SystemTap
什么是system Tap ?
SystemTap 提供环境用来获得更多关于内核几乎所有组件的信息，用以被进一步分析。SystemTap也可以被当作一种工具，为用户研究和监控内核详情提供便利。
运行system tap需要些什么 ?
- 需要如下组件包 :
- kernel-debuginfo
- kernel-debuginfo-common
- kernel-devel
- systemtap-runtime
- gcc
如何运行 SystemTap ?
SystemTap脚本通过stap命令运行。stap 可以从标准输入或文件运行 SystemTap。
要运行systemstap，用户需要root权限。要让没有root访问权限的用户运行 SystemTap，需要把他们添加到如下的用户组之一 : "stapdev" , "stapusr"
SystemTap 如何工作 ?
它以如下方式工作:
- 首先，SystemTap检查已有公用tapset库对应的脚本。 然后，SystemTap将添加所有本地tapsets.
- SystemTap将把脚本翻译成C，再通过系统的C编译器来生成内核模块。
- SystemTap 加载该模块，并使能脚本中所有的probes(包括events 和 handlers) 。
- 当这些 events 发生时，对应的 handlers被执行。
- 一旦 systemTap 会话终止，probes被关闭 ，同时该内核模块被卸载。
总的来讲，当我们运行systemtap时， systemtap 通过脚本构建一个内核模块，并将其加载到内核，之后，内核允许它直接从内核抽取数据。
获取更多信息请参考 : http://sourceware.org/systemtap/langref/SystemTap_overview.html
SystemTap
What is system Tap ?
SystemTap provides environment to get more information on almost any component within the kernel so that it may be further analysed. OR SystemTap is tool which provides facility to user to study and monitor the activities of the kernel in detail.
What we need to run system tap ?
- Need below group of packages to run system tap in system :
- kernel-debuginfo
- kernel-debuginfo-common
- kernel-devel
- systemtap-runtime
- gcc
How to run SystemTap ?
SystemTap scripts are run through the command stap. stap can run SystemTap scripts from standard input or from file.
To run systemstap user need root privileges, not all users can run systemstap. To allow secondary users to run SystemTap without root access need to add them toone of these user groups : "stapdev" , "stapusr"
How SystemTap works ?
It runs in following fashion :
- First, SystemTap checks the script against the existing tapset library for any tapsets used. SystemTap will then add any located tapsets with their corresponding definitions in the tapset library.
- SystemTap then translates the script to C, running the system C compiler to create a kernel module from it.
- SystemTap loads the module, then enables all the probes(events and handlers) in the script.
- As the events occur, their corresponding handlers are executed.
- Once the systemTap session is terminated, the probes are disabled, and the kernel module is unloaded.
In short, When we run systemtap, systemtap builds a kernel module out of that script and then loads the module into the kernel. Once this done kerenl allow it to extract specified data directly from kernel.
To get more information on system tap refer below link : http://sourceware.org/systemtap/langref/SystemTap_overview.html
https://kernelnewbies.org/SystemTap