Linux下的万能观测工具.ppt

* SystemTapLinux下的万能观测工具 褚霸 核心系统数据库组 chuba@ 2010/11/18 Agenda 介绍SystemTap ? 安装和系统要求 ? 实践例子 ? 参考和杂项 ? 结论 SystemTap是什么？ According to /systemtap/ ? SystemTap provides free software (GPL) infrastructure to simplify the gathering of information about the running Linux system. This assists diagnosis of a performance or functional problem. SystemTap eliminates the need for the developer to go through the tedious and disruptive instrument, recompile, install, and reboot sequence that may be otherwise required to collect data. ? ? ? 观察活体系统最佳工具，前提是你懂得如何观察！ SystemTap是如何工作的 1. write or choose a script describing what you want to observe 2. stap translates it into a kernel module 3. stap loads the module and communicates with it ? 4. just wait for your data ? 五步走 #?stap -uv test.stpPass 1: parsed user script and 74 library script(s) using 86868virt/20488res/1792shr kb, in 190usr/20sys/209real ms.Pass 2: analyzed script: 1 probe(s), 0 function(s), 0 embed(s), 0 global(s) using 87264virt/21148res/1976shr kb, in 10usr/0sys/7real ms.Pass 3: translated to C into /tmp/stapz2iv97/stap_aef621603e006af62084b361e0a0c981_553.c using 87264virt/21332res/2144shr kb, in 0usr/0sys/0real ms.Pass 4: compiled C into stap_aef621603e006af62084b361e0a0c981_553.ko in 1230usr/160sys/1384real ms.Pass 5: starting run.Pass 5: run completed in 10usr/20sys/12331real ms. SystemTap 探测点例子 SystemTap is all about executing certain actions when hitting certain probe points. ? syscall.read ??????when entering read() system call syscall.close.return ????????when returning from the close() system call module(floppy).function(*) ????????when entering any function from the floppy module kernel.function(*@net/socket.c).return ????????when returning from any function in le net/socket.c kernel.statement(*@kernel/sched.c:2917) ????????when hitting line 2917 of le kernel/sched.c 更多探测点例子 timer.ms(200) ?????? every 200 milliseconds ? process(/bin/ls).function(*)??????? ?????? when entering any function in /bin/ls