SystemTap script to view the top processes syscalls returning EACCES (and related files)

eacces.stp

#!/bin/env stap

global errors, files[50000]

probe syscall.open,
      syscall.write,
      syscall.read,
      syscall.pread,
      syscall.pwrite
 {
  filename .= ""
  if (filename != "") {
    files[pid(), execname(), filename] <<< 1
  }
}

probe syscall.open.return,
      syscall.write.return,
      syscall.read.return,
      syscall.pread.return,
      syscall.pwrite.return {
  if ($return == 2) { /* EACCES */
    errors[pid(), $return, name, execname()] <<< 1
  }
}

probe timer.s(10) {
  exit()
}

probe end {
  printf("\n%8s %-32s %-16s %8s\n",
         "PID", "SYSCALL", "PROC", "COUNT")
  foreach([pid, error, thissyscall, execname] in errors- limit 20) {
    printf("%8d %-32s %-16s %8d\n",
           pid,
           thissyscall,
           execname,
           @count(errors[pid, error, thissyscall, execname])
    )
    foreach ([fpid, execname, filename] in files- limit 10) {
      printf("\t - %8d %s\n", @count(files[fpid, execname, filename]), filename)
    }
  }

  delete errors
  delete files
}