On Wed, 23 Jul 2025 12:52:32 -0400 Steven Rostedt <[email protected]> wrote:
> On Wed, 23 Jul 2025 12:42:02 -0400 > Steven Rostedt <[email protected]> wrote: > > > [ > > Create an eprobe called "sys" and attach it to sys_enter. > > Read the id of the system call and the second argument > > ] > > # echo 'e:sys raw_syscalls.sys_enter nr=$id:u32 arg2+8($args):u64' >> > > /sys/kernel/tracing/dynamic_events > > The above has a typo. I originally had it as "filename=+8($args):u64" > but decided to change it to "arg2" as its attached to the generic raw > syscall. But in the process, I accidentally deleted the "=". So the > above should be: > > # echo 'e:sys raw_syscalls.sys_enter nr=$id:u32 arg2=+8($args):u64' >> > /sys/kernel/tracing/dynamic_events Yeah, it should be :) > > > > > > [ > > Create a synthetic event "path" that will hold the address of the > > sys_openat filename. This is on a 64bit machine, so make it 64 bits > > ] > > # echo 's:path u64 file;' >> /sys/kernel/tracing/dynamic_events > > > > [ > > Add a histogram to the eprobe/sys which tiggers if the "nr" field is > > 257 (sys_openat), and save the filename in the "file" variable. > > ] > > # echo 'hist:keys=common_pid:file=filename if nr == 257' > > > /sys/kernel/tracing/events/eprobes/sys/trigger > > And I forgot to update this, as it's not "filename" any more, but > "arg2". So this needs to be: > > # echo 'hist:keys=common_pid:file=arg2 if nr == 257' > > /sys/kernel/tracing/events/eprobes/sys/trigger OK, let me fix when I pick this. The code looks good to me. Thanks! > > -- Steve -- Masami Hiramatsu (Google) <[email protected]>
