Re: Trace syscalls

["Frank Ch. Eigler" <fche at redhat dot com>]

Hi -

On Tue, Mar 25, 2008 at 03:03:19PM -0700, Tim Bird wrote:
> Frank Ch. Eigler wrote:
> >It is tempting to use an overbroad wildcard for that @2 parameter, but
> >just try with specific files (or function name patterns, or
> >directories) first.  Our kernel probing blacklist is not sufficiently
> >broad yet, and a plain '*' can still bring down a machine.
> 
> FWIW, maintaining the blacklist for Kernel Function Trace (which puts
> a hook in every kernel function prologue and epilogue) is one of the
> painful aspects of that project.

Yeah.  We haven't come quite to terms with it, but our ability to use
wildcards both to specify probes and to blacklist areas may make it
less painful.


> My experience with KFT overhead is that it about doubles the
> execution time of the kernel while it is active.  [...]

If that includes data production (actual tracing), that would be
unexpectedly good.


> I was waiting for the new system tracing work by Steven Rostedt to
> make it into the kernel before trying to push some KFT bits
> upstream. Optimally this kind of thing could be done with Markers
> and somehow integrated for SystemTap to utilize by flipping a switch
> (sometime in the distant future).

Actually, I hope to see systemtap interface directly to the native
function tracing API being proposed.  It may even be possible to do it
transparently to script users under the existing .function() probe
point names.

- FChE