- Prev
- SystemTap Beginners Guide
- Next

### ⁠5.3.5. Tracking Most Frequently Used System Calls

timeout.stp from Section 5.3.4, “Monitoring Polling Applications” helps you identify which applications are polling by examining a small subset of system calls ( `poll`, `select`, `epoll`, `itimer`, `futex`, `nanosleep`, and `signal`). However, in some systems, an excessive number of system calls outside that small subset might be responsible for time spent in the kernel. If you suspect that an application is using system calls excessively, you need to identify the most frequently used system calls on the system. To do this, use topsys.stp.
topsys.stp

    #! /usr/bin/env stap
    #
    # This script continuously lists the top 20 systemcalls in the interval
    # 5 seconds
    #

    global syscalls_count

    probe syscall_any {
      syscalls_count[name] <<< 1
    }

    function print_systop () {
      printf ("%25s %10s\n", "SYSCALL", "COUNT")
      foreach (syscall in syscalls_count- limit 20) {
        printf("%25s %10d\n", syscall, @count(syscalls_count[syscall]))
      }
      delete syscalls_count
    }

    probe timer.s(5) {
      print_systop ()
      printf("--------------------------------------------------------------\n")
    }

    global prom_arr

    probe prometheus {
      foreach (syscall in syscalls_count- limit 20)
        prom_arr[syscall] = @count(syscalls_count[syscall])

      @prometheus_dump_array1(prom_arr, "top_syscall_count", "name")
      delete prom_arr
    }

topsys.stp lists the top 20 system calls used by the system per 5-second interval. It also lists how many times each system call was used during that period. Refer to Example 5.17, “topsys.stp Sample Output” for a sample output.
⁠

Example 5.17. topsys.stp Sample Output

    --------------------------------------------------------------
                      SYSCALL      COUNT
                 gettimeofday       1857
                         read       1821
                        ioctl       1568
                         poll       1033
                        close        638
                         open        503
                       select        455
                        write        391
                       writev        335
                        futex        303
                      recvmsg        251
                       socket        137
                clock_gettime        124
               rt_sigprocmask        121
                       sendto        120
                    setitimer        106
                         stat         90
                         time         81
                    sigreturn         72
                        fstat         66
    --------------------------------------------------------------

- Prev5.3.4. Monitoring Polling Applications
- Up
- Home
- Next5.3.6. Tracking System Call Volume Per Process