timing system calls or other functions

[Ivan Novick <novickivan at gmail dot com>]

Hello,

I am planning to use system tap to measure the amount of time inside
all system calls.  Every 60 seconds i will print out the current
accumulated numbers per system call.

I want to make sure that I do not include bogus numbers from returns
of system calls where i did not process the entry to the call.

The begin timestamp will be stored in an array keyed on pid and
syscall name.  When we get the return i will subtract the current
timestamp from the begin timestamp for that call.

What if there is no begin timestamp for that entry?   Due to starting
the tracking in the middle of a system call perhaps.

Will systemtap generate an error because i am trying to read a value
from the array that is not present?

Is there a way to write an if statement that checks for the presence
of a key in an associative array?  Than the solution would seem
straightforward.

The other question is regarding multi-threading.  Presumably the same
system call can be made from the same process multiple times before
exiting, so my associate array should probably be keyed on pid, tid,
and syscall name.  Correct?

There are numerous samples of measuring accumulated function time with
systemtap, but I did not see either the dangling return probe or
multi-threading discussed in this context.

Thank you and regards,
Ivan Novick