[lttng-dev] Extracting System Call IDs By Using TMF

[lttng-dev] Extracting System Call IDs By Using TMF

[Shariyar]

Hi,

I need information on how to extract system call ids from a kernel level
trace by using TMF.
For example, a sample code to iterate through a kernel trace in CTF format
is given below.

In this code, I am able to extract the system call name and its return
value. However, from the *event.getContent()* function, I could not get the
system call id for the corresponding system call name.

Kindly let me know, how to extract the system call id? By system call id I
mean the actual system call id assigned by Linux to a system call as shown
on this site: http://syscalls.kernelgrok.com/

///////////////////////////////////////////////Code
//////////////////////////////////////
public void readTrace(){

        CtfIterator  traceIterator=trace.createIterator();

        while (traceIterator.advance()){

            CtfTmfEvent event = traceIterator.getCurrentEvent();
            ITmfEventField content = event.getContent();
            String eventName=event.getEventName();

            ITmfEventField sys_exit=content.getField("ret");

            if (sys_exit != null)
                System.out.println("Ret: "+sys_exit.getValue());

            if (eventName.startsWith(LttngStrings.SYSCALL_PREFIX)
                ||
eventName.startsWith(LttngStrings.COMPAT_SYSCALL_PREFIX)) {

                        System.out.println(eventName);
             }
        }

    }
///////////////////////////////////////////////Code
//////////////////////////////////////

Regards,
Shariyar
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.lttng.org/pipermail/lttng-dev/attachments/20131128/46db208f/attachment.html>

[lttng-dev] Extracting System Call IDs By Using TMF

[Matthew Khouzam]

Hi Shariyar,

I would like to know what is the need for the syscall id? I looked at
kernel events, and they store the system call name, not the id? Is it
for performance reasons, or is there some functionality that can be
achieved from a call ID that cannot from a name?

On 13-11-28 07:29 PM, Shariyar wrote:
>
> I need information on how to extract system call ids from a kernel
> level trace by using TMF.
> For example, a sample code to iterate through a kernel trace in CTF
> format is given below.
>
> In this code, I am able to extract the system call name and its return
> value. However, from the *event.getContent()* function, I could not
> get the system call id for the corresponding system call name.
>
> Kindly let me know, how to extract the system call id? By system call
> id I mean the actual system call id assigned by Linux to a system call
> as shown on this site: http://syscalls.kernelgrok.com/
>

[lttng-dev] Extracting System Call IDs By Using TMF

[Francis Giraldeau]

Le 2013-11-29 10:39, Matthew Khouzam a ?crit :
> Hi Shariyar,
> 
> I would like to know what is the need for the syscall id? I looked at
> kernel events, and they store the system call name, not the id? Is it
> for performance reasons, or is there some functionality that can be
> achieved from a call ID that cannot from a name?


For that reason, I implemented a simple syscall event module, that do
not decode arguments:

https://github.com/giraldeau/lttng-modules/blob/addons/addons/lttng-syscall-entry.c

Francis

[lttng-dev] Extracting System Call IDs By Using TMF

[Shariyar]

Hi Matthew:

In that case I need to create a map myself.

I  was looking for the system call ids for the following reasons:

1. In LTTng 1.0, there were several occasions when only the system call id
was found in a trace but not the names. If such is the case with LTTng 2.0,
then my concern is  that it would be better to extract ids.

2. Trained models need to be stored in database and ids will take lesser
sapce as the model grows with time.

Regards,
Shariyar



Message: 1
Date: Fri, 29 Nov 2013 10:39:54 -0500
From: Matthew Khouzam <matthew.khouzam@ericsson.com>
To: <lttng-dev at lists.lttng.org>
Subject: Re: [lttng-dev] Extracting System Call IDs By Using TMF
Message-ID: <5298B54A.5080907 at ericsson.com>
Content-Type: text/plain; charset="ISO-8859-1"

Hi Shariyar,

I would like to know what is the need for the syscall id? I looked at
kernel events, and they store the system call name, not the id? Is it
for performance reasons, or is there some functionality that can be
achieved from a call ID that cannot from a name?
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.lttng.org/pipermail/lttng-dev/attachments/20131130/5e8eb168/attachment-0001.html>