Question

我为sys_enter_openat的系统调用启用了ftrace事件跟踪。 events/syscalls/sys_enter_openat/format给出的相应输出格式是

print fmt: "dfd: 0x%08lx, filename: 0x%08lx, flags: 0x%08lx, mode: 0x%08lx", ((unsigned long)(REC->dfd)), ((unsigned long)(REC->filename)), ((unsigned long)(REC->flags)), ((unsigned long)(REC->mode))

正如预期的那样，到ftrace的示例输出行类似于

msm_irqbalance-1338  [000] ...1 211710.033931: sys_openat(dfd: ffffff9c, filename: 5af693f224, flags: 2, mode: 0)

是否可以更改输出格式，以使filename: 5af693f224可以显示为filename: <string>而不是地址？我想使用systemtap或krpobe可以做到这一点，但是我的设置目前不允许使用它。

Answer 1

您可以使用自己的格式定义 kprobe 事件：

let iframeLoaded = false;

function Activate_iFrame() {

    //iframe start
    let iframe_01 = document.getElementById("iframe_01");

    iframe_01.style.display = 'Block';

    if (!iframeLoaded &&$("#iframe_01").find("iframe").contents().find("body")) {
        console.log("loaded");
        iframeLoaded = true;
        iframe_01.src = "LINK TO WEBSITE";
    }
}

输出：

cd /sys/kernel/debug/tracing
echo 'p:open do_sys_open file=+0(%si):string' > kprobe_events
echo 1 > events/kprobes/open/enable
cat trace_pipe

详情见：https://events19.linuxfoundation.org/wp-content/uploads/2017/12/oss-eu-2018-fun-with-dynamic-trace-events_steven-rostedt.pdf

将系统调用事件跟踪输出的格式更改为ftrace

1 个答案: