全系统IO监控

iomoniter.stp

global file_read_top
global file_write_top

probe begin {
    printf("Ctrl-C break\n")
}

probe syscall.read.return {
    if ( $return > 0 ) {
        file = @cast(task_current(), "task_struct")->files->fdt->fd[$fd]
        filename = fullpath_struct_file(task_current(), file)
        if ( filename != "" ) {
            if ( (file->f_inode->i_mode & 0170000) == 0100000 ) {
                file_read_top[pid(), execname(), filename] += $return
            }
        }
    }
}

probe syscall.write.return {
    if ( $return > 0 ) {
        file = @cast(task_current(), "task_struct")->files->fdt->fd[$fd]
        filename = fullpath_struct_file(task_current(), file)
        if ( filename != "" ) {
            if ( (file->f_inode->i_mode & 0170000) == 0100000 ) {
                file_write_top[pid(), execname(), filename] += $return
            }
        }
    }
}