fche changed the topic of #systemtap to: http://sourceware.org/systemtap; email systemtap@sourceware.org if answers here not timely, conversations may be logged
pwithnall____ has quit [Ping timeout: 255 seconds]
hpt has joined #systemtap
pwithnall_ has quit [Ping timeout: 255 seconds]
pwithnall_ has joined #systemtap
orivej has joined #systemtap
gromero has joined #systemtap
hkshaw has joined #systemtap
gromero has quit [Ping timeout: 240 seconds]
fLiPr3VeRsE has joined #systemtap
gila has joined #systemtap
pwithnall_ has quit [Quit: pwithnall_]
pwithnall_ has joined #systemtap
scox has quit [Ping timeout: 255 seconds]
pwithnall_ has quit [Quit: pwithnall_]
pwithnall____ has joined #systemtap
orivej has quit [Ping timeout: 240 seconds]
orivej has joined #systemtap
hpt has quit [Quit: Lost terminal]
pwithnall_ has joined #systemtap
gila has quit [Ping timeout: 240 seconds]
gila has joined #systemtap
mjw has joined #systemtap
sj0rz_ has joined #systemtap
gila has quit [Ping timeout: 276 seconds]
hkshaw has quit [Ping timeout: 276 seconds]
pwithnall_ has quit [Quit: pwithnall_]
<sj0rz_> i was looking at https://sourceware.org/git/gitweb.cgi?p=systemtap.git;a=blob;f=tapset/linux/sysc_execve.stp;h=3a305b51f9e74ade48ab53c05f6576646bd67cc1;hb=HEAD#l66
<sj0rz_> am i correct that there is no out of the box way to expand the collapsed env array? (to mimic the behavior of strace -v)
<fche> sj0rz_, have you seen [man function::env_var] ?
<fche> (dunno why it's not called 'getenv' though :)
<sj0rz_> fche: i had not, thanks
sj0rz_ is now known as sj0rz
gila has joined #systemtap
hkshaw has joined #systemtap
orivej has quit [Ping timeout: 255 seconds]
wcohen has quit [Ping timeout: 240 seconds]
orivej has joined #systemtap
nkambo__ has joined #systemtap
nkambo_ has quit [Ping timeout: 268 seconds]
<sj0rz> fche: ah, i see that function gets the environment from the current process
<sj0rz> what i meant was merely printing the env array in a similar manner to the argv array
<sj0rz> in the execve probe
<sj0rz> i guess i could just use __get_argv instead of __count_envp
gromero has joined #systemtap
scox has joined #systemtap
<sj0rz> what is the difference between the dw_ and the nd_ probes?
nkambo__ has quit [Ping timeout: 246 seconds]
<sj0rz> probe syscall.execve = dw_syscall.execve !, nd_syscall.execve {}
leitao has joined #systemtap
nkambo__ has joined #systemtap
mbenitez has joined #systemtap
mbenitez has joined #systemtap
mbenitez has quit [Changing host]
<fche> that's hinted at in [man stapprobes]
<fche> dw - dwarf debuginfo based; nd - kprobe symbol-table/abi based
<sj0rz> fche: thanks!
nkambo_ has joined #systemtap
nkambo__ has quit [Ping timeout: 268 seconds]
nkambo_ has quit [Ping timeout: 246 seconds]
pwithnall_ has joined #systemtap
drsmith_away is now known as drsmith
nkambo_ has joined #systemtap
pwithnall_ has quit [Quit: pwithnall_]
orivej has quit [Ping timeout: 246 seconds]
wcohen has joined #systemtap
<sj0rz> fche: so how can i best overwrite this behavior in my .stp script?
<sj0rz> i'm having trouble getting it to work
<sj0rz> the default tapset contains probes for the execve syscall for multiple arches, can i overwrite the behavior for all of them in my .stp script somehow?
<fche> what would you like to overwrite?
<fche> stap -L syscall.execve
<fche> syscall.execve name:string filename:string __argv:long args:string __envp:long env_str:string argstr:string $filename:long int $argv:long int $envp:long int
<fche> you want to provide some decoded form of env_str somehow?
<sj0rz> yeah i basically wanted to replace:
<sj0rz> env_str = __count_envp(pointer_arg(3))
<sj0rz> by:
<sj0rz> env_str = __get_argv(pointer_arg(3), 0)
<sj0rz> in the default execve probe
<sj0rz> i have a probe for probe nd_syscall.* that logs to a file
<sj0rz> but i want the output of execve to use the expanded env format
<fche> can you give me an example of the difference?
<fche> if it's naturally better, we can make it work by changing the tapset source directly, I guess conditionally on %( systemtap_v %)
brolley has joined #systemtap
<sj0rz> yeah that was what i was thinking (like the strace -v flag