进程IO监控

ioperproc.stp

global file_rw_top
global exe

probe begin {
    printf("Ctrl-C break\n")
}

function rwtrace(pid, fd, size, type) {
    if ( size > 0 ) {
        if ( pid() == $1 ) {
            file = @cast(task_current(), "task_struct")->files->fdt->fd[fd]
            filename = fullpath_struct_file(task_current(), file)
            exe = execname()
        }
        if ( filename != "" ) {
            if ( (file->f_inode->i_mode & 0170000) == 0100000 ) {
                file_rw_top[type, filename] += size
            }
        }
    }
}

probe syscall.read.return {
    rwtrace($1, $fd, $return, "read")
}

probe syscall.write.return {
    rwtrace($1, $fd, $return, "write")
}

probe end {
    printf("\nexecname(pid) op filenames size(n)\n")
    foreach ( [type, filename] in file_rw_top- ) {
        size = file_rw_top[type, filename]
        printf("%s(%u) %s %s size(%ld)\n", exe, $1, type, filename, size);
    }
}