LinuxQuestions.org
LinuxAnswers - the LQ Linux tutorial section.
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Software > Linux - Kernel
User Name
Password
Linux - Kernel This forum is for all discussion relating to the Linux kernel.

Notices

Reply
 
Search this Thread
Old 12-05-2008, 02:06 AM   #1
sudhansu
LQ Newbie
 
Registered: Dec 2008
Posts: 4

Rep: Reputation: 0
want to make Log of system calls per process running on the machine


Hello everybody,

i want to trace system calls for each process running on machine. This trace must be done at kernel level... plz help me anybody how to do it?
 
Old 12-05-2008, 08:04 PM   #2
jailbait
Guru
 
Registered: Feb 2003
Location: Blue Ridge Mountain
Distribution: Debian Wheezy, Debian Jessie
Posts: 7,536

Rep: Reputation: 178Reputation: 178
You can do so with a specially patched kernel. Here are some links which explain how to do it:

http://en.wikipedia.org/wiki/Linux_Trace_Toolkit

http://www.opersys.com/LTT/dox/ltt-o...elp/index.html

http://www.linuxjournal.com/article/3829

--------------------------
Steve Stites
 
Old 12-05-2008, 08:29 PM   #3
syg00
LQ Veteran
 
Registered: Aug 2003
Location: Australia
Distribution: Lots ...
Posts: 12,309

Rep: Reputation: 1032Reputation: 1032Reputation: 1032Reputation: 1032Reputation: 1032Reputation: 1032Reputation: 1032Reputation: 1032
I might be inclined to look at systemtap. Don't know about tracing everything tho'.
Those 2 will give you plenty of references elsewhere.
 
Old 12-09-2008, 12:14 AM   #4
syg00
LQ Veteran
 
Registered: Aug 2003
Location: Australia
Distribution: Lots ...
Posts: 12,309

Rep: Reputation: 1032Reputation: 1032Reputation: 1032Reputation: 1032Reputation: 1032Reputation: 1032Reputation: 1032Reputation: 1032
Maybe have a look at ftrace - and yes, it came in at 2.6.27
 
Old 12-09-2008, 12:32 AM   #5
hasanatizaz
Member
 
Registered: Nov 2007
Location: Pakistan
Distribution: Redhat and Debian
Posts: 302
Blog Entries: 1

Rep: Reputation: 34
strace ?
 
Old 01-07-2009, 12:23 AM   #6
sudhansu
LQ Newbie
 
Registered: Dec 2008
Posts: 4

Original Poster
Rep: Reputation: 0
hello
i have tried starce and system tap but the problem is when i am doing #strace ls and when i am tracing ls using stap the sequences which i am getting are different. it seems me like stap is printing some more system calls and the number of these extra system calls are quite big(almost two times as in strace). i am using the following stap script

probe syscall.*
{
if(execname() == "ls")
printf ("%s\n",probefunc())
}

Now i am confused that what are these extra system calls.
-----------------------------------------------------------------
trace for ls using strace is

execve
brk
access
open
fstat64
mmap2
close
open
read
fstat64
mmap2
mmap2
mmap2
close
open
read
fstat64
mmap2
mmap2
close
open
read
fstat64
mmap2
mmap2
close
open
read
fstat64
mmap2
mmap2
mmap2
close
open
read
fstat64
mmap2
mmap2
mmap2
close
open
read
fstat64
mmap2
mmap2
close
open
read
fstat64
mmap2
mmap2
mmap2
close
mmap2
set_thread_area
mprotect
mprotect
mprotect
mprotect
mprotect
munmap
set_tid_address
set_robust_list
futex
rt_sigaction
rt_sigaction
rt_sigprocmask
getrlimit
uname
brk
brk
open
fstat64
mmap2
read
read
close
munmap
statfs64
open
fstat64
mmap2
read
read
close
munmap
open
fstat64
mmap2
close
ioctl
ioctl
open
fstat64
fcntl64
getdents64
getdents64
close
fstat64
ioctl
mmap2
write
close
munmap
close
exit_group

------------------------------------------------------------------------------------------------------------
trace for ls using stap script is

sys_close
sys_close
sys_brk
sys_access
sys_open
sys_fstat64
sys_mmap2
sys_close
sys_open
sys_read
sys_fstat64
sys_mmap2
sys_mmap2
sys_mmap2
sys_close
sys_open
sys_read
sys_fstat64
sys_mmap2
sys_mmap2
sys_close
sys_open
sys_read
sys_fstat64
sys_mmap2
sys_mmap2
sys_close
sys_open
sys_read
sys_fstat64
sys_mmap2
sys_mmap2
sys_mmap2
sys_close
sys_open
sys_read
sys_fstat64
sys_mmap2
sys_mmap2
sys_mmap2
sys_close
sys_open
sys_read
sys_fstat64
sys_mmap2
sys_mmap2
sys_close
sys_open
sys_read
sys_fstat64
sys_mmap2
sys_mmap2
sys_mmap2
sys_close
sys_mmap2
sys_set_thread_area
sys_mprotect
sys_mprotect
sys_mprotect
sys_mprotect
sys_mprotect
sys_munmap
sys_set_tid_address
sys_futex
sys_rt_sigaction
sys_rt_sigaction
sys_rt_sigprocmask
sys_getrlimit
sys_newuname
sys_brk
sys_brk
sys_open
sys_fstat64
sys_mmap2
sys_read
sys_read
sys_close
sys_munmap
sys_statfs64
sys_open
sys_fstat64
sys_mmap2
sys_read
sys_read
sys_close
sys_munmap
sys_open
sys_fstat64
sys_mmap2
sys_close
sys_ioctl
sys_ioctl
sys_ioctl
sys_ioctl
sys_rt_sigaction
sys_rt_sigaction
sys_rt_sigaction
sys_rt_sigaction
sys_rt_sigaction
sys_rt_sigaction
sys_rt_sigaction
sys_rt_sigaction
sys_rt_sigaction
sys_rt_sigaction
sys_rt_sigaction
sys_rt_sigaction
sys_rt_sigaction
sys_rt_sigaction
sys_rt_sigaction
sys_rt_sigaction
sys_rt_sigaction
sys_rt_sigaction
sys_rt_sigaction
sys_rt_sigaction
sys_rt_sigaction
sys_rt_sigaction
sys_rt_sigaction
sys_rt_sigaction
sys_fstat64
sys_mmap2
sys_open
sys_fstat64
sys_fcntl64
sys_fcntl64
sys_getdents64
sys_lstat64
sys_socket
sys_fcntl64
sys_fcntl64
sys_connect
sys_close
sys_socket
sys_fcntl64
sys_fcntl64
sys_connect
sys_close
sys_open
sys_fstat64
sys_mmap2
sys_read
sys_read
sys_close
sys_munmap
sys_open
sys_fstat64
sys_mmap2
sys_close
sys_open
sys_read
sys_fstat64
sys_mmap2
sys_mmap2
sys_close
sys_mprotect
sys_munmap
sys_open
sys_fcntl64
sys_fcntl64
sys_fstat64
sys_mmap2
sys_read
sys_close
sys_munmap
sys_socket
sys_fcntl64
sys_fcntl64
sys_connect
sys_close
sys_socket
sys_fcntl64
sys_fcntl64
sys_connect
sys_close
sys_open
sys_fstat64
sys_mmap2
sys_read
sys_close
sys_munmap
sys_lstat64
sys_open
sys_fstat64
sys_mmap2
sys_read
sys_close
sys_munmap
sys_open
sys_fstat64
sys_mmap2
sys_read
sys_close
sys_munmap
sys_lstat64
sys_lstat64
sys_lstat64
sys_getdents64
sys_close
sys_write
sys_write
sys_rt_sigaction
sys_rt_sigaction
sys_rt_sigaction
sys_rt_sigaction
sys_rt_sigaction
sys_rt_sigaction
sys_rt_sigaction
sys_rt_sigaction
sys_rt_sigaction
sys_rt_sigaction
sys_rt_sigaction
sys_rt_sigaction
sys_close
sys_munmap
sys_close
sys_exit_group
do_exit


-----------------------------------------------------------------
please help me to understand this difference. I will be very thankful to you.
 
Old 11-17-2011, 04:04 PM   #7
8613133
LQ Newbie
 
Registered: Nov 2011
Posts: 11

Rep: Reputation: Disabled
logging

hi,
i want to log all the system calls & services in the kernel(services are the transanction between modules in the kernel),with which tool i can do it?
 
Old 02-16-2012, 02:50 AM   #8
drc123
LQ Newbie
 
Registered: Oct 2011
Posts: 3

Rep: Reputation: Disabled
Use ftrace. Do the following :

$ mount -t debugfs nodev /sys/kernel/debug
$ cd /sys/kernel_debug/tracing/
$ echo function > current_tracer
$ echo 1 > tracing_on
$ echo 1 > tracing_enabled
$ cat trace|more

You will see kernel function control flow.
Then,
from a new shell
$ ping google.com

return to ftrace shell

$ cat trace|grep "ping-"

You should see kernel action for ping. Cool stuff.
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
process ,threads and system calls raedbenz Linux - Newbie 16 07-15-2008 12:30 AM
Which virtual machine can be used to emulate RH 7.3 on PIV to log system calls nedianz Linux - Security 1 03-14-2005 08:07 AM
which virtaul machine to use to log system calls by privileged proccesses nedianz Linux - Newbie 1 03-14-2005 06:10 AM
Which virtual machine can be used to emulate RH 7.3 on PIV to log system calls nedianz Linux - Software 0 03-14-2005 05:36 AM
run process in background using system calls indian Programming 2 08-10-2004 05:03 PM


All times are GMT -5. The time now is 07:02 PM.

Main Menu
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
identi.ca: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration