FM / lwtools

/usr/share/systemtap/examples/lwtools

Name	Size	Mode	Actions
accept2close-nd.8	1424	0644	edit dl rm
accept2close-nd.meta	597	0644	edit dl rm
accept2close-nd.stp	1798	0755	edit dl rm
accept2close-nd.txt	3385	0644	edit dl rm
biolatency-nd.8	1671	0644	edit dl rm
biolatency-nd.meta	622	0644	edit dl rm
biolatency-nd.stp	2071	0755	edit dl rm
biolatency-nd_example.txt	7362	0644	edit dl rm
bitesize-nd.8	1157	0644	edit dl rm
bitesize-nd.meta	491	0644	edit dl rm
bitesize-nd.stp	1543	0755	edit dl rm
bitesize-nd_example.txt	3426	0644	edit dl rm
execsnoop-nd.8	1235	0644	edit dl rm
execsnoop-nd.meta	570	0644	edit dl rm
execsnoop-nd.stp	1283	0755	edit dl rm
execsnoop-nd_example.txt	2585	0644	edit dl rm
fslatency-nd.8	1930	0644	edit dl rm
fslatency-nd.meta	660	0644	edit dl rm
fslatency-nd.stp	3982	0755	edit dl rm
fslatency-nd_example.txt	13384	0644	edit dl rm
fsslower-nd.8	1753	0644	edit dl rm
fsslower-nd.meta	623	0644	edit dl rm
fsslower-nd.stp	3715	0755	edit dl rm
fsslower-nd_example.txt	1938	0644	edit dl rm
killsnoop-nd.8	1131	0644	edit dl rm
killsnoop-nd.meta	384	0644	edit dl rm
killsnoop-nd.stp	1281	0755	edit dl rm
killsnoop-nd_example.txt	1908	0644	edit dl rm
opensnoop-nd.8	1268	0644	edit dl rm
opensnoop-nd.meta	357	0644	edit dl rm
opensnoop-nd.stp	1026	0755	edit dl rm
opensnoop-nd_example.txt	1124	0644	edit dl rm
README	107	0644	edit dl rm
rwtime-nd.8	1146	0644	edit dl rm
rwtime-nd.meta	412	0644	edit dl rm
rwtime-nd.stp	1599	0755	edit dl rm
rwtime-nd_example.txt	4185	0644	edit dl rm
syscallbypid-nd.8	1089	0644	edit dl rm
syscallbypid-nd.meta	404	0644	edit dl rm
syscallbypid-nd.stp	1100	0755	edit dl rm
syscallbypid-nd_example.txt	9322	0644	edit dl rm

Edit: /usr/share/systemtap/examples/lwtools/accept2close-nd.txt (3385B)

Examples of accept2close-nd.stp, the Linux SystemTap version.

This shows accepted socket lifespans, by measuring the time from syscall
accept() to close() on the same file descriptor. Sessions are printed as they
occur, and a histogram summary is printed at the end. For example:

# ./accept2close-nd.stp
TIME                     PID    COMM           FD   DURATION
Sat Jan 31 05:31:14 2015 29042  node           11   1 ms
Sat Jan 31 05:31:15 2015 29042  node           11   1 ms
Sat Jan 31 05:31:15 2015 29042  node           11   1 ms
Sat Jan 31 05:31:15 2015 29042  node           11   1 ms
Sat Jan 31 05:31:15 2015 29042  node           11   1 ms
Sat Jan 31 05:31:15 2015 29042  node           11   1 ms
Sat Jan 31 05:31:15 2015 29042  node           11   1 ms
Sat Jan 31 05:31:15 2015 29042  node           11   1 ms
Sat Jan 31 05:31:15 2015 29042  node           11   1 ms
Sat Jan 31 05:31:15 2015 29042  node           11   1 ms
Sat Jan 31 05:31:15 2015 29042  node           11   1 ms
Sat Jan 31 05:31:15 2015 29042  node           11   1 ms
Sat Jan 31 05:31:15 2015 29042  node           11   2 ms
Sat Jan 31 05:31:15 2015 29042  node           11   3 ms
Sat Jan 31 05:31:15 2015 29042  node           11   2 ms
Sat Jan 31 05:31:15 2015 29042  node           11   1 ms
Sat Jan 31 05:31:15 2015 29042  node           11   1 ms
Sat Jan 31 05:31:15 2015 29042  node           11   1 ms
Sat Jan 31 05:31:15 2015 29042  node           11   1 ms
[...]
Duration (ns):
   value |-------------------------------------------------- count
  131072 |                                                     0
  262144 |                                                     0
  524288 |                                                     1
 1048576 |@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@     138
 2097152 |@@                                                   6
 4194304 |                                                     1
 8388608 |                                                     0
16777216 |                                                     0

Most of these sessions were between 1 and 2 milliseconds in lifespan.

The socket lifespan is expected to represent the time taken by a server to
respond to a request. This time may include cycles on-CPU, and cycles off-CPU
blocked on another resource. Note that HTTP keep-alive sessions may have long
durations which process multiple requests.

accept2close-nd.stp accepts an optional argument: a minimum lifespan threshold
in milliseconds. For example, socket sessions that are 5 milliseconds and
longer:

# ./accept2close-nd.stp 5
Only tracing events slower than 5 ms.
TIME                     PID    COMM           FD   DURATION
Sat Jan 31 05:36:23 2015 5236   node           11   5 ms
Sat Jan 31 05:37:39 2015 5236   node           11   5 ms
Sat Jan 31 05:37:50 2015 5236   node           11   9 ms
Sat Jan 31 05:38:09 2015 5236   node           11   7 ms
^C
Duration (ns):
   value |-------------------------------------------------- count
 1048576 |                                                   0
 2097152 |                                                   0
 4194304 |@@@                                                3
 8388608 |@                                                  1
16777216 |                                                   0
33554432 |                                                   0

cmd: