用户态进程探针

  1. # 
  2. probe process("/lib64/libc.so.6").function("*memcpy*") { /* scripts */ }
  4. #
  5. probe process(28888).function("*open*") { /* scripts */ }
  7. #
  8. probe process("/home/postgres/postgresql-12.1/bin/postgres").function("*memcpy*") {
  9.     /* scripts */
  10. }
  12. #
  13. probe process("postgres").statement("GetNewTransactionId@varsup.c:76") {
  14.     /* scripts */
  15. }

系统调用探针

  1. #
  2. probe.syscall.*
  4. #
  5. probe syscall.write
  7. #
  8. probe syscall.write.return

内核函数探针

  1. # function()和function.call是等价的
  2. probe kernel.function("SyS_execve@fs/exec.c:1764").call
  4. probe kernel.function("SyS_execve@fs/exec.c:1764").return
  6. # 语句
  7. probe kernel.statement("generic_make_request@block/blk-core.c:*")
  9. # 所以内核函数加探针,慎用
  10. probe kernel.function("*").call

systemtap内置探针

  1. probe ioblock.*
  2. probe ioscheduler.*
  3. probe ioscheduler_trace.*
  5. # 进入cpu时间片
  6. probe scheduler.cpu_on
  8. # 从cpu时间片切出
  9. probe scheduler.cpu_off