FM / lwtools

/usr/share/systemtap/examples/lwtools

Name	Size	Mode	Actions
accept2close-nd.8	1424	0644	edit dl rm
accept2close-nd.meta	597	0644	edit dl rm
accept2close-nd.stp	1798	0755	edit dl rm
accept2close-nd.txt	3385	0644	edit dl rm
biolatency-nd.8	1671	0644	edit dl rm
biolatency-nd.meta	622	0644	edit dl rm
biolatency-nd.stp	2071	0755	edit dl rm
biolatency-nd_example.txt	7362	0644	edit dl rm
bitesize-nd.8	1157	0644	edit dl rm
bitesize-nd.meta	491	0644	edit dl rm
bitesize-nd.stp	1543	0755	edit dl rm
bitesize-nd_example.txt	3426	0644	edit dl rm
execsnoop-nd.8	1235	0644	edit dl rm
execsnoop-nd.meta	570	0644	edit dl rm
execsnoop-nd.stp	1283	0755	edit dl rm
execsnoop-nd_example.txt	2585	0644	edit dl rm
fslatency-nd.8	1930	0644	edit dl rm
fslatency-nd.meta	660	0644	edit dl rm
fslatency-nd.stp	3982	0755	edit dl rm
fslatency-nd_example.txt	13384	0644	edit dl rm
fsslower-nd.8	1753	0644	edit dl rm
fsslower-nd.meta	623	0644	edit dl rm
fsslower-nd.stp	3715	0755	edit dl rm
fsslower-nd_example.txt	1938	0644	edit dl rm
killsnoop-nd.8	1131	0644	edit dl rm
killsnoop-nd.meta	384	0644	edit dl rm
killsnoop-nd.stp	1281	0755	edit dl rm
killsnoop-nd_example.txt	1908	0644	edit dl rm
opensnoop-nd.8	1268	0644	edit dl rm
opensnoop-nd.meta	357	0644	edit dl rm
opensnoop-nd.stp	1026	0755	edit dl rm
opensnoop-nd_example.txt	1124	0644	edit dl rm
README	107	0644	edit dl rm
rwtime-nd.8	1146	0644	edit dl rm
rwtime-nd.meta	412	0644	edit dl rm
rwtime-nd.stp	1599	0755	edit dl rm
rwtime-nd_example.txt	4185	0644	edit dl rm
syscallbypid-nd.8	1089	0644	edit dl rm
syscallbypid-nd.meta	404	0644	edit dl rm
syscallbypid-nd.stp	1100	0755	edit dl rm
syscallbypid-nd_example.txt	9322	0644	edit dl rm

Edit: /usr/share/systemtap/examples/lwtools/accept2close-nd.stp (1798B)

#!/usr/bin/stap
/*
 * accept2close-nd.stp	Show socket duration: accept()->close().
 *
 * USAGE: ./accept2close.stp [min_ms]
 *
 * NOTE: This will miss sockets that are opened by one process, and then closed
 * by another (eg, sshd).
 *
 * A minimum latency threshold, in milliseconds, can be provided as an optional
 * argument. Without this, all events are shown.
 *
 * Copyright (C) 2015 Brendan Gregg.
 *
 * This program is free software; you can redistribute it and/or modify
 * it under the terms of the GNU General Public License as published by
 * the Free Software Foundation; either version 2 of the License, or
 * (at your option) any later version.
 *
 * This program is distributed in the hope that it will be useful,
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 * GNU General Public License for more details.
 *
 * 20-Jun-2014	Brendan Gregg	Created this.
 */

global duration, ts, min_ns;

probe begin
{
	# process arguments
	if (argv_1 != "") {
		min_ns = strtol(argv_1, 10) * 1000000;
		printf("Only tracing events slower than %s ms.\n", argv_1);
	} else {
		min_ns = 0;
	}

printf("%-24s %-6s %-14s %-4s %s\n", "TIME", "PID", "COMM", "FD",
	    "DURATION");
}

probe nd_syscall.accept.return,
    nd_syscall.accept4.return
{
	ts[tid(), retval] = gettimeofday_ns();
}

probe nd_syscall.close
{
	last = ts[tid(), int_arg(1)];
	if (last) {
		delta = gettimeofday_ns() - last;
		if (delta >= min_ns) {
			printf("%-24s %-6d %-14s %-4d %d ms\n",
			    ctime(gettimeofday_s()),
			    pid(), execname(), int_arg(1), delta / 1000000);
			duration <<< delta;
		}
		delete ts[tid(), int_arg(1)];
	}
}

probe end
{
	printf("\nDuration (ns):\n");
	if (@count(duration)) { print(@hist_log(duration)); }
}

cmd: