systemtap 脚本示例

.[root@localhost ~]# stap -v -e 'probe vfs.read {printf("read performed\n"); exit()}'

Pass : parsed user script and  library script(s) using 146900virt/23668res/3024shr/21332data kb, in 130usr/40sys/183real ms.
Pass : analyzed script:  probe(s),  function(s),  embed(s),  global(s) using 257648virt/78000res/6100shr/71736data kb, in 510usr/870sys/2099real ms.
Pass : using cached /root/.systemtap/cache/e2/stap_e2a36f2dcc498d9e1b0e44a8fa8004fa_1020.c
Pass : using cached /root/.systemtap/cache/e2/stap_e2a36f2dcc498d9e1b0e44a8fa8004fa_1020.ko
Pass : starting run.
read performed
Pass : run completed in 10usr/40sys/344real ms.

.[root@localhost ~]# uname -m
  x86_64

.[root@localhost ~]# uname -r
  2.6.-.el5

.[root@localhost ~]# uname -a
  Linux localhost.localdomain 2.6.-.el5 # SMP Wed Dec  :: EST  x86_64 x86_64 x86_64 GNU/Linux

.stap -r kernel_version script -m module_name

     stap -r 2.6.-.el5 -e 'probe vfs.read {exit()}' -m simple
     生成simple.ko

     staprun  simple.ko

. [root@localhost ~]# echo "probe timer.s(10) {exit()}" | stap -v -

   说明：To instruct stap to read a SystemTap script from standard input, use the - switch instead of the file name

.stap -e 'probe module("ext3").function("*") {println(execname()," ",pid()) }'

.stap -e 'probe timer.s(4) {println(execname()," ",pid()) }'

.stap -e 'probe begin{printf ("hello world\n"); exit() }'

.stap -e 'probe syscall.open { printf("%s(%d) open\n", execname(), pid()) }'

.[root@localhost ~]# cat >thread_indent.stp
probe kernel.function("*@net/socket.c").call
{
  printf ("%s -> %s\n", thread_indent(), probefunc())
}
probe kernel.function("*@net/socket.c").return
{
  printf ("%s <- %s\n", thread_indent(-), probefunc())
}
[root@localhost ~]# stap thread_indent.stp
      pcscd(): -> sock_poll
     pcscd(): <- sock_poll
      pcscd(): -> sock_poll
      pcscd(): <- sock_poll

.
 [root@localhost ~]# cat .stp
   probe syscall.* {
     if(pid() == target())
         printf("%s\n", name)
       }
  stap .stp -x 

.[root@localhost ~]# stap .stp -c "ls -a"

.[root@localhost ~]# stap -L 'kernel.function("vfs_read")'
kernel.function("vfs_read@fs/read_write.c:248") $file:struct file* $buf:char* $count:size_t $pos:loff_t*

.
stap -e 'probe kernel.function("vfs_read") {
                   printf ("current files_stat max_files: %d\n",
                   @var("files_stat@fs/file_table.c")->max_files);
                   exit(); }'

.打印刷 函数的（vfs_read)四个参数

[root@localhost ~]# stap -e 'probe kernel.function("vfs_read") {printf("%s\n", $$parms); exit(); }'

file=0xffff81005429d0c0 buf=0x7fff98a0c270 count=0x2004 pos=0xffff8100363d3f50    

说明:There are four parameters passed into vfs_read: file, buf, count, and pos.
The $$parms generates a string for the parameters passed into the function.
In this case all but the count parameter are pointers.

.打印数据结构
stap -e 'probe kernel.function("vfs_read") {printf("%s\n", $$parms$); exit(); }'

file={            .f_u={...},
                  .f_dentry=0xffff81003492c660,
                  .f_vfsmnt=0xffff810047fb70c0,
          .f_op=0xffffffff886594a0,
          .f_count={...},
          .f_flags=,
          .f_mode=,
          .f_pos=,
          .f_owner={...},
          .f_uid=,
          .f_gid=,
          .f_ra={...},
          .f_version=,
          .f_security=0x0,
          .private_data=0x0,
          .f_ep_links={...},
          .f_ep_lock={...},
          .f_mapping=0xffff8100346125c0
          }
buf=""
count=
pos=-

.打印更详细的数据结构
stap -e 'probe kernel.function("vfs_read") {printf("%s\n", $$parms$$); exit(); }'
file={.f_u={.fu_list={.next=0xffff810057a3e0f8,
                      .prev=0xffff8100440d70c0},
              .fu_rcuhead={.next=0xffff810057a3e0f8,
                           .func=0xffff8100440d70c0
                  }
              },
       .f_dentry=0xffff810032dbb150,
       .f_vfsmnt=0xffff810047fb70c0,
       .f_op=0xffffffff8865b040,
       .f_count={.counter=},
       .f_flags=,
       .f_mode=,
       .f_pos=,
       .f_owner={.lock={.raw_lock={.lock=}},
                        .pid=,
                .uid=,
                .euid=,
                .security=0x0,
                .signum=},
                .f_uid=,
                .f_gid=,
                .f_ra={.start=,
                       .size=,
                   .flags=,
                   .cache_hit=,
                   .prev_page=,
                   .ahead_start=,
                   .ahea
说明:With the “$” suffix fields that are composed of data structures are not expanded.
     The “$$” suffix will print the values contained within the nested data structures

.@cast:类型转换
function task_state:long (task:long)
{
    return @cast(task, "task_struct", "kernel<linux/sched.h>")->state
}

The function returns the value of the state field from a task_struct pointed to by the long task.
The first argument of the @cast operator, task, is the pointer to the object.
The second argument is the type to cast the object to, task_struct.
The third argument lists what file that the type definition information comes from and is optional. 

.命令行参数传递
    Use $ if you are expecting the user to enter an integer as a command-line argument,
    and @ if you are expecting a string. 

   cat >.stp
   probe kenel.function(@)
       {
            printfln( execname(),@)

       }

 [root@localhost ~]# stap  stap .stp vfs_read

 .
foo["tom"] =
foo["dick"] =
foo["harry"] =
device[pid(),execname(),uid(),ppid(),"W"] = devname

All associate arrays must be declared as global,
regardless of whether the associate array is used in one or multiple probes

.
global reads
probe vfs.read
{
  reads[execname()] ++
}
probe timer.s()
{
  foreach (count in reads)
    printf("%s : %d \n", count, reads[count])

}

.
probe timer.s()
{
  foreach (count in reads- limit )
    printf("%s : %d \n", count, reads[count])
}

reads:数组
limit :
The limit  option instructs the foreach to only process the first ten iterations
(that is, print the first , starting with the highest value).
-:in descending order 

cat >.stp

global reads
probe vfs.read
{
  reads[execname()] ++
}

probe timer.s()
{
  printf("=======\n")
  foreach (count in reads-)
    printf("%s : %d \n", count, reads[count])
  if(["stapio"] in reads) {
    printf("stapio read detected, exiting\n")

  }

  .

global reads
probe vfs.read
{
  reads[execname(),pid()] <<<
}
probe timer.s()
{
  foreach([var1,var2] in reads)
    printf("%s (%d) : %d \n", var1, var2, @count(reads[var1,var2]))
}
@count(reads[execname()]) will return how many values are stored in each unique key in array reads.
@sum(reads[execname()]) will return the total of all values stored in each unique key in array reads.
the operator <<< $count stores the amount returned by $count to
the associated value of the corresponding execname() in the reads array