debug.stp

global closed_trace%
global closed_timestamp%
global closed_tid%

probe syscall.close {
    if (target() != pid()) {
        next
    }
    closed_trace[$fd] = ubacktrace()
    closed_timestamp[$fd] = gettimeofday_us()
    closed_tid[$fd] = tid()
}

probe syscall.read.return {
    if (target() != pid()) {
        next
    }
    if ($return == -9) {
        now = gettimeofday_us()
        printf("%s.%06d, read(%d) == -EBADF\n", ctime(now/1000000), now%1000000, $fd)
        printf("%s\n", print_usyms(ubacktrace()))
        printf("Closed in %d at %s.%06d:\n",
               closed_tid[$fd],
               ctime(closed_timestamp[$fd]/1000000), closed_timestamp[$fd]%1000000)
        printf("%s\n", print_usyms(closed_trace[$fd]))
    }
}