Lines Matching full:trace
1 Demonstrations of trace.
4 trace probes functions you specify and displays trace messages if a particular
8 For example, suppose you want to trace all commands being exec'd across the
11 # trace 'sys_execve "%s", arg1'
32 to be the command that is exec'd. The above trace was generated by executing
36 Next, suppose you are looking for large reads across the system. Let's trace
40 # trace 'sys_read (arg3 > 20000) "read %d bytes", arg3'
48 During the trace, I executed "dd if=/dev/zero of=/dev/null bs=1M count=4".
53 You can also trace user functions. For example, let's simulate the bashreadline
57 # trace 'r:bash:readline "%s", retval'
73 # trace.py -U -a 'r::sys_futex "%d", retval'
83 trace failed read and write calls on the libc level, and include a time column:
85 # trace 'r:c:read ((int)retval < 0) "read failed: %d", retval' \
96 trace has also some basic support for kernel tracepoints. For example, let's
97 trace the block:block_rq_complete tracepoint and print out the number of sectors
100 # trace 't:block:block_rq_complete "sectors=%d", args->nr_sector' -T
119 predicate and trace arguments.
123 These probes can be traced by trace just like kernel tracepoints. For example,
124 trace new threads being created and their function name, include time column
127 # trace 'u:pthread:pthread_create "%U", arg3' -T -C
137 The "%U" format specifier tells trace to resolve arg3 as a user-space symbol,
141 trace Ruby methods being called (this requires a version of Ruby built with
144 # trace 'u:ruby:method__entry "%s.%s", arg1, arg2' -p $(pidof irb) -T
154 You can also trace exported functions from shared libraries, or an imported
157 # sudo ./trace.py 'r:/usr/lib64/libtinfo.so:curses_version "Version=%s", retval'
168 # trace 'p:c:open (STRCMP("test.txt", arg1)) "opening %s", arg1' -T
180 # trace 'p:c:open(char *filename) "opening %s", filename'
185 # trace 'p::SyS_nanosleep(struct timespec *ts) "sleep for %lld ns", ts->tv_nsec'
198 As a final example, let's trace open syscalls for a specific process. By
201 # trace -p 2740 'do_sys_open "%s", arg2' -T
223 # trace sys_open
237 # trace.py 'sys_setsockopt(int fd, int level, int optname, char* optval, int optlen)(level==0 && op…
252 usage: trace [-h] [-b BUFFER_PAGES] [-p PID] [-L TID] [-v] [-Z STRING_SIZE]
256 Attach to functions and print trace messages.
266 -p PID, --pid PID id of the process to trace (optional)
267 -L TID, --tid TID id of the thread to trace (optional)
271 -S, --include-self do not filter trace's own pid from the trace
274 -t, --timestamp print timestamp column (offset from trace start)
278 -K, --kernel-stack output kernel stack trace
279 -U, --user-stack output user stack trace
288 trace do_sys_open
289 Trace the open syscall and print a default trace message when entered
290 trace 'do_sys_open "%s", arg2'
291 Trace the open syscall and print the filename being opened
292 trace 'sys_read (arg3 > 20000) "read %d bytes", arg3'
293 Trace the read syscall and print a message for reads >20000 bytes
294 trace 'r::do_sys_open "%llx", retval'
295 Trace the return from the open syscall and print the return value
296 trace 'c:open (arg2 == 42) "%s %d", arg1, arg2'
297 Trace the open() call from libc only if the flags (arg2) argument is 42
298 trace 'c:malloc "size = %d", arg1'
299 Trace malloc calls and print the size being allocated
300 trace 'p:c:write (arg1 == 1) "writing %d bytes to STDOUT", arg3'
301 Trace the write() call from libc to monitor writes to STDOUT
302 trace 'r::__kmalloc (retval == 0) "kmalloc failed!"'
303 Trace returns from __kmalloc which returned a null pointer
304 trace 'r:c:malloc (retval) "allocated = %x", retval'
305 Trace returns from malloc and print non-NULL allocated buffers
306 trace 't:block:block_rq_complete "sectors=%d", args->nr_sector'
307 Trace the block_rq_complete kernel tracepoint and print # of tx sectors
308 trace 'u:pthread:pthread_create (arg4 != 0)'
309 Trace the USDT probe pthread_create when its 4th argument is non-zero
310 trace 'p::SyS_nanosleep(struct timespec *ts) "sleep for %lld ns", ts->tv_nsec'
311 Trace the nanosleep syscall and print the sleep duration in ns
312 trace -I 'linux/fs.h' \
314 Trace the uprobe_register inode mapping ops, and the symbol can be found
316 trace -I 'kernel/sched/sched.h' \
318 Trace the cfs scheduling runqueue remaining runtime. The struct cfs_rq is defined
322 trace -I 'net/sock.h' \\
324 Trace udpv6 sendmsg calls only if socket's destination port is equal
326 trace -I 'linux/fs_struct.h' 'mntns_install "users = %d", $task->fs->users'
327 Trace the number of users accessing the file system of the current task