  function::addr_to_node — Returns which node a given address belongs to within a NUMA system
  function::bytes_to_string — Human readable string for given bytes
  function::mem_page_size — Number of bytes in a page for this architecture
  function::pages_to_string — Turns pages into a human readable string
  function::proc_mem_data — Program data size (data + stack) in pages
  function::proc_mem_rss — Program resident set size in pages
  function::proc_mem_shr — Program shared pages (from shared mappings)
  function::proc_mem_size — Total program virtual memory size in pages
  function::proc_mem_string — Human readable string of process memory usage
  function::proc_mem_txt — Program text (code) size in pages
  function::vm_fault_contains — Test return value for page fault reason
  probe::vm.brk — Fires when a brk is requested (i.e. the heap will be resized)
  probe::vm.kfree — Fires when kfree is requested
  probe::vm.kmalloc — Fires when kmalloc is requested
  probe::vm.kmalloc_node — Fires when kmalloc_node is requested
  probe::vm.kmem_cache_alloc — Fires when kmem_cache_alloc is requested
  probe::vm.kmem_cache_alloc_node — Fires when kmem_cache_alloc_node is requested
  probe::vm.kmem_cache_free — Fires when kmem_cache_free is requested
  probe::vm.mmap — Fires when an mmap is requested
  probe::vm.munmap — Fires when an munmap is requested
  probe::vm.oom_kill — Fires when a thread is selected for termination by the OOM killer
  probe::vm.pagefault — Records that a page fault occurred
  probe::vm.pagefault.return — Indicates what type of fault occurred
  probe::vm.write_shared — Attempts at writing to a shared page
  probe::vm.write_shared_copy — Page copy for shared page write
7. Task Time Tapset
  function::cputime_to_msecs — Translates the given cputime into milliseconds
  function::cputime_to_string — Human readable string for given cputime
  function::cputime_to_usecs — Translates the given cputime into microseconds
  function::msecs_to_string — Human readable string for given milliseconds
  function::nsecs_to_string — Human readable string for given nanoseconds
  function::task_start_time — Start time of the given task
  function::task_stime — System time of the task
  function::task_time_string — Human readable string of task time usage
  function::task_time_string_tid — Human readable string of task time usage
  function::task_utime — User time of the task
  function::usecs_to_string — Human readable string for given microseconds
8. Scheduler Tapset
  probe::scheduler.balance — A cpu attempting to find more work.
  probe::scheduler.cpu_off — Process is about to stop running on a cpu
  probe::scheduler.cpu_on — Process is beginning execution on a cpu
  probe::scheduler.ctxswitch — A context switch is occuring.
  probe::scheduler.kthread_stop — A thread created by kthread_create is being stopped
  probe::scheduler.kthread_stop.return — A kthread is stopped and gets the return value
  probe::scheduler.migrate — Task migrating across cpus
  probe::scheduler.process_exit — Process exiting
  probe::scheduler.process_fork — Process forked
  probe::scheduler.process_free — Scheduler freeing a data structure for a process
  probe::scheduler.process_wait — Scheduler starting to wait on a process
  probe::scheduler.signal_send — Sending a signal
  probe::scheduler.tick — Schedulers internal tick, a processes timeslice accounting is updated
  probe::scheduler.wait_task — Waiting on a task to unschedule (become inactive)
  probe::scheduler.wakeup — Task is woken up
  probe::scheduler.wakeup_new — Newly created task is woken up for the first time
9. IO Scheduler and block IO Tapset
  probe::ioblock.end — Fires whenever a block I/O transfer is complete.
  probe::ioblock.request — Fires whenever making a generic block I/O request.
  probe::ioblock_trace.bounce — Fires whenever a buffer bounce is needed for at least one page of a block IO request.
  probe::ioblock_trace.end — Fires whenever a block I/O transfer is complete.
  probe::ioblock_trace.request — Fires just as a generic block I/O request is created for a bio.
  probe::ioscheduler.elv_add_request — probe to indicate request is added to the request queue.
  probe::ioscheduler.elv_add_request.kp — kprobe based probe to indicate that a request was added to the request queue
  probe::ioscheduler.elv_add_request.tp — tracepoint based probe to indicate a request is added to the request queue.
  probe::ioscheduler.elv_completed_request — Fires when a request is completed
  probe::ioscheduler.elv_next_request — Fires when a request is retrieved from the request queue
  probe::ioscheduler.elv_next_request.return — Fires when a request retrieval issues a return signal
  probe::ioscheduler_trace.elv_abort_request — Fires when a request is aborted.
  probe::ioscheduler_trace.elv_completed_request — Fires when a request is
  probe::ioscheduler_trace.elv_issue_request — Fires when a request is
  probe::ioscheduler_trace.elv_requeue_request — Fires when a request is
  probe::ioscheduler_trace.plug — Fires when a request queue is plugged;
  probe::ioscheduler_trace.unplug_io — Fires when a request queue is unplugged;
  probe::ioscheduler_trace.unplug_timer — Fires when unplug timer associated
10. SCSI Tapset
  probe::scsi.iocompleted — SCSI mid-layer running the completion processing for block device I/O requests
  probe::scsi.iodispatching — SCSI mid-layer dispatched low-level SCSI command
  probe::scsi.iodone — SCSI command completed by low level driver and enqueued into the done queue.
  probe::scsi.ioentry — Prepares a SCSI mid-layer request
  probe::scsi.ioexecute — Create mid-layer SCSI request and wait for the result
  probe::scsi.set_state — Order SCSI device state change
11. TTY Tapset
  probe::tty.init — Called when a tty is being initalized
  probe::tty.ioctl — called when a ioctl is request to the tty
  probe::tty.open — Called when a tty is opened
  probe::tty.poll — Called when a tty device is being polled
  probe::tty.read — called when a tty line will be read
  probe::tty.receive — called when a tty receives a message
  probe::tty.register — Called when a tty device is registred
  probe::tty.release — Called when the tty is closed
  probe::tty.resize — Called when a terminal resize happens
  probe::tty.unregister — Called when a tty device is being unregistered
  probe::tty.write — write to the tty line
12. Interrupt Request (IRQ) Tapset
  probe::irq_handler.entry — Execution of interrupt handler starting
  probe::irq_handler.exit — Execution of interrupt handler completed
  probe::softirq.entry — Execution of handler for a pending softirq starting
  probe::softirq.exit — Execution of handler for a pending softirq completed
  probe::workqueue.create — Creating a new workqueue
  probe::workqueue.destroy — Destroying workqueue
  probe::workqueue.execute — Executing deferred work
  probe::workqueue.insert — Queuing work on a workqueue
13. Networking Tapset
  function::format_ipaddr — Returns a string representation for an IP address
  function::htonl — Convert 32-bit long from host to network order
  function::htonll — Convert 64-bit long long from host to network order
  function::htons — Convert 16-bit short from host to network order
  function::ip_ntop — Returns a string representation for an IPv4 address
  function::ntohl — Convert 32-bit long from network to host order
  function::ntohll — Convert 64-bit long long from network to host order
  function::ntohs — Convert 16-bit short from network to host order
  probe::netdev.change_mac — Called when the netdev_name has the MAC changed
  probe::netdev.change_mtu — Called when the netdev MTU is changed
  probe::netdev.change_rx_flag — Called when the device RX flag will be changed
  probe::netdev.close — Called when the device is closed
  probe::netdev.get_stats — Called when someone asks the device statistics
  probe::netdev.hard_transmit — Called when the devices is going to TX (hard)
  probe::netdev.ioctl — Called when the device suffers an IOCTL
  probe::netdev.open — Called when the device is opened
  probe::netdev.receive — Data received from network device.
  probe::netdev.register — Called when the device is registered
  probe::netdev.rx — Called when the device is going to receive a packet
  probe::netdev.set_promiscuity — Called when the device enters/leaves promiscuity
  probe::netdev.transmit — Network device transmitting buffer
  probe::netdev.unregister — Called when the device is being unregistered
  probe::netfilter.arp.forward — - Called for each ARP packet to be forwarded
  probe::netfilter.arp.in — - Called for each incoming ARP packet
  probe::netfilter.arp.out — - Called for each outgoing ARP packet
  probe::netfilter.bridge.forward — Called on an incoming bridging packet destined for some other computer
  probe::netfilter.bridge.local_in — Called on a bridging packet destined for the local computer
  probe::netfilter.bridge.local_out — Called on a bridging packet coming from a local process
  probe::netfilter.bridge.post_routing — - Called before a bridging packet hits the wire
  probe::netfilter.bridge.pre_routing — - Called before a bridging packet is routed
  probe::netfilter.ip.forward — Called on an incoming IP packet addressed to some other computer
  probe::netfilter.ip.local_in — Called on an incoming IP packet addressed to the local computer
  probe::netfilter.ip.local_out — Called on an outgoing IP packet
  probe::netfilter.ip.post_routing — Called immediately before an outgoing IP packet leaves the computer
  probe::netfilter.ip.pre_routing — Called before an IP packet is routed
  probe::sunrpc.clnt.bind_new_program — Bind a new RPC program to an existing client
  probe::sunrpc.clnt.call_async — Make an asynchronous RPC call
  probe::sunrpc.clnt.call_sync — Make a synchronous RPC call
  probe::sunrpc.clnt.clone_client — Clone an RPC client structure
  probe::sunrpc.clnt.create_client — Create an RPC client
  probe::sunrpc.clnt.restart_call — Restart an asynchronous RPC call
  probe::sunrpc.clnt.shutdown_client — Shutdown an RPC client
  probe::sunrpc.sched.delay — Delay an RPC task
  probe::sunrpc.sched.execute — Execute the RPC `scheduler'
  probe::sunrpc.sched.new_task — Create new task for the specified client
  probe::sunrpc.sched.release_task — Release all resources associated with a task
  probe::sunrpc.svc.create — Create an RPC service
  probe::sunrpc.svc.destroy — Destroy an RPC service
  probe::sunrpc.svc.drop — Drop RPC request
  probe::sunrpc.svc.process — Process an RPC request
  probe::sunrpc.svc.recv — Listen for the next RPC request on any socket
  probe::sunrpc.svc.register — Register an RPC service with the local portmapper
  probe::sunrpc.svc.send — Return reply to RPC client
  probe::tcp.disconnect — TCP socket disconnection
  probe::tcp.disconnect.return — TCP socket disconnection complete
  probe::tcp.receive — Called when a TCP packet is received
  probe::tcp.recvmsg — Receiving TCP message
  probe::tcp.recvmsg.return — Receiving TCP message complete
  probe::tcp.sendmsg — Sending a tcp message
  probe::tcp.sendmsg.return — Sending TCP message is done
  probe::tcp.setsockopt — Call to `setsockopt`
  probe::tcp.setsockopt.return — Return from `setsockopt`
  probe::udp.disconnect — Fires when a process requests for a UDP disconnection
  probe::udp.disconnect.return — UDP has been disconnected successfully
  probe::udp.recvmsg — Fires whenever a UDP message is received
  probe::udp.recvmsg.return — Fires whenever an attempt to receive a UDP message received is completed
  probe::udp.sendmsg — Fires whenever a process sends a UDP message
  probe::udp.sendmsg.return — Fires whenever an attempt to send a UDP message is completed
14. Socket Tapset
  function::inet_get_ip_source — Provide IP source address string for a kernel socket
  function::inet_get_local_port — Provide local port number for a kernel socket
  function::sock_fam_num2str — Given a protocol family number, return a string representation
  function::sock_fam_str2num — Given a protocol family name (string), return the corresponding protocol family number
  function::sock_prot_num2str — Given a protocol number, return a string representation
  function::sock_prot_str2num — Given a protocol name (string), return the corresponding protocol number
  function::sock_state_num2str — Given a socket state number, return a string representation
  function::sock_state_str2num — Given a socket state string, return the corresponding state number
  probe::socket.aio_read — Receiving message via `sock_aio_read`
  probe::socket.aio_read.return — Conclusion of message received via `sock_aio_read`
  probe::socket.aio_write — Message send via `sock_aio_write`
  probe::socket.aio_write.return — Conclusion of message send via `sock_aio_write`
  probe::socket.close — Close a socket
  probe::socket.close.return — Return from closing a socket
  probe::socket.create — Creation of a socket
  probe::socket.create.return — Return from Creation of a socket
  probe::socket.read_iter — Receiving message via `sock_read_iter`
  probe::socket.read_iter.return — Conclusion of message received via `sock_read_iter`
  probe::socket.readv — Receiving a message via `sock_readv`
  probe::socket.readv.return — Conclusion of receiving a message via `sock_readv`
  probe::socket.receive — Message received on a socket.
  probe::socket.recvmsg — Message being received on socket
  probe::socket.recvmsg.return — Return from Message being received on socket
  probe::socket.send — Message sent on a socket.
  probe::socket.sendmsg — Message is currently being sent on a socket.
  probe::socket.sendmsg.return — Return from socket.sendmsg.
  probe::socket.write_iter — Message send via `sock_write_iter`
  probe::socket.write_iter.return — Conclusion of message send via `sock_write_iter`
  probe::socket.writev — Message sent via `socket_writev`
  probe::socket.writev.return — Conclusion of message sent via `socket_writev`
15. SNMP Information Tapset
  function::ipmib_filter_key — Default filter function for ipmib.* probes
  function::ipmib_get_proto — Get the protocol value
  function::ipmib_local_addr — Get the local ip address
  function::ipmib_remote_addr — Get the remote ip address
  function::ipmib_tcp_local_port — Get the local tcp port
  function::ipmib_tcp_remote_port — Get the remote tcp port
  function::linuxmib_filter_key — Default filter function for linuxmib.* probes
  function::tcpmib_filter_key — Default filter function for tcpmib.* probes
  function::tcpmib_get_state — Get a socket's state
  function::tcpmib_local_addr — Get the source address
  function::tcpmib_local_port — Get the local port
  function::tcpmib_remote_addr — Get the remote address
  function::tcpmib_remote_port — Get the remote port
  probe::ipmib.ForwDatagrams — Count forwarded packet
  probe::ipmib.FragFails — Count datagram fragmented unsuccessfully
  probe::ipmib.FragOKs — Count datagram fragmented successfully
  probe::ipmib.InAddrErrors — Count arriving packets with an incorrect address
  probe::ipmib.InDiscards — Count discarded inbound packets
  probe::ipmib.InNoRoutes — Count an arriving packet with no matching socket
  probe::ipmib.InReceives — Count an arriving packet
  probe::ipmib.InUnknownProtos — Count arriving packets with an unbound proto
  probe::ipmib.OutRequests — Count a request to send a packet
  probe::ipmib.ReasmReqds — Count number of packet fragments reassembly requests
  probe::ipmib.ReasmTimeout — Count Reassembly Timeouts
  probe::linuxmib.DelayedACKs — Count of delayed acks
  probe::linuxmib.ListenDrops — Count of times conn request that were dropped
  probe::linuxmib.ListenOverflows — Count of times a listen queue overflowed
  probe::linuxmib.TCPMemoryPressures — Count of times memory pressure was used
  probe::tcpmib.ActiveOpens — Count an active opening of a socket
  probe::tcpmib.AttemptFails — Count a failed attempt to open a socket
  probe::tcpmib.CurrEstab — Update the count of open sockets
  probe::tcpmib.EstabResets — Count the reset of a socket
  probe::tcpmib.InSegs — Count an incoming tcp segment
  probe::tcpmib.OutRsts — Count the sending of a reset packet
  probe::tcpmib.OutSegs — Count the sending of a TCP segment
  probe::tcpmib.PassiveOpens — Count the passive creation of a socket
  probe::tcpmib.RetransSegs — Count the retransmission of a TCP segment
16. Kernel Process Tapset
  function::get_loadavg_index — Get the load average for a specified interval
  function::sprint_loadavg — Report a pretty-printed load average
  function::target_set_pid — Does pid descend from target process?
  function::target_set_report — Print a report about the target set
  probe::kprocess.create — Fires whenever a new process or thread is successfully created
  probe::kprocess.exec — Attempt to exec to a new program
  probe::kprocess.exec_complete — Return from exec to a new program
  probe::kprocess.exit — Exit from process
  probe::kprocess.release — Process released
  probe::kprocess.start — Starting new process
17. Signal Tapset
  function::get_sa_flags — Returns the numeric value of sa_flags
  function::get_sa_handler — Returns the numeric value of sa_handler
  function::is_sig_blocked — Returns 1 if the signal is currently blocked, or 0 if it is not
  function::sa_flags_str — Returns the string representation of sa_flags
  function::sa_handler_str — Returns the string representation of an sa_handler
  function::signal_str — Returns the string representation of a signal number
  function::sigset_mask_str — Returns the string representation of a sigset
  probe::signal.check_ignored — Checking to see signal is ignored
  probe::signal.check_ignored.return — Check to see signal is ignored completed
  probe::signal.checkperm — Check being performed on a sent signal
  probe::signal.checkperm.return — Check performed on a sent signal completed
  probe::signal.do_action — Examining or changing a signal action
  probe::signal.do_action.return — Examining or changing a signal action completed
  probe::signal.flush — Flushing all pending signals for a task
  probe::signal.force_segv — Forcing send of SIGSEGV
  probe::signal.force_segv.return — Forcing send of SIGSEGV complete
  probe::signal.handle — Signal handler being invoked
  probe::signal.handle.return — Signal handler invocation completed
  probe::signal.pending — Examining pending signal
  probe::signal.pending.return — Examination of pending signal completed
  probe::signal.procmask — Examining or changing blocked signals
  probe::signal.procmask.return — Examining or changing blocked signals completed
  probe::signal.send — Signal being sent to a process
  probe::signal.send.return — Signal being sent to a process completed (deprecated in SystemTap 2.1)
  probe::signal.send_sig_queue — Queuing a signal to a process
  probe::signal.send_sig_queue.return — Queuing a signal to a process completed
  probe::signal.sys_tgkill — Sending kill signal to a thread group
  probe::signal.sys_tgkill.return — Sending kill signal to a thread group completed
  probe::signal.sys_tkill — Sending a kill signal to a thread
  probe::signal.syskill — Sending kill signal to a process
  probe::signal.syskill.return — Sending kill signal completed
  probe::signal.systkill.return — Sending kill signal to a thread completed
  probe::signal.wakeup — Sleeping process being wakened for signal
18. Errno Tapset
  function::errno_str — Symbolic string associated with error code
  function::return_str — Formats the return value as a string
  function::returnstr — Formats the return value as a string
  function::returnval — Possible return value of probed function
19. RLIMIT Tapset
  function::rlimit_from_str — Symbolic string associated with resource limit code
20. Device Tapset
  function::MAJOR — Extract major device number from a kernel device number (kdev_t)
  function::MINOR — Extract minor device number from a kernel device number (kdev_t)
  function::MKDEV — Creates a value that can be compared to a kernel device number (kdev_t)
  function::usrdev2kerndev — Converts a user-space device number into the format used in the kernel
21. Directory-entry (dentry) Tapset
  function::d_name — get the dirent name
  function::d_path — get the full nameidata path
  function::fullpath_struct_file — get the full path
  function::fullpath_struct_nameidata — get the full nameidata path
  function::fullpath_struct_path — get the full path
  function::inode_name — get the inode name
  function::inode_path — get the path to an inode
  function::real_mount — get the 'struct mount' pointer
  function::reverse_path_walk — get the full dirent path
  function::task_dentry_path — get the full dentry path
22. Logging Tapset
  function::abort — Immediately shutting down probing script.
  function::assert — evaluate assertion
  function::dump_stack — Send the kernel backtrace to the kernel trace buffer
  function::error — Send an error message
  function::exit — Start shutting down probing script.
  function::ftrace — Send a message to the ftrace ring-buffer
  function::log — Send a line to the common trace buffer
  function::printk — Send a message to the kernel trace buffer
  function::warn — Send a line to the warning stream
23. Queue Statistics Tapset
  function::qs_done — Function to record finishing request
  function::qs_run — Function to record being moved from wait queue to being serviced
  function::qs_wait — Function to record enqueue requests
  function::qsq_blocked — Returns the time reqest was on the wait queue
  function::qsq_print — Prints a line of statistics for the given queue
  function::qsq_service_time — Amount of time per request service
  function::qsq_start — Function to reset the stats for a queue
  function::qsq_throughput — Number of requests served per unit time
  function::qsq_utilization — Fraction of time that any request was being serviced
  function::qsq_wait_queue_length — length of wait queue
  function::qsq_wait_time — Amount of time in queue + service per request
24. Random functions Tapset
  function::randint — Return a random number between [0,n)
25. String and data retrieving functions Tapset
  function::atomic_long_read — Retrieves an atomic long variable from kernel memory
  function::atomic_read — Retrieves an atomic variable from kernel memory
  function::kernel_buffer_quoted — Retrieves and quotes buffer from kernel space
  function::kernel_buffer_quoted_error — Retrieves and quotes buffer from kernel space
  function::kernel_char — Retrieves a char value stored in kernel memory
  function::kernel_int — Retrieves an int value stored in kernel memory
  function::kernel_long — Retrieves a long value stored in kernel memory
  function::kernel_or_user_string_quoted — Retrieves and quotes string from kernel or user memory
  function::kernel_or_user_string_quoted_utf16 — Retrieves and quotes UTF-16 string from kernel or user memory
  function::kernel_or_user_string_quoted_utf32 — Retrieves and quotes UTF-32 string from kernel or user memory
  function::kernel_pointer — Retrieves a pointer value stored in kernel memory
  function::kernel_short — Retrieves a short value stored in kernel memory
  function::kernel_string — Retrieves string from kernel memory
  function::kernel_string_n — Retrieves string of given length from kernel memory
  function::kernel_string_quoted — Retrieves and quotes string from kernel memory
  function::kernel_string_quoted_utf16 — Quote given kernel UTF-16 string.
  function::kernel_string_quoted_utf32 — Quote given UTF-32 kernel string.
