FM / lwtools

/usr/share/systemtap/examples/lwtools

Name	Size	Mode	Actions
accept2close-nd.8	1424	0644	edit dl rm
accept2close-nd.meta	597	0644	edit dl rm
accept2close-nd.stp	1798	0755	edit dl rm
accept2close-nd.txt	3385	0644	edit dl rm
biolatency-nd.8	1671	0644	edit dl rm
biolatency-nd.meta	622	0644	edit dl rm
biolatency-nd.stp	2071	0755	edit dl rm
biolatency-nd_example.txt	7362	0644	edit dl rm
bitesize-nd.8	1157	0644	edit dl rm
bitesize-nd.meta	491	0644	edit dl rm
bitesize-nd.stp	1543	0755	edit dl rm
bitesize-nd_example.txt	3426	0644	edit dl rm
execsnoop-nd.8	1235	0644	edit dl rm
execsnoop-nd.meta	570	0644	edit dl rm
execsnoop-nd.stp	1283	0755	edit dl rm
execsnoop-nd_example.txt	2585	0644	edit dl rm
fslatency-nd.8	1930	0644	edit dl rm
fslatency-nd.meta	660	0644	edit dl rm
fslatency-nd.stp	3982	0755	edit dl rm
fslatency-nd_example.txt	13384	0644	edit dl rm
fsslower-nd.8	1753	0644	edit dl rm
fsslower-nd.meta	623	0644	edit dl rm
fsslower-nd.stp	3715	0755	edit dl rm
fsslower-nd_example.txt	1938	0644	edit dl rm
killsnoop-nd.8	1131	0644	edit dl rm
killsnoop-nd.meta	384	0644	edit dl rm
killsnoop-nd.stp	1281	0755	edit dl rm
killsnoop-nd_example.txt	1908	0644	edit dl rm
opensnoop-nd.8	1268	0644	edit dl rm
opensnoop-nd.meta	357	0644	edit dl rm
opensnoop-nd.stp	1026	0755	edit dl rm
opensnoop-nd_example.txt	1124	0644	edit dl rm
README	107	0644	edit dl rm
rwtime-nd.8	1146	0644	edit dl rm
rwtime-nd.meta	412	0644	edit dl rm
rwtime-nd.stp	1599	0755	edit dl rm
rwtime-nd_example.txt	4185	0644	edit dl rm
syscallbypid-nd.8	1089	0644	edit dl rm
syscallbypid-nd.meta	404	0644	edit dl rm
syscallbypid-nd.stp	1100	0755	edit dl rm
syscallbypid-nd_example.txt	9322	0644	edit dl rm

Edit: /usr/share/systemtap/examples/lwtools/fslatency-nd.stp (3982B)

#!/usr/bin/stap
/*
 * fslatency-nd.stp	Measure file system I/O latency distribution.
 *			For Linux, uses SystemTap (non-debuginfo).
 *
 * USAGE: ./fslatency-nd.stp [interval [count]]
 *
 * This script uses kernel dynamic tracing of two common file system functions:
 * do_sync_read() and do_sync_write(). This provides a view of just two file
 * system request types. There are typically many others: asynchronous I/O,
 * directory operations, file handle operations, etc, that this script does
 * not instrument.
 *
 * This current implementation also traces sock_aio_write(), to exclude that
 * write time from the report.
 *
 * From systemtap-lwtools: https://github.com/brendangregg/systemtap-lwtools
 *
 * See the corresponding man page (in systemtap-lwtools) for more info.
 *
 * Copyright (C) 2015 Brendan Gregg.
 * Copyright (C) 2015 Red Hat, Inc.
 *
 * This program is free software; you can redistribute it and/or modify
 * it under the terms of the GNU General Public License as published by
 * the Free Software Foundation; either version 2 of the License, or
 * (at your option) any later version.
 *
 * This program is distributed in the hope that it will be useful,
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 * GNU General Public License for more details.
 *
 * 06-Feb-2015	Brendan Gregg	Created this.
 */

global ts[65536];	# 65536 is max concurrent I/O
global lat, interval = 0, secs = 0, count = 0, output = 0;

probe begin
{
	printf("Tracing FS sync reads and writes... ");
	if (argv_1 != "") {
		interval = strtol(argv_1, 10);
		if (argv_2 != "") {
			count = strtol(argv_2, 10);
		}
		printf("Output every %d secs.\n", interval);
	} else {
		printf("Hit Ctrl-C to end.\n");
	}
}

probe read_funcs, write_funcs
{
	ts[tid()] = gettimeofday_ns();
}

probe read_funcs = kprobe.function("do_sync_read") !, __vfs_read
{
}
probe __vfs_read = kprobe.function("__vfs_read")
{
	# Skip the call if new_sync_read() wouldn't be called.
	file = pointer_arg(1)
	if (!file || @cast(file, "file", "kernel")->f_op->read
	    || !@cast(file, "file", "kernel")->f_op->read_iter)
		next
}

probe write_funcs = kprobe.function("do_sync_write") !, __vfs_write
{
}
probe __vfs_write = kprobe.function("__vfs_write")
{
	# Skip the call if new_sync_write() wouldn't be called.
	file = pointer_arg(1)
	if (!file || @cast(file, "file", "kernel")->f_op->write
	    || !@cast(file, "file", "kernel")->f_op->write_iter)
		next
}

probe kprobe.function("sock_write_iter") !, kprobe.function("sock_aio_write")
{
	/* not a file system write */
	ts[tid()] = 0;
}

probe read_funcs.return, write_funcs.return
{
	if (ts[tid()]) {
		lat[ppfunc()] <<< gettimeofday_ns() - ts[tid()];
		delete ts[tid()];
	}
}

probe read_funcs.return = kprobe.function("do_sync_read").return !,
			  __vfs_read.return
{
}
probe __vfs_read.return = kprobe.function("__vfs_read").return
{
	# Skip the call if new_sync_read() wouldn't be called.
	file = @entry(pointer_arg(1))
	if (!file || @cast(file, "file", "kernel")->f_op->read
	    || !@cast(file, "file", "kernel")->f_op->read_iter)
		next
}

probe write_funcs.return = kprobe.function("do_sync_write").return !,
			   __vfs_write.return
{
}
probe __vfs_write.return = kprobe.function("__vfs_write")
{
	# Skip the call if new_sync_write() wouldn't be called.
	file = pointer_arg(1)
	if (!file || @cast(file, "file", "kernel")->f_op->write
	    || !@cast(file, "file", "kernel")->f_op->write_iter)
		next
}

probe timer.s(1)
{
	if (interval) {
		if (++secs == interval) {
			print_report();
			secs = 0;
			count && (++output == count) && exit();
		}
	}
}

probe end
{
	!interval && print_report();
	delete secs;
	delete output;
}

cmd: