Questions tagged [tracing]

The tag has no usage guidance.

Filter by
Sorted by
Tagged with
0 votes
0 answers
16 views

How to trace DMA transactions by using dma_debug?

I am currently working on some PCI-e device stuff, that requires me to get the trace for DMA transactions on a specific (say GPU or NIC ) PCI card. After doing some research I found a useful post by ...
4spr1n's user avatar
  • 1
0 votes
1 answer
2k views

How to clear the /sys/kernel/debug/tracing/trace_pipe quickly?

I am using the bpf_printk() helper to print to the kernel debug to trace some BPF programs. The usage is as follows: #include <stdio.h> #include <linux/bpf.h> #include <sys/socket.h>...
diviquery's user avatar
  • 115
1 vote
1 answer
252 views

Log all commands executed regardless of shell?

Suppose a user runs the following command: zcat file.gz | grep something | gzip > grepped.gz I'm looking for a kernel feature (a BPF filter perhaps?) that would note all of the execves, chain ...
d33tah's user avatar
  • 1,361
0 votes
1 answer
435 views

Systemtap probe kernel module function while that module is loaded

How to use a Systemtap probe on a kernel module function while that module is loaded. I am trying to print the functions being called for a particular module while it is being loaded. Suppose I have a ...
Franc's user avatar
  • 279
0 votes
1 answer
116 views

How to view quickly spawned/killed processes on a Fedora Linux machine?

On Windows, there is a program available for download which is part of what's called the sysinternals suite of tools. This program is called Process Explorer 64 aka ProcExp64. The program is useful ...
the_endian's user avatar
2 votes
1 answer
40 views

How to convert an int to a string in DTrace?

I'd like to be able to concatenate a string and an int using strjoin(), e.g., strjoin("ada", args[1]->unit_number); but in order to do that I have to make sure that the int is first ...
Mateusz Piotrowski's user avatar
1 vote
0 answers
191 views

Is it possible to trace/record every file IO being done by one or all applications, both through syscalls and mmap?

I want to trace every IO operation an application does in its lifetime and don't want any caching effect to interfere. I cannot change the application source code, using a shim would be OK. ...
hfingler's user avatar
  • 251
0 votes
2 answers
19 views

extract application name from rawpacket

Sounds dumb, but can you extract application name from a packet/pcap. For eg: If a packet destination is to chrome process, can you extract that information from packet?
Fight Daily's user avatar
2 votes
1 answer
205 views

How can I profile virtual memory accesses made in user mode and kernel mode?

I would like to generate a log of all virtual memory accesses performed in user mode and kernel mode as a result of running some program. Besides collecting memory access locations, I also want to ...
bryantcurto's user avatar
5 votes
1 answer
2k views

How to trace DMA?

I am working on software that communicates with a PCI card through direct memory access (DMA) transactions. My programs use a suit of drivers and a library that handles the DMA. Everything runs on a ...
xealits's user avatar
  • 2,143
0 votes
1 answer
272 views

Suspicious pgrep run as root user on debian bullseye

I experience quite a bit of fan activity on my laptop, even the machine should be idle. When I take a look at my processes with top I have a pgrep process appear once in a while, taking some CPU. It ...
nath's user avatar
  • 5,620
2 votes
1 answer
135 views

Multiple Tracing Events Readers

Question Does the tracing pipes in Linux, for tracing events, accepts simultaneous readers? Context I am trying to get traces from the RAS subsystem while running some benchmarks. This subsystem ...
Alexandre Santana's user avatar
3 votes
0 answers
129 views

What is causing this 3s delay in gvim startup?

The gvim program is stuck for 3 seconds before opening any file. This issue is isolated to gvim, vim opens just fine. Therefore, the cause must be somewhere in X or some related service and not vim. ...
Ярослав Рахматуллин's user avatar
0 votes
2 answers
876 views

zsh: Is it possible to trace all functions and commands called and aliases expanded during a command’s execution?

I want something like this: # source: a() b mp3 m4a "$@" b() eval "${1}-to-${2} $@:q" alias mp3-to-m4a='ffmpeg ...' # $ traceall a a.mp3 a.m4a # should return: Functions: a b Aliases: mp3-to-...
HappyFace's user avatar
  • 1,593
7 votes
3 answers
10k views

How to debug/trace bash function?

I have a bash script myscript.sh, which has a bunch of functions inside. To run one function, I would write source myscript.sh; myfunction How debug such a function?
Dims's user avatar
  • 3,255
2 votes
0 answers
57 views

Record filesystem activity

I would like to record all filesystem activity so that I can later replay it at will (for benchmarking purposes). What's the best way of doing that? I considered strace, but rejected that because it ...
Nikratio's user avatar
  • 121
0 votes
1 answer
834 views

Why cannot I enable tracing?

According to the README file in /sys/kernel/debug/tracing/README, doing echo 1 > tracing_on should be a quick way to enable tracing. No matter how many times I execute this (as root), the value in ...
oligofren's user avatar
  • 1,150
2 votes
2 answers
1k views

What is this `gmain` process with these unknown PIDs in my trace file?

Reading up on an answer to find out which process registered inotify watchers, I executed the following commands echo 1 | sudo tee /sys/kernel/debug/tracing/events/syscalls/...
oligofren's user avatar
  • 1,150
1 vote
0 answers
120 views

Determine average and maximum execution time of a task by using ftrace/perf

I've gathered some traces containing scheduling events ('sched:*') by using ftrace and perf record. By analyzing the results many of my questions could already be answered. However, I was wondering ...
Iniesta8's user avatar
  • 121
5 votes
3 answers
1k views

Define bash function which does not show up in xtrace (set -x)

In a bash script I have a log() function that is used in several places, as well as a logs() function that diverts lots of line to log(). When I run parts of the script with set -x, obviously all ...
Harald's user avatar
  • 888
2 votes
1 answer
471 views

Is there a command to show tracepoints "live", which includes the PID?

I have tried looking at the documentation for perf script, perf trace, and trace-cmd, including the list of commands in "SEE ALSO". I can trace e.g. sched:sched_process_exec "live" using perf trace -...
sourcejedi's user avatar
  • 49.9k
2 votes
1 answer
235 views

How can I diagnose a process which has no executable file name associated with it?

There is a process taking up 100% CPU on a KVM based server I am running. This is the output of htop. PID USER PRI NI VIRT RES SHR S CPU% MEM% TIME+ Command 22230 ...
vfclists's user avatar
  • 7,485
2 votes
0 answers
513 views

Tool for displaying timeline view of kernel/userspace execution trace

I've used the ftrace tool trace-cmd for recording scheduling tracepoints and syscall tracepoints. I can inspect them visually using the kernelshark GUI program. It dislays per-core timelines and per-...
Daniel Näslund's user avatar
3 votes
1 answer
413 views

Can getauxval be used to determine whether or not you're being traced?

Coming off of this question, I patched my kernel in a quest to get SQL Server 2017 on Linux to start up. Now I'm getting further but I'm being shut down, strstr("TracerPid:\t0\n", "TracerPid:") ...
Evan Carroll's user avatar
  • 30.4k
1 vote
1 answer
71 views

Modifying standard DTT scripts to use -c instead of $1

There are lots of great dtrace programs out there and some of them require a PID to be passed to them, in order for them to trace that PID. Inside the dtrace scripts that argument is stored in $1. Is ...
Junaid Shahid's user avatar
1 vote
1 answer
340 views

Ftrace time duration

I echoed 1 to tracing_on in /sys/kernel/debug/tracing directory and echoed 0 again after a second. However, the timestamp of the first entry is 216.852 and that of the last entry is 234.136 giving me ...
Vishal Khopkar's user avatar
7 votes
1 answer
1k views

How to capture the xtrace output (only) in a file?

I know that I can redirect the xtrace output to some_file with something like this: exec 2 >> some_file set +x ...but this sends to some_file not only the xtrace output, but also any other ...
kjo's user avatar
  • 15.3k
1 vote
0 answers
412 views

Trace apache server activity for a specific http request

I have a cracker serving fake content to google bot from my Drupal site. They are able to generally bypass my CMS system but bootstrap it just enough catch http request and return a "cloned" page with ...
Greg Stout's user avatar
2 votes
1 answer
75 views

How to measure changes to the filesystem done by a certain application? [closed]

I am using a command line application which creates a great amount of intermediate artifacts to the file system and then at some point deletes them. On environments where storage space is constrained ...
carlossless's user avatar
8 votes
1 answer
5k views

filter out certain processes and/or pids in ftrace?

I'm not sure if I'm thinking about this the right way (and please correct me if I'm wrong), but the following is my understanding of ftrace. In /sys/kernel/debug/tracing, there are the following ...
LeapDayWilliam's user avatar
0 votes
1 answer
74 views

Uprobes Status on the present linux kernel

I know uprobes was introduced on kernel 3.5 has it survived or is it dropped, is it still available on kernel 4.x
SAS's user avatar
  • 31
1 vote
1 answer
2k views

configure: error: LDFLAGS

I am trying to install LTTng. I was installing lttng-tools-2.6.0 and got the following error: configure: error: Cannot find libuuid uuid_generate nor libc uuid_create. Use LDFLAGS=-Ldir to specify ...
SAS's user avatar
  • 31
2 votes
1 answer
292 views

Function tracing per thread

I have a complex multi threaded application running on a Cent OS 5.8 the application is coded using C and C++ I am searching for a FUNCTION TRACING tool which can help me do the following. Trace all ...
SAS's user avatar
  • 31
2 votes
0 answers
217 views

How to reliably and transparently trace process execution

During compilation of most (if not all) software packages, the output on stdout and stderr is created by multiple individual processes and the files that are processed/changed/created in the course of ...
josch's user avatar
  • 355
1 vote
2 answers
377 views

`nl` invocation soaking all input before numbering

How can this be done? I don't see any applicable option in the manual. I have positively checked that indentation breaks after ten million lines. You can check it like: $ (for i in `seq 0 10000000`...
41754's user avatar
  • 95