RHE Linux User Manual

Daftar Isi ☛

(Sebelumnya) 22 : Chapter 4. Timestamp Func ...

22 : Chapter 14. Signal Tapset ... (Berikutnya)

SystemTap Tapset Reference

Chapter 11. Networking Tapset

probe::netdev.receive - Data received from network device.
probe::netdev.transmit - Network device transmitting buffer
probe::netdev.change_mtu - Called when the netdev MTU is changed
probe::netdev.open - Called when the device is opened
probe::netdev.close - Called when the device is closed
probe::netdev.hard_transmit - Called when the devices is going to TX (hard)
probe::netdev.rx - Called when the device is going to receive a packet
probe::netdev.change_rx_flag - Called when the device RX flag will be changed
probe::netdev.set_promiscuity - Called when the device enters/leaves promiscuity
probe::netdev.ioctl - Called when the device suffers an IOCTL
probe::netdev.register - Called when the device is registered
probe::netdev.unregister - Called when the device is being unregistered
probe::netdev.get_stats - Called when someone asks the device statistics
probe::netdev.change_mac - Called when the netdev_name has the MAC changed
probe::tcp.sendmsg - Sending a tcp message
probe::tcp.sendmsg.return - Sending TCP message is done
probe::tcp.recvmsg - Receiving TCP message
probe::tcp.recvmsg.return - Receiving TCP message complete
probe::tcp.disconnect - TCP socket disconnection
probe::tcp.disconnect.return - TCP socket disconnection complete
probe::tcp.setsockopt - Call to setsockopt
probe::tcp.setsockopt.return - Return from setsockopt
probe::tcp.receive - Called when a TCP packet is received
probe::udp.sendmsg - Fires whenever a process sends a UDP message
probe::udp.sendmsg.return - Fires whenever an attempt to send a UDP message is completed
probe::udp.recvmsg - Fires whenever a UDP message is received
probe::udp.recvmsg.return - Fires whenever an attempt to receive a UDP message received is completed
probe::udp.disconnect - Fires when a process requests for a UDP disconnection
probe::udp.disconnect.return - UDP has been disconnected successfully
function::ip_ntop - returns a string representation from an integer IP number

This family of probe points is used to probe the activities of the network device and protocol layers.

Name

probe::netdev.receive - Data received from network device.

Synopsis

netdev.receive

Values

protocol: Protocol of received packet.
dev_name: The name of the device. e.g: eth0, ath1.
length: The length of the receiving buffer.

Name

probe::netdev.transmit - Network device transmitting buffer

Synopsis

netdev.transmit

Values

protocol: The protocol of this packet(defined in include/linux/if_ether.h).
dev_name: The name of the device. e.g: eth0, ath1.
length: The length of the transmit buffer.
truesize: The size of the data to be transmitted.

Name

probe::netdev.change_mtu - Called when the netdev MTU is changed

Synopsis

netdev.change_mtu

Values

dev_name: The device that will have the MTU changed
new_mtu: The new MTU
old_mtu: The current MTU

Name

probe::netdev.open - Called when the device is opened

Synopsis

netdev.open

Values

dev_name: The device that is going to be opened

Name

probe::netdev.close - Called when the device is closed

Synopsis

netdev.close

Values

dev_name: The device that is going to be closed

Name

probe::netdev.hard_transmit - Called when the devices is going to TX (hard)

Synopsis

netdev.hard_transmit

Values

protocol: The protocol used in the transmission
dev_name: The device scheduled to transmit
length: The length of the transmit buffer.
truesize: The size of the data to be transmitted.

Name

probe::netdev.rx - Called when the device is going to receive a packet

Synopsis

netdev.rx

Values

protocol: The packet protocol
dev_name: The device received the packet

Name

probe::netdev.change_rx_flag - Called when the device RX flag will be changed

Synopsis

netdev.change_rx_flag

Values

dev_name: The device that will be changed
flags: The new flags

Name

probe::netdev.set_promiscuity - Called when the device enters/leaves promiscuity

Synopsis

netdev.set_promiscuity

Values

dev_name: The device that is entering/leaving promiscuity mode
enable: If the device is entering promiscuity mode
inc: Count the number of promiscuity openers
disable: If the device is leaving promiscuity mode

Name

probe::netdev.ioctl - Called when the device suffers an IOCTL

Synopsis

netdev.ioctl

Values

cmd: The IOCTL request
arg: The IOCTL argument (usually the netdev interface)

Name

probe::netdev.register - Called when the device is registered

Synopsis

netdev.register

Values

dev_name: The device that is going to be registered

Name

probe::netdev.unregister - Called when the device is being unregistered

Synopsis

netdev.unregister

Values

dev_name: The device that is going to be unregistered

Name

probe::netdev.get_stats - Called when someone asks the device statistics

Synopsis

netdev.get_stats

Values

dev_name: The device that is going to provide the statistics

Name

probe::netdev.change_mac - Called when the netdev_name has the MAC changed

Synopsis

netdev.change_mac

Values

dev_name: The device that will have the MTU changed
new_mac: The new MAC address
mac_len: The MAC length
old_mac: The current MAC address

Name

probe::tcp.sendmsg - Sending a tcp message

Synopsis

tcp.sendmsg

Values

name: Name of this probe
size: Number of bytes to send
sock: Network socket

Context

The process which sends a tcp message

Name

probe::tcp.sendmsg.return - Sending TCP message is done

Synopsis

tcp.sendmsg.return

Values

name: Name of this probe
size: Number of bytes sent or error code if an error occurred.

Context

The process which sends a tcp message

Name

probe::tcp.recvmsg - Receiving TCP message

Synopsis

tcp.recvmsg

Values

saddr: A string representing the source IP address
daddr: A string representing the destination IP address
name: Name of this probe
sport: TCP source port
dport: TCP destination port
size: Number of bytes to be received
sock: Network socket

Context

The process which receives a tcp message

Name

probe::tcp.recvmsg.return - Receiving TCP message complete

Synopsis

tcp.recvmsg.return

Values

saddr: A string representing the source IP address
daddr: A string representing the destination IP address
name: Name of this probe
sport: TCP source port
dport: TCP destination port
size: Number of bytes received or error code if an error occurred.

Context

The process which receives a tcp message

Name

probe::tcp.disconnect - TCP socket disconnection

Synopsis

tcp.disconnect

Values

saddr: A string representing the source IP address
daddr: A string representing the destination IP address
flags: TCP flags (e.g. FIN, etc)
name: Name of this probe
sport: TCP source port
dport: TCP destination port
sock: Network socket

Context

The process which disconnects tcp

Name

probe::tcp.disconnect.return - TCP socket disconnection complete

Synopsis

tcp.disconnect.return

Values

ret: Error code (0: no error)
name: Name of this probe

Context

The process which disconnects tcp

Name

probe::tcp.setsockopt - Call to setsockopt

Synopsis

tcp.setsockopt

Values

optstr: Resolves optname to a human-readable format
level: The level at which the socket options will be manipulated
optlen: Used to access values for setsockopt
name: Name of this probe
optname: TCP socket options (e.g. TCP_NODELAY, TCP_MAXSEG, etc)
sock: Network socket

Context

The process which calls setsockopt

Name

probe::tcp.setsockopt.return - Return from setsockopt

Synopsis

tcp.setsockopt.return

Values

ret: Error code (0: no error)
name: Name of this probe

Context

The process which calls setsockopt

Name

probe::tcp.receive - Called when a TCP packet is received

Synopsis

tcp.receive

Values

urg: TCP URG flag
protocol: Packet protocol from driver
psh: TCP PSH flag
name: Name of the probe point
rst: TCP RST flag
dport: TCP destination port
saddr: A string representing the source IP address
daddr: A string representing the destination IP address
ack: TCP ACK flag
fin: TCP FIN flag
syn: TCP SYN flag
sport: TCP source port
iphdr: IP header address

Name

probe::udp.sendmsg - Fires whenever a process sends a UDP message

Synopsis

udp.sendmsg

Values

name: The name of this probe
size: Number of bytes sent by the process
sock: Network socket used by the process

Context

The process which sent a UDP message

Name

probe::udp.sendmsg.return - Fires whenever an attempt to send a UDP message is completed

Synopsis

udp.sendmsg.return

Values

name: The name of this probe
size: Number of bytes sent by the process

Context

The process which sent a UDP message

Name

probe::udp.recvmsg - Fires whenever a UDP message is received

Synopsis

udp.recvmsg

Values

name: The name of this probe
size: Number of bytes received by the process
sock: Network socket used by the process

Context

The process which received a UDP message

Name

probe::udp.recvmsg.return - Fires whenever an attempt to receive a UDP message received is completed

Synopsis

udp.recvmsg.return

Values

name: The name of this probe
size: Number of bytes received by the process

Context

The process which received a UDP message

Name

probe::udp.disconnect - Fires when a process requests for a UDP disconnection

Synopsis

udp.disconnect

Values

flags: Flags (e.g. FIN, etc)
name: The name of this probe
sock: Network socket used by the process

Context

The process which requests a UDP disconnection

Name

probe::udp.disconnect.return - UDP has been disconnected successfully

Synopsis

udp.disconnect.return

Values

ret: Error code (0: no error)
name: The name of this probe

Context

The process which requested a UDP disconnection

Name

function::ip_ntop - returns a string representation from an integer IP number

Synopsis

function ip_ntop:string(addr:long)

Arguments

addr: the ip represented as an integer

Chapter 12. Socket Tapset

probe::socket.send - Message sent on a socket.
probe::socket.receive - Message received on a socket.
probe::socket.sendmsg - Message is currently being sent on a socket.
probe::socket.sendmsg.return - Return from socket.sendmsg.
probe::socket.recvmsg - Message being received on socket
probe::socket.recvmsg.return - Return from Message being received on socket
probe::socket.aio_write - Message send via sock_aio_write
probe::socket.aio_write.return - Conclusion of message send via sock_aio_write
probe::socket.aio_read - Receiving message via sock_aio_read
probe::socket.aio_read.return - Conclusion of message received via sock_aio_read
probe::socket.writev - Message sent via socket_writev
probe::socket.writev.return - Conclusion of message sent via socket_writev
probe::socket.readv - Receiving a message via sock_readv
probe::socket.readv.return - Conclusion of receiving a message via sock_readv
probe::socket.create - Creation of a socket
probe::socket.create.return - Return from Creation of a socket
probe::socket.close - Close a socket
probe::socket.close.return - Return from closing a socket
function::sock_prot_num2str - Given a protocol number, return a string representation.
function::sock_prot_str2num - Given a protocol name (string), return the corresponding protocol number.
function::sock_fam_num2str - Given a protocol family number, return a string representation.
function::sock_fam_str2num - Given a protocol family name (string), return the corresponding
function::sock_state_num2str - Given a socket state number, return a string representation.
function::sock_state_str2num - Given a socket state string, return the corresponding state number.

This family of probe points is used to probe socket activities. It contains the following probe points:

Name

probe::socket.send - Message sent on a socket.

Synopsis

socket.send

Values

success: Was send successful? (1 = yes, 0 = no)
protocol: Protocol value
flags: Socket flags value
name: Name of this probe
state: Socket state value
size: Size of message sent (in bytes) or error code if success = 0
type: Socket type value
family: Protocol family value

Context

The message sender

Name

probe::socket.receive - Message received on a socket.

Synopsis

socket.receive

Values

success: Was send successful? (1 = yes, 0 = no)
protocol: Protocol value
flags: Socket flags value
name: Name of this probe
state: Socket state value
size: Size of message received (in bytes) or error code if success = 0
type: Socket type value
family: Protocol family value

Context

The message receiver

Name

probe::socket.sendmsg - Message is currently being sent on a socket.

Synopsis

socket.sendmsg

Values

protocol: Protocol value
flags: Socket flags value
name: Name of this probe
state: Socket state value
size: Message size in bytes
type: Socket type value
family: Protocol family value

Context

The message sender

Description

Fires at the beginning of sending a message on a socket via the sock_sendmsg function

Name

probe::socket.sendmsg.return - Return from socket.sendmsg.

Synopsis

socket.sendmsg.return

Values

success: Was send successful? (1 = yes, 0 = no)
protocol: Protocol value
flags: Socket flags value
name: Name of this probe
state: Socket state value
size: Size of message sent (in bytes) or error code if success = 0
type: Socket type value
family: Protocol family value

Context

The message sender.

Description

Fires at the conclusion of sending a message on a socket via the sock_sendmsg function

Name

probe::socket.recvmsg - Message being received on socket

Synopsis

socket.recvmsg

Values

protocol: Protocol value
flags: Socket flags value
name: Name of this probe
state: Socket state value
size: Message size in bytes
type: Socket type value
family: Protocol family value

Context

The message receiver.

Description

Fires at the beginning of receiving a message on a socket via the sock_recvmsg function

Name

probe::socket.recvmsg.return - Return from Message being received on socket

Synopsis

socket.recvmsg.return

Values

success: Was receive successful? (1 = yes, 0 = no)
protocol: Protocol value
flags: Socket flags value
name: Name of this probe
state: Socket state value
size: Size of message received (in bytes) or error code if success = 0
type: Socket type value
family: Protocol family value

Context

The message receiver.

Description

Fires at the conclusion of receiving a message on a socket via the sock_recvmsg function.

Name

probe::socket.aio_write - Message send via sock_aio_write

Synopsis

socket.aio_write

Values

protocol: Protocol value
flags: Socket flags value
name: Name of this probe
state: Socket state value
size: Message size in bytes
type: Socket type value
family: Protocol family value

Context

The message sender

Description

Fires at the beginning of sending a message on a socket via the sock_aio_write function

Name

probe::socket.aio_write.return - Conclusion of message send via sock_aio_write

Synopsis

socket.aio_write.return

Values

success: Was receive successful? (1 = yes, 0 = no)
protocol: Protocol value
flags: Socket flags value
name: Name of this probe
state: Socket state value
size: Size of message received (in bytes) or error code if success = 0
type: Socket type value
family: Protocol family value

Context

The message receiver.

Description

Fires at the conclusion of sending a message on a socket via the sock_aio_write function

Name

probe::socket.aio_read - Receiving message via sock_aio_read

Synopsis

socket.aio_read

Values

protocol: Protocol value
flags: Socket flags value
name: Name of this probe
state: Socket state value
size: Message size in bytes
type: Socket type value
family: Protocol family value

Context

The message sender

Description

Fires at the beginning of receiving a message on a socket via the sock_aio_read function

Name

probe::socket.aio_read.return - Conclusion of message received via sock_aio_read

Synopsis

socket.aio_read.return

Values

success: Was receive successful? (1 = yes, 0 = no)
protocol: Protocol value
flags: Socket flags value
name: Name of this probe
state: Socket state value
size: Size of message received (in bytes) or error code if success = 0
type: Socket type value
family: Protocol family value

Context

The message receiver.

Description

Fires at the conclusion of receiving a message on a socket via the sock_aio_read function

Name

probe::socket.writev - Message sent via socket_writev

Synopsis

socket.writev

Values

protocol: Protocol value
flags: Socket flags value
name: Name of this probe
state: Socket state value
size: Message size in bytes
type: Socket type value
family: Protocol family value

Context

The message sender

Description

Fires at the beginning of sending a message on a socket via the sock_writev function

Name

probe::socket.writev.return - Conclusion of message sent via socket_writev

Synopsis

socket.writev.return

Values

success: Was send successful? (1 = yes, 0 = no)
protocol: Protocol value
flags: Socket flags value
name: Name of this probe
state: Socket state value
size: Size of message sent (in bytes) or error code if success = 0
type: Socket type value
family: Protocol family value

Context

The message receiver.

Description

Fires at the conclusion of sending a message on a socket via the sock_writev function

Name

probe::socket.readv - Receiving a message via sock_readv

Synopsis

socket.readv

Values

protocol: Protocol value
flags: Socket flags value
name: Name of this probe
state: Socket state value
size: Message size in bytes
type: Socket type value
family: Protocol family value

Context

The message sender

Description

Fires at the beginning of receiving a message on a socket via the sock_readv function

Name

probe::socket.readv.return - Conclusion of receiving a message via sock_readv

Synopsis

socket.readv.return

Values

success: Was receive successful? (1 = yes, 0 = no)
protocol: Protocol value
flags: Socket flags value
name: Name of this probe
state: Socket state value
size: Size of message received (in bytes) or error code if success = 0
type: Socket type value
family: Protocol family value

Context

The message receiver.

Description

Fires at the conclusion of receiving a message on a socket via the sock_readv function

Name

probe::socket.create - Creation of a socket

Synopsis

socket.create

Values

protocol: Protocol value
name: Name of this probe
requester: Requested by user process or the kernel (1 = kernel, 0 = user)
type: Socket type value
family: Protocol family value

Context

The requester (see requester variable)

Description

Fires at the beginning of creating a socket.

Name

probe::socket.create.return - Return from Creation of a socket

Synopsis

socket.create.return

Values

success: Was socket creation successful? (1 = yes, 0 = no)
protocol: Protocol value
err: Error code if success == 0
name: Name of this probe
requester: Requested by user process or the kernel (1 = kernel, 0 = user)
type: Socket type value
family: Protocol family value

Context

The requester (user process or kernel)

Description

Fires at the conclusion of creating a socket.

Name

probe::socket.close - Close a socket

Synopsis

socket.close

Values

protocol: Protocol value
flags: Socket flags value
name: Name of this probe
state: Socket state value
type: Socket type value
family: Protocol family value

Context

The requester (user process or kernel)

Description

Fires at the beginning of closing a socket.

Name

probe::socket.close.return - Return from closing a socket

Synopsis

socket.close.return

Values

name: Name of this probe

Context

The requester (user process or kernel)

Description

Fires at the conclusion of closing a socket.

Name

function::sock_prot_num2str - Given a protocol number, return a string representation.

Synopsis

function sock_prot_num2str:string(proto:long)

Arguments

proto: The protocol number.

Name

function::sock_prot_str2num - Given a protocol name (string), return the corresponding protocol number.

Synopsis

function sock_prot_str2num:long(proto:string)

Arguments

proto: The protocol name.

Name

function::sock_fam_num2str - Given a protocol family number, return a string representation.

Synopsis

function sock_fam_num2str:string(family:long)

Arguments

family: The family number.

Name

function::sock_fam_str2num - Given a protocol family name (string), return the corresponding

Synopsis

function sock_fam_str2num:long(family:string)

Arguments

family: The family name.

Description

protocol family number.

Name

function::sock_state_num2str - Given a socket state number, return a string representation.

Synopsis

function sock_state_num2str:string(state:long)

Arguments

state: The state number.

Name

function::sock_state_str2num - Given a socket state string, return the corresponding state number.

Synopsis

function sock_state_str2num:long(state:string)

Arguments

state: The state name.

Chapter 13. Kernel Process Tapset

probe::kprocess.create - Fires whenever a new process is successfully created
probe::kprocess.start - Starting new process
probe::kprocess.exec - Attempt to exec to a new program
probe::kprocess.exec_complete - Return from exec to a new program
probe::kprocess.exit - Exit from process
probe::kprocess.release - Process released

This family of probe points is used to probe process-related activities. It contains the following probe points:

Name

probe::kprocess.create - Fires whenever a new process is successfully created

Synopsis

kprocess.create

Values

new_pid: The PID of the newly created process

Context

Parent of the created process.

Description

Fires whenever a new process is successfully created, either as a result of fork (or one of its syscall variants), or a new kernel thread.

Name

probe::kprocess.start - Starting new process

Synopsis

kprocess.start

Values

None

Context

Newly created process.

Description

Fires immediately before a new process begins execution.

Name

probe::kprocess.exec - Attempt to exec to a new program

Synopsis

kprocess.exec

Values

filename: The path to the new executable

Context

The caller of exec.

Description

Fires whenever a process attempts to exec to a new program.

Name

probe::kprocess.exec_complete - Return from exec to a new program

Synopsis

kprocess.exec_complete

Values

success: A boolean indicating whether the exec was successful
errno: The error number resulting from the exec

Context

On success, the context of the new executable. On failure, remains in the context of the caller.

Description

Fires at the completion of an exec call.

Name

probe::kprocess.exit - Exit from process

Synopsis

kprocess.exit

Values

code: The exit code of the process

Context

The process which is terminating.

Description

Fires when a process terminates. This will always be followed by a kprocess.release, though the latter may be delayed if the process waits in a zombie state.

Name

probe::kprocess.release - Process released

Synopsis

kprocess.release

Values

pid: PID of the process being released
task: A task handle to the process being released

Context

The context of the parent, if it wanted notification of this process' termination, else the context of the process itself.

Description

Fires when a process is released from the kernel. This always follows a kprocess.exit, though it may be delayed somewhat if the process waits in a zombie state.

Source : http://www.redhat.com

(Sebelumnya) 22 : Chapter 4. Timestamp Func ...

22 : Chapter 14. Signal Tapset ... (Berikutnya)