ktap
A New Scripting Dynamic Tracing Tool For Linux
www.ktap.org
ktap is a new scripting dynamic tracing tool for Linux, it uses a scripting language and lets users trace the Linux kernel dynamically. ktap is designed to give operational insights with interoperability that allows users to tune, troubleshoot and extend kernel and application. It's similar with Linux Systemtap and Solaris Dtrace.
ktap have different design principles from Linux mainstream dynamic tracing language in that it's based on bytecode, so it doesn't depend upon GCC, doesn't require compiling kernel module for each script, safe to use in production environment, fulfilling the embedded ecosystem's tracing needs.
More information can be found at ktap homepage.
Highlights
- simple but powerful scripting language
- register based interpreter (heavily optimized) in Linux kernel
- small and lightweight (6KLOC of interpreter)
- not depend on gcc for each script running
- easy to use in embedded environment without debugging info
- support for tracepoint, kprobe, uprobe, function trace, timer, and more
- supported in x86, arm, ppc, mips
- safety in sandbox
Building & Running
-
Clone ktap from github
$ git clone http://github.com/ktap/ktap.git
-
Compiling ktap
$ cd ktap $ make #generate ktapvm kernel module and ktap binary
-
Load ktapvm kernel module(make sure debugfs mounted)
$ make load #need to be root or have sudo access
-
Running ktap
$ ./ktap scripts/helloworld.kp
Examples
-
simplest one-liner command to enable all tracepoints
ktap -e "trace *:* { print(argevent) }"
-
syscall tracing on target process
ktap -e "trace syscalls:* { print(argevent) }" -- ls
-
function tracing
ktap -e "trace ftrace:function { print(argevent) }" ktap -e "trace ftrace:function /ip==mutex*/ { print(argevent) }"
-
simple syscall tracing
trace syscalls:* { print(cpu(), pid(), execname(), argevent) }
-
syscall tracing in histogram style
s = {} trace syscalls:sys_enter_* { s[argname] += 1 } trace_end { histogram(s) }
-
kprobe tracing
trace probe:do_sys_open dfd=%di fname=%dx flags=%cx mode=+4($stack) { print("entry:", execname(), argevent) } trace probe:do_sys_open%return fd=$retval { print("exit:", execname(), argevent) }
-
uprobe tracing
trace probe:/lib/libc.so.6:malloc { print("entry:", execname(), argevent) } trace probe:/lib/libc.so.6:malloc%return { print("exit:", execname(), argevent) }
-
stapsdt tracing (userspace static marker)
trace sdt:/lib64/libc.so.6:lll_futex_wake { print("lll_futex_wake", execname(), argevent) } or: #trace all static mark in libc trace sdt:/lib64/libc.so.6:* { print(execname(), argevent) }
-
timer
tick-1ms { printf("time fired on one cpu\n"); } profile-2s { printf("time fired on every cpu\n"); }
More sample scripts can be found at scripts/ directory.
Mailing list
[email protected]
You can subscribe to ktap mailing list at link (subscribe before posting):
http://www.freelists.org/list/ktap
Copyright and License
ktap is licensed under GPL v2
Copyright (C) 2012-2013, Jovi Zhangwei [email protected]. All rights reserved.
Contribution
ktap is still under active development, so contributions are welcome. You are encouraged to report bugs, provide feedback, send feature request, or hack on it.
See More
More info can be found at [documentation][tutorial] [tutorial]: http://www.ktap.org/doc/tutorial.html