<?xml version="1.0" encoding="UTF-8" standalone="no"?>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8" /><title>5.3.6. Tracking System Call Volume Per Process</title><link rel="stylesheet" type="text/css" href="Common_Content/css/default.css" /><link rel="stylesheet" media="print" href="Common_Content/css/print.css" type="text/css" /><meta name="generator" content="publican 2.8" /><meta name="package" content="Systemtap-SystemTap_Beginners_Guide-2.1-en-US-2.1-2" /><link rel="home" href="index.html" title="SystemTap Beginners Guide" /><link rel="up" href="mainsect-profiling.html" title="5.3. Profiling" /><link rel="prev" href="topsyssect.html" title="5.3.5. Tracking Most Frequently Used System Calls" /><link rel="next" href="futexcontentionsect.html" title="5.4. Identifying Contended User-Space Locks" /></head><body><p id="title"><a class="left" href="http://www.fedoraproject.org"><img src="Common_Content/images/image_left.png" alt="Product Site" /></a><a class="right" href="http://docs.fedoraproject.org"><img src="Common_Content/images/image_right.png" alt="Documentation Site" /></a></p><ul class="docnav"><li class="previous"><a accesskey="p" href="topsyssect.html"><strong>Prev</strong></a></li><li class="next"><a accesskey="n" href="futexcontentionsect.html"><strong>Next</strong></a></li></ul><div xml:lang="en-US" class="section" id="syscallsbyprocpidsect" lang="en-US"><div class="titlepage"><div><div keep-together.within-column="always"><h3 class="title" id="syscallsbyprocpidsect">5.3.6. Tracking System Call Volume Per Process</h3></div></div></div><a id="idp7591576" class="indexterm"></a><a id="idp318920" class="indexterm"></a><a id="idp838032" class="indexterm"></a><a id="idm18713264" class="indexterm"></a><div class="para">
This section illustrates how to determine which processes are performing the highest volume of system calls. In previous sections, we've described how to monitor the top system calls used by the system over time (<a class="xref" href="topsyssect.html">Section 5.3.5, “Tracking Most Frequently Used System Calls”</a>). We've also described how to identify which applications use a specific set of "polling suspect" system calls the most (<a class="xref" href="timeoutssect.html">Section 5.3.4, “Monitoring Polling Applications”</a>). Monitoring the volume of system calls made by each process provides more data in investigating your system for polling processes and other resource hogs.
</div><div class="formalpara" id="syscallsbyprocpid"><h5 class="formalpara">syscalls_by_proc.stp</h5>
<pre class="programlisting">#! /usr/bin/env stap
# Copyright (C) 2006 IBM Corp.
#
# This file is part of systemtap, and is free software. You can
# redistribute it and/or modify it under the terms of the GNU General
# Public License (GPL); either version 2, or (at your option) any
# later version.
#
# Print the system call count by process name in descending order.
#
global syscalls
probe begin {
print ("Collecting data... Type Ctrl-C to exit and display results\n")
}
probe syscall.* {
syscalls[execname()]++
}
probe end {
printf ("%-10s %-s\n", "#SysCalls", "Process Name")
foreach (proc in syscalls-)
printf("%-10d %-s\n", syscalls[proc], proc)
}
</pre>
</div><div class="para">
<a class="xref" href="syscallsbyprocpidsect.html#syscallsbyprocpid">syscalls_by_proc.stp</a> lists the top 20 processes performing the highest number of system calls. It also lists how many system calls each process performed during the time period. Refer to <a class="xref" href="syscallsbyprocpidsect.html#syscallsbyprocpidoutput">Example 5.18, “topsys.stp Sample Output”</a> for a sample output.
</div><div class="example" id="syscallsbyprocpidoutput"><h6>Example 5.18. <a class="xref" href="topsyssect.html#topsys">topsys.stp</a> Sample Output</h6><div class="example-contents"><pre class="screen">Collecting data... Type Ctrl-C to exit and display results
#SysCalls Process Name
1577 multiload-apple
692 synergyc
408 pcscd
376 mixer_applet2
299 gnome-terminal
293 Xorg
206 scim-panel-gtk
95 gnome-power-man
90 artsd
85 dhcdbd
84 scim-bridge
78 gnome-screensav
66 scim-launcher
[...]</pre></div></div><br class="example-break" /><div class="para">
If you prefer the output to display the process IDs instead of the process names, use the following script instead.
</div><div class="formalpara" id="syscallsbypid"><h5 class="formalpara">syscalls_by_pid.stp</h5>
<pre class="programlisting">#! /usr/bin/env stap
# Copyright (C) 2006 IBM Corp.
#
# This file is part of systemtap, and is free software. You can
# redistribute it and/or modify it under the terms of the GNU General
# Public License (GPL); either version 2, or (at your option) any
# later version.
#
# Print the system call count by process ID in descending order.
#
global syscalls
probe begin {
print ("Collecting data... Type Ctrl-C to exit and display results\n")
}
probe syscall.* {
syscalls[pid()]++
}
probe end {
printf ("%-10s %-s\n", "#SysCalls", "PID")
foreach (pid in syscalls-)
printf("%-10d %-d\n", syscalls[pid], pid)
}
</pre>
</div><div class="para">
As indicated in the output, you need to manually exit the script in order to display the results. You can add a timed expiration to either script by simply adding a <code class="command">timer.s()</code> probe; for example, to instruct the script to expire after 5 seconds, add the following probe to the script:
</div><pre class="screen">probe timer.s(5)
{
exit()
}</pre></div><ul class="docnav"><li class="previous"><a accesskey="p" href="topsyssect.html"><strong>Prev</strong>5.3.5. Tracking Most Frequently Used System Calls</a></li><li class="up"><a accesskey="u" href="#"><strong>Up</strong></a></li><li class="home"><a accesskey="h" href="index.html"><strong>Home</strong></a></li><li class="next"><a accesskey="n" href="futexcontentionsect.html"><strong>Next</strong>5.4. Identifying Contended User-Space Locks</a></li></ul></body></html>
