Questions tagged [tracing]
The tracing tag has no usage guidance.
36
questions
8
votes
1
answer
1k
views
Does mtrace() still work in modern distros?
tldr: Does mtrace still work or am I just doing it wrong?
I was attempting to use mtrace and have been unable to get it to write data to a file. I followed the instructions in man 3 mtrace:
t_mtrace.c:...
- 255
1
vote
0
answers
64
views
How to trace DMA transactions by using dma_debug?
I am currently working on some PCI-e device stuff, that requires me to get the trace for DMA transactions on a specific (say GPU or NIC ) PCI card. After doing some research I found a useful post by ...
- 11
0
votes
1
answer
3k
views
How to clear the /sys/kernel/debug/tracing/trace_pipe quickly?
I am using the bpf_printk() helper to print to the kernel debug to trace some BPF programs. The usage is as follows:
#include <stdio.h>
#include <linux/bpf.h>
#include <sys/socket.h>...
- 115
1
vote
1
answer
549
views
Log all commands executed regardless of shell?
Suppose a user runs the following command:
zcat file.gz | grep something | gzip > grepped.gz
I'm looking for a kernel feature (a BPF filter perhaps?) that would note all of the execves, chain ...
- 1,361
0
votes
1
answer
522
views
Systemtap probe kernel module function while that module is loaded
How to use a Systemtap probe on a kernel module function while that module is loaded. I am trying to print the functions being called for a particular module while it is being loaded. Suppose I have a ...
- 299
0
votes
1
answer
142
views
How to view quickly spawned/killed processes on a Fedora Linux machine?
On Windows, there is a program available for download which is part of what's called the sysinternals suite of tools. This program is called Process Explorer 64 aka ProcExp64. The program is useful ...
- 414
2
votes
1
answer
47
views
How to convert an int to a string in DTrace?
I'd like to be able to concatenate a string and an int using strjoin(), e.g.,
strjoin("ada", args[1]->unit_number);
but in order to do that I have to make sure that the int is first ...
- 4,853
1
vote
0
answers
341
views
Is it possible to trace/record every file IO being done by one or all applications, both through syscalls and mmap?
I want to trace every IO operation an application does in its lifetime and don't want any caching effect to interfere. I cannot change the application source code, using a shim would be OK. ...
- 251
0
votes
2
answers
20
views
extract application name from rawpacket
Sounds dumb, but can you extract application name from a packet/pcap.
For eg: If a packet destination is to chrome process, can you extract that information from packet?
2
votes
1
answer
236
views
How can I profile virtual memory accesses made in user mode and kernel mode?
I would like to generate a log of all virtual memory accesses performed in user mode and kernel mode as a result of running some program.
Besides collecting memory access locations, I also want to ...
- 21
6
votes
1
answer
2k
views
How to trace DMA?
I am working on software that communicates with a PCI card through direct memory access (DMA) transactions. My programs use a suit of drivers and a library that handles the DMA. Everything runs on a ...
- 2,183
0
votes
1
answer
296
views
Suspicious pgrep run as root user on debian bullseye
I experience quite a bit of fan activity on my laptop, even the machine should be idle. When I take a look at my processes with top I have a pgrep process appear once in a while, taking some CPU. It ...
- 5,894
2
votes
1
answer
161
views
Multiple Tracing Events Readers
Question
Does the tracing pipes in Linux, for tracing events, accepts simultaneous readers?
Context
I am trying to get traces from the RAS subsystem while running some benchmarks.
This subsystem ...
3
votes
0
answers
134
views
What is causing this 3s delay in gvim startup?
The gvim program is stuck for 3 seconds before opening any file. This issue is isolated to gvim, vim opens just fine. Therefore, the cause must be somewhere in X or some related service and not vim.
...
- 1,364
0
votes
2
answers
970
views
zsh: Is it possible to trace all functions and commands called and aliases expanded during a command’s execution?
I want something like this:
# source:
a() b mp3 m4a "$@"
b() eval "${1}-to-${2} $@:q"
alias mp3-to-m4a='ffmpeg ...'
#
$ traceall a a.mp3 a.m4a
# should return:
Functions:
a
b
Aliases:
mp3-to-...
- 1,640
7
votes
3
answers
11k
views
How to debug/trace bash function?
I have a bash script myscript.sh, which has a bunch of functions inside. To run one function, I would write
source myscript.sh; myfunction
How debug such a function?
- 3,305
2
votes
0
answers
57
views
Record filesystem activity
I would like to record all filesystem activity so that I can later replay it at will (for benchmarking purposes). What's the best way of doing that?
I considered strace, but rejected that because it ...
- 121
0
votes
1
answer
997
views
Why cannot I enable tracing?
According to the README file in /sys/kernel/debug/tracing/README, doing echo 1 > tracing_on should be a quick way to enable tracing. No matter how many times I execute this (as root), the value in ...
- 1,180
2
votes
2
answers
1k
views
What is this `gmain` process with these unknown PIDs in my trace file?
Reading up on an answer to find out which process registered inotify watchers, I executed the following commands
echo 1 | sudo tee /sys/kernel/debug/tracing/events/syscalls/...
- 1,180
1
vote
0
answers
131
views
Determine average and maximum execution time of a task by using ftrace/perf
I've gathered some traces containing scheduling events ('sched:*') by using ftrace and perf record. By analyzing the results many of my questions could already be answered.
However, I was wondering ...
- 121
5
votes
3
answers
1k
views
Define bash function which does not show up in xtrace (set -x)
In a bash script I have a log() function that is used in several places, as well as a logs() function that diverts lots of line to log(). When I run parts of the script with set -x, obviously all ...
- 958
2
votes
1
answer
504
views
Is there a command to show tracepoints "live", which includes the PID?
I have tried looking at the documentation for perf script, perf trace, and trace-cmd, including the list of commands in "SEE ALSO".
I can trace e.g. sched:sched_process_exec "live" using perf trace -...
- 51.4k
2
votes
1
answer
243
views
How can I diagnose a process which has no executable file name associated with it?
There is a process taking up 100% CPU on a KVM based server I am running.
This is the output of htop.
PID USER PRI NI VIRT RES SHR S CPU% MEM% TIME+ Command
22230 ...
- 7,629
2
votes
0
answers
598
views
Tool for displaying timeline view of kernel/userspace execution trace
I've used the ftrace tool trace-cmd for recording scheduling tracepoints and syscall tracepoints. I can inspect them visually using the kernelshark GUI program. It dislays per-core timelines and per-...
- 1,872
3
votes
1
answer
446
views
Can getauxval be used to determine whether or not you're being traced?
Coming off of this question, I patched my kernel in a quest to get SQL Server 2017 on Linux to start up. Now I'm getting further but I'm being shut down,
strstr("TracerPid:\t0\n", "TracerPid:") ...
- 32.4k
1
vote
1
answer
71
views
Modifying standard DTT scripts to use -c instead of $1
There are lots of great dtrace programs out there and some of them require a PID to be passed to them, in order for them to trace that PID. Inside the dtrace scripts that argument is stored in $1. Is ...
1
vote
1
answer
372
views
Ftrace time duration
I echoed 1 to tracing_on in /sys/kernel/debug/tracing directory and echoed 0 again after a second. However, the timestamp of the first entry is 216.852 and that of the last entry is 234.136 giving me ...
7
votes
1
answer
1k
views
How to capture the xtrace output (only) in a file?
I know that I can redirect the xtrace output to some_file with something like this:
exec 2 >> some_file
set +x
...but this sends to some_file not only the xtrace output, but also any other ...
- 15.8k
1
vote
0
answers
422
views
Trace apache server activity for a specific http request
I have a cracker serving fake content to google bot from my Drupal site. They are able to generally bypass my CMS system but bootstrap it just enough catch http request and return a "cloned" page with ...
- 11
2
votes
1
answer
75
views
How to measure changes to the filesystem done by a certain application? [closed]
I am using a command line application which creates a great amount of intermediate artifacts to the file system and then at some point deletes them.
On environments where storage space is constrained ...
- 243
8
votes
1
answer
5k
views
filter out certain processes and/or pids in ftrace?
I'm not sure if I'm thinking about this the right way (and please correct me if I'm wrong), but the following is my understanding of ftrace.
In /sys/kernel/debug/tracing, there are the following ...
- 141
0
votes
1
answer
78
views
Uprobes Status on the present linux kernel
I know uprobes was introduced on kernel 3.5 has it survived or is it dropped, is it still available on kernel 4.x
- 31
1
vote
1
answer
2k
views
configure: error: LDFLAGS
I am trying to install LTTng.
I was installing lttng-tools-2.6.0 and got the following error:
configure: error: Cannot find libuuid uuid_generate nor libc uuid_create. Use LDFLAGS=-Ldir to specify ...
- 31
2
votes
1
answer
301
views
Function tracing per thread
I have a complex multi threaded application running on a Cent OS 5.8
the application is coded using C and C++
I am searching for a FUNCTION TRACING tool which can help me do the following.
Trace all ...
- 31
2
votes
0
answers
219
views
How to reliably and transparently trace process execution
During compilation of most (if not all) software packages, the output on stdout and stderr is created by multiple individual processes and the files that are processed/changed/created in the course of ...
- 365
1
vote
2
answers
382
views
`nl` invocation soaking all input before numbering
How can this be done?
I don't see any applicable option in the manual.
I have positively checked that indentation breaks after ten million lines.
You can check it like:
$ (for i in `seq 0 10000000`...
- 95