  function::kernel_string_utf16 — Retrieves UTF-16 string from kernel memory
  function::kernel_string_utf32 — Retrieves UTF-32 string from kernel memory
  function::user_buffer_quoted — Retrieves and quotes buffer from user space
  function::user_buffer_quoted_error — Retrieves and quotes buffer from user space
  function::user_char — Retrieves a char value stored in user space
  function::user_char_error — Retrieves a char value stored in user space
  function::user_char_warn — Retrieves a char value stored in user space
  function::user_int — Retrieves an int value stored in user space
  function::user_int16 — Retrieves a 16-bit integer value stored in user space
  function::user_int16_error — Retrieves a 16-bit integer value stored in user space
  function::user_int32 — Retrieves a 32-bit integer value stored in user space
  function::user_int32_error — Retrieves a 32-bit integer value stored in user space
  function::user_int64 — Retrieves a 64-bit integer value stored in user space
  function::user_int64_error — Retrieves a 64-bit integer value stored in user space
  function::user_int8 — Retrieves a 8-bit integer value stored in user space
  function::user_int8_error — Retrieves a 8-bit integer value stored in user space
  function::user_int_error — Retrieves an int value stored in user space
  function::user_int_warn — Retrieves an int value stored in user space
  function::user_long — Retrieves a long value stored in user space
  function::user_long_error — Retrieves a long value stored in user space
  function::user_long_warn — Retrieves a long value stored in user space
  function::user_short — Retrieves a short value stored in user space
  function::user_short_error — Retrieves a short value stored in user space
  function::user_short_warn — Retrieves a short value stored in user space
  function::user_string — Retrieves string from user space
  function::user_string_n — Retrieves string of given length from user space
  function::user_string_n_nofault — Retrieves string of given length from user space
  function::user_string_n_quoted — Retrieves and quotes string from user space
  function::user_string_n_warn — Retrieves string from user space
  function::user_string_nofault — Retrieves string from user space
  function::user_string_quoted — Retrieves and quotes string from user space
  function::user_string_quoted_utf16 — Quote given user UTF-16 string.
  function::user_string_quoted_utf32 — Quote given user UTF-32 string.
  function::user_string_utf16 — Retrieves UTF-16 string from user memory
  function::user_string_utf32 — Retrieves UTF-32 string from user memory
  function::user_string_warn — Retrieves string from user space
  function::user_uint16 — Retrieves an unsigned 16-bit integer value stored in user space
  function::user_uint16_error — Retrieves an unsigned 16-bit integer value stored in user space
  function::user_uint32 — Retrieves an unsigned 32-bit integer value stored in user space
  function::user_uint32_error — Retrieves an unsigned 32-bit integer value stored in user space
  function::user_uint64 — Retrieves an unsigned 64-bit integer value stored in user space
  function::user_uint64_error — Retrieves an unsigned 64-bit integer value stored in user space
  function::user_uint8 — Retrieves a unsigned 8-bit integer value stored in user space
  function::user_uint8_error — Retrieves a unsigned 8-bit integer value stored in user space
  function::user_ulong — Retrieves an unsigned long value stored in user space
  function::user_ulong_error — Retrieves a unsigned long value stored in user space
  function::user_ulong_warn — Retrieves an unsigned long value stored in user space
  function::user_ushort — Retrieves an unsigned short value stored in user space
  function::user_ushort_error — Retrieves an unsigned short value stored in user space
  function::user_ushort_warn — Retrieves an unsigned short value stored in user space
26. String and data writing functions Tapset
  function::set_kernel_char — Writes a char value to kernel memory
  function::set_kernel_int — Writes an int value to kernel memory
  function::set_kernel_long — Writes a long value to kernel memory
  function::set_kernel_pointer — Writes a pointer value to kernel memory.
  function::set_kernel_short — Writes a short value to kernel memory
  function::set_kernel_string — Writes a string to kernel memory
  function::set_kernel_string_n — Writes a string of given length to kernel memory
  function::set_user_char — Writes a char value to user memory
  function::set_user_int — Writes an int value to user memory
  function::set_user_long — Writes a long value to user memory
  function::set_user_pointer — Writes a pointer value to user memory.
  function::set_user_short — Writes a short value to user memory
  function::set_user_string — Writes a string to user memory
  function::set_user_string_arg — Writes a string to user memory.
  function::set_user_string_n — Writes a string of given length to user memory
27. Guru tapsets
  function::mdelay — millisecond delay
  function::panic — trigger a panic
  function::raise — raise a signal in the current thread
  function::udelay — microsecond delay
28. A collection of standard string functions
  function::isdigit — Checks for a digit
  function::isinstr — Returns whether a string is a substring of another string
  function::matched — Return a given matched subexpression.
  function::matched_str — Return the last matched string.
  function::ngroups — Number of subexpressions in the last match.
  function::str_replace — str_replace Replaces all instances of a substring with another
  function::string_quoted — Quotes a given string
  function::stringat — Returns the char at a given position in the string
  function::strlen — Returns the length of a string
  function::strpos — Returns location of a substring within another string
  function::strtol — strtol - Convert a string to a long
  function::substr — Returns a substring
  function::text_str — Escape any non-printable chars in a string
  function::text_strn — Escape any non-printable chars in a string
  function::tokenize — Return the next non-empty token in a string
29. Utility functions for using ansi control chars in logs
  function::ansi_clear_screen — Move cursor to top left and clear screen.
  function::ansi_cursor_hide — Hides the cursor.
  function::ansi_cursor_move — Move cursor to new coordinates.
  function::ansi_cursor_restore — Restores a previously saved cursor position.
  function::ansi_cursor_save — Saves the cursor position.
  function::ansi_cursor_show — Shows the cursor.
  function::ansi_new_line — Move cursor to new line.
  function::ansi_reset_color — Resets Select Graphic Rendition mode.
  function::ansi_set_color — Set the ansi Select Graphic Rendition mode.
  function::indent — returns an amount of space to indent
  function::indent_depth — returns the global nested-depth
  function::thread_indent — returns an amount of space with the current task information
  function::thread_indent_depth — returns the nested-depth of the current task
30. SystemTap Translator Tapset
  probe::stap.cache_add_mod — Adding kernel instrumentation module to cache
  probe::stap.cache_add_nss — Add NSS (Network Security Services) information to cache
  probe::stap.cache_add_src — Adding C code translation to cache
  probe::stap.cache_clean — Removing file from stap cache
  probe::stap.cache_get — Found item in stap cache
  probe::stap.pass0 — Starting stap pass0 (parsing command line arguments)
  probe::stap.pass0.end — Finished stap pass0 (parsing command line arguments)
  probe::stap.pass1.end — Finished stap pass1 (parsing scripts)
  probe::stap.pass1a — Starting stap pass1 (parsing user script)
  probe::stap.pass1b — Starting stap pass1 (parsing library scripts)
  probe::stap.pass2 — Starting stap pass2 (elaboration)
  probe::stap.pass2.end — Finished stap pass2 (elaboration)
  probe::stap.pass3 — Starting stap pass3 (translation to C)
  probe::stap.pass3.end — Finished stap pass3 (translation to C)
  probe::stap.pass4 — Starting stap pass4 (compile C code into kernel module)
  probe::stap.pass4.end — Finished stap pass4 (compile C code into kernel module)
  probe::stap.pass5 — Starting stap pass5 (running the instrumentation)
  probe::stap.pass5.end — Finished stap pass5 (running the instrumentation)
  probe::stap.pass6 — Starting stap pass6 (cleanup)
  probe::stap.pass6.end — Finished stap pass6 (cleanup)
  probe::stap.system — Starting a command from stap
  probe::stap.system.return — Finished a command from stap
  probe::stap.system.spawn — stap spawned new process
  probe::stapio.receive_control_message — Received a control message
  probe::staprun.insert_module — Inserting SystemTap instrumentation module
  probe::staprun.remove_module — Removing SystemTap instrumentation module
  probe::staprun.send_control_message — Sending a control message
31. Network File Storage Tapsets
  function::nfsderror — Convert nfsd error number into string
  probe:: —
  probe::nfs.aop.readahead — NFS client reading multiple pages
  probe::nfs.aop.readpage — NFS client synchronously reading a page
  probe::nfs.aop.readpages — NFS client reading multiple pages
  probe::nfs.aop.release_page — NFS client releasing page
  probe::nfs.aop.set_page_dirty — NFS client marking page as dirty
  probe::nfs.aop.write_begin — NFS client begin to write data
  probe::nfs.aop.write_end — NFS client complete writing data
  probe::nfs.aop.writepage — NFS client writing a mapped page to the NFS server
  probe::nfs.aop.writepages — NFS client writing several dirty pages to the NFS server
  probe::nfs.fop.aio_read — NFS client aio_read file operation
  probe::nfs.fop.aio_write — NFS client aio_write file operation
  probe::nfs.fop.check_flags — NFS client checking flag operation
  probe::nfs.fop.flush — NFS client flush file operation
  probe::nfs.fop.fsync — NFS client fsync operation
  probe::nfs.fop.llseek — NFS client llseek operation
  probe::nfs.fop.lock — NFS client file lock operation
  probe::nfs.fop.mmap — NFS client mmap operation
  probe::nfs.fop.open — NFS client file open operation
  probe::nfs.fop.read — NFS client read operation
  probe::nfs.fop.read_iter — NFS client read_iter file operation
  probe::nfs.fop.release — NFS client release page operation
  probe::nfs.fop.sendfile — NFS client send file operation
  probe::nfs.fop.write — NFS client write operation
  probe::nfs.fop.write_iter — NFS client write_iter file operation
  probe::nfs.proc.commit — NFS client committing data on server
  probe::nfs.proc.commit_done — NFS client response to a commit RPC task
  probe::nfs.proc.commit_setup — NFS client setting up a commit RPC task
  probe::nfs.proc.create — NFS client creating file on server
  probe::nfs.proc.handle_exception — NFS client handling an NFSv4 exception
  probe::nfs.proc.lookup — NFS client opens/searches a file on server
  probe::nfs.proc.open — NFS client allocates file read/write context information
  probe::nfs.proc.read — NFS client synchronously reads file from server
  probe::nfs.proc.read_done — NFS client response to a read RPC task
  probe::nfs.proc.read_setup — NFS client setting up a read RPC task
  probe::nfs.proc.release — NFS client releases file read/write context information
  probe::nfs.proc.remove — NFS client removes a file on server
  probe::nfs.proc.rename — NFS client renames a file on server
  probe::nfs.proc.rename_done — NFS client response to a rename RPC task
  probe::nfs.proc.rename_setup — NFS client setting up a rename RPC task
  probe::nfs.proc.write — NFS client synchronously writes file to server
  probe::nfs.proc.write_done — NFS client response to a write RPC task
  probe::nfs.proc.write_setup — NFS client setting up a write RPC task
  probe::nfsd.close — NFS server closing a file for client
  probe::nfsd.commit — NFS server committing all pending writes to stable storage
  probe::nfsd.create — NFS server creating a file(regular,dir,device,fifo) for client
  probe::nfsd.createv3 — NFS server creating a regular file or set file attributes for client
  probe::nfsd.dispatch — NFS server receives an operation from client
  probe::nfsd.lookup — NFS server opening or searching file for a file for client
  probe::nfsd.open — NFS server opening a file for client
  probe::nfsd.proc.commit — NFS server performing a commit operation for client
  probe::nfsd.proc.create — NFS server creating a file for client
  probe::nfsd.proc.lookup — NFS server opening or searching for a file for client
  probe::nfsd.proc.read — NFS server reading file for client
  probe::nfsd.proc.remove — NFS server removing a file for client
  probe::nfsd.proc.rename — NFS Server renaming a file for client
  probe::nfsd.proc.write — NFS server writing data to file for client
  probe::nfsd.read — NFS server reading data from a file for client
  probe::nfsd.rename — NFS server renaming a file for client
  probe::nfsd.unlink — NFS server removing a file or a directory for client
  probe::nfsd.write — NFS server writing data to a file for client
32. Speculation
  function::commit — Write out all output related to a speculation buffer
  function::discard — Discard all output related to a speculation buffer
  function::speculate — Store a string for possible output later
  function::speculation — Allocate a new id for speculative output
33. JSON Tapset
  function::json_add_array — Add an array
  function::json_add_array_numeric_metric — Add a numeric metric to an array
  function::json_add_array_string_metric — Add a string metric to an array
  function::json_add_numeric_metric — Add a numeric metric
  function::json_add_string_metric — Add a string metric
  function::json_set_prefix — Set the metric prefix.
  macro::json_output_array_numeric_value — Output a numeric value for metric in an array.
  macro::json_output_array_string_value — Output a string value for metric in an array.
  macro::json_output_data_end — End the json output.
  macro::json_output_data_start — Start the json output.
  macro::json_output_numeric_value — Output a numeric value.
  macro::json_output_string_value — Output a string value.
  probe::json_data — Fires whenever JSON data is wanted by a reader.
34. Output file switching Tapset
  function::switch_file — switch to the next output file
35. Floating point processing Tapset
  function::fp32_to_fp64 — Convert fp32 to 64 bit floating point
  function::fp_add — Addition between floating points
  function::fp_eq — fp comparison function equal
  function::fp_le — Check if first fp is less than or equal to
  function::fp_lt — fp comparison function less than
  function::fp_mul — Multiplication between floating points
  function::fp_rem — Floating point division
  function::fp_sqrt — Floating point square root
  function::fp_sub — Subtraction between floating points
  function::fp_to_long — Convert fp to int64
  function::fp_to_string — Convert 64 bit floating point to string
  function::long_to_fp — Convert long int to 64 bit floating point
  function::string_to_fp — Convert the given string into floating point
36. Syscall Any Tapset
  probe::syscall_any — Record entry into a syscall
  probe::syscall_any.return — Record exit from a syscall
37. CVE Livepatching Tapset
  function::cve_count_metric — Increment the count of key
  function::cve_record_metric — Set the value of key
  function::cve_tmpdisable — Disable the cve livepatch
38. syscalls

List of Tables

38.1. Syscalls list

|  | Next
|  | Chapter 1. Introduction