strace-ttt.awk

#!/usr/bin/env awk

# strace -ttt parser (speed ~ 10MB/s)

function inc(pid, time, syscall)
{
    # per-thread elapsed
    if (threads[pid]) {
        e = time - threads[pid];
    }

    elapsed[syscall] += e;
    ++calls[syscall];

    threads[pid] = time;

    total_elapsed += e;
    ++total;
}

BEGIN {
    FS="[ (]*"
}
# 29488 1491743556.274695 open("/foo", O_RDONLY <unfinished ...>
/ <unfinished ...> / {
    next;
}
# 29488 1491743556.274711 <... open resumed> ) = 8
/ resumed> / {
    inc($1, $2, $4);
    next;
}
# 29488 1491743556.274695 open("/foo", O_RDONLY) = 1
/ = / && NF > 3 {
    inc($1, $2, $3)
    next;
}
END {
    printf("# threads: %i, %.1f sec, %i calls\n",
           length(threads), total_elapsed, total);

    for (key in elapsed) {
        e = elapsed[key]
        c = calls[key]

        printf("%s: %.6f sec (%.1f %%), %i calls (%.1f %%)\n",
               key, e, e * 100 / total_elapsed, c, c * 100 / total);
    }
}