FM / lwtools

/usr/share/systemtap/examples/lwtools

Name	Size	Mode	Actions
accept2close-nd.8	1424	0644	edit dl rm
accept2close-nd.meta	597	0644	edit dl rm
accept2close-nd.stp	1798	0755	edit dl rm
accept2close-nd.txt	3385	0644	edit dl rm
biolatency-nd.8	1671	0644	edit dl rm
biolatency-nd.meta	622	0644	edit dl rm
biolatency-nd.stp	2071	0755	edit dl rm
biolatency-nd_example.txt	7362	0644	edit dl rm
bitesize-nd.8	1157	0644	edit dl rm
bitesize-nd.meta	491	0644	edit dl rm
bitesize-nd.stp	1543	0755	edit dl rm
bitesize-nd_example.txt	3426	0644	edit dl rm
execsnoop-nd.8	1235	0644	edit dl rm
execsnoop-nd.meta	570	0644	edit dl rm
execsnoop-nd.stp	1283	0755	edit dl rm
execsnoop-nd_example.txt	2585	0644	edit dl rm
fslatency-nd.8	1930	0644	edit dl rm
fslatency-nd.meta	660	0644	edit dl rm
fslatency-nd.stp	3982	0755	edit dl rm
fslatency-nd_example.txt	13384	0644	edit dl rm
fsslower-nd.8	1753	0644	edit dl rm
fsslower-nd.meta	623	0644	edit dl rm
fsslower-nd.stp	3715	0755	edit dl rm
fsslower-nd_example.txt	1938	0644	edit dl rm
killsnoop-nd.8	1131	0644	edit dl rm
killsnoop-nd.meta	384	0644	edit dl rm
killsnoop-nd.stp	1281	0755	edit dl rm
killsnoop-nd_example.txt	1908	0644	edit dl rm
opensnoop-nd.8	1268	0644	edit dl rm
opensnoop-nd.meta	357	0644	edit dl rm
opensnoop-nd.stp	1026	0755	edit dl rm
opensnoop-nd_example.txt	1124	0644	edit dl rm
README	107	0644	edit dl rm
rwtime-nd.8	1146	0644	edit dl rm
rwtime-nd.meta	412	0644	edit dl rm
rwtime-nd.stp	1599	0755	edit dl rm
rwtime-nd_example.txt	4185	0644	edit dl rm
syscallbypid-nd.8	1089	0644	edit dl rm
syscallbypid-nd.meta	404	0644	edit dl rm
syscallbypid-nd.stp	1100	0755	edit dl rm
syscallbypid-nd_example.txt	9322	0644	edit dl rm

Edit: /usr/share/systemtap/examples/lwtools/accept2close-nd.8 (1424B)

.TH accept2close-nd 8  "2015-01-30" "USER COMMANDS"
.SH NAME
accept2close-nd \- trace process signals. Uses Linux SystemTap (non-debuginfo).
.SH SYNOPSIS
.B accept2close-nd.stp
[min_ms]
.SH DESCRIPTION
This traces socket duration from the accept() syscall to close(), and provides
details on the lifespan of these passive connections.

NOTE: This will miss sockets that are opened by one process, and then closed
by another (eg, sshd).
.SH REQUIREMENTS
SystemTap.
.SH OPTIONS
.TP
min_ms
Minimum lifespan threshold, in milliseconds. This is an optional argument that
can be used to focus on outliers.
.SH EXAMPLES
.TP
Trace all passive socket connections, and show event details and a summary:
#
.B accept2close-nd.stp
.TP
Trace all passive socket connections equal to or slower than 5 milliseconds:
#
.B accept2close-nd.stp 5
.SH FIELDS
.TP
TIME
Time of socket close, human readable.
.TP
PID
Server process ID
.TP
COMM
Server process name.
.TP
FD
File descriptor for socket.
.TP
DURATION
Duration of socket connection (lifespan), in milliseconds.
.SH OVERHEAD
Should be low. Test first.
.SH SOURCE
This is from the SystemTap lwtools collection.
.IP
https://github.com/brendangregg/systemtap-lwtools
.PP
Also look under the examples directory for a text file containing example
usage, output, and commentary for this tool.
.SH OS
Linux
.SH STABILITY
Unstable - in development.
.SH AUTHOR
Brendan Gregg
.SH SEE ALSO
strace(1)

cmd: