Differences between revisions 8 and 9
⇤ ← Revision 8 as of 2020-03-14 17:32:06 →
Size: 1863
Editor: EmanueleRocca
Comment:
← Revision 9 as of 2020-03-14 23:58:28 → ⇥
Size: 1859
Editor: PaulWise
Comment: general cleanup
Deletions are marked like this. Additions are marked like this.
Line 1: Line 1:
[[http://sources.redhat.com/systemtap/|SystemTap]] provides an infrastructure to simplify the gathering of information about the running Linux kernel or userspace programs. SystemTap scripts are compiled into loadable kernel modules and can instrument the execution of functions or statements in the kernel or user-space. [[https://www.sourceware.org/systemtap/|SystemTap]] provides an infrastructure to simplify the gathering of information about the running Linux kernel or userspace programs. SystemTap scripts are compiled into loadable kernel modules and can instrument the execution of functions or statements in the kernel or user-space.
Line 4: Line 4:
Line 22: Line 23:
If the package cannot be found, add the following to '''/etc/apt/sources.list''' and run '''apt update''', then try to install the package again: If the debug symbols package cannot be found, add the [[SourcesList#Debug_Symbol_Packages|debug packages archive]] to your [[SourcesList|apt sources]], run '''apt update''' and then try to install the package again.
Line 24: Line 25:
{{{
deb https://debug.mirrors.debian.org/debian-debug/ stable-debug main
}}}		 List the probe points matching a certain pattern:
Line 28: Line 27:

List the probe points matching a certain parttern:
Line 34: Line 31:
See when a given function gets called:
Line 35: Line 33:
See when a given function gets called:
Line 43: Line 40:
Line 48: Line 46:
Line 54: Line 53:
There is a guide on [[http://sources.redhat.com/systemtap/wiki/SystemtapOnDebian|how to configure SystemTap on a Debian]] system in [[http://sources.redhat.com/systemtap/wiki/|SystemTap's Wiki]]. There is a guide on [[https://www.sourceware.org/systemtap/wiki/SystemtapOnDebian|how to configure SystemTap on a Debian]] system in [[https://www.sourceware.org/systemtap/wiki/|SystemTap's Wiki]].

SystemTap provides an infrastructure to simplify the gathering of information about the running Linux kernel or userspace programs. SystemTap scripts are compiled into loadable kernel modules and can instrument the execution of functions or statements in the kernel or user-space.

Quick start

Install systemtap as well as the kernel headers for your currently running kernel: 

apt install systemtap linux-headers-$(uname -r)

Try out this hello world one-liner: 

stap -v -e 'probe oneshot { println("hello world") }'

Inspect some user-space code, for example coreutils, by installing the relevant debug symbols: 

apt install coreutils-dbgsym

If the debug symbols package cannot be found, add the debug packages archive to your apt sources, run apt update and then try to install the package again.

List the probe points matching a certain pattern: 

sudo stap -L 'process("/bin/ls").function("*user*")'

See when a given function gets called: 

stap -e 'probe process("/bin/ls").function("format_user") { printf("format_user(uid=%d)\n", $u) }'

Now try running ls -l /etc/passwd, and you should see output from your SystemTap probe.

Finally, to instrument the Linux kernel, install the debug symbols (warning! that's a big package): 

apt install systemtap linux-image-$(uname -r)-dbg

You can now instrument kernel functions, for example: 

stap -ve 'probe kernel.function("icmp_reply") { println("icmp reply") }'

See also

There is a guide on how to configure SystemTap on a Debian system in SystemTap's Wiki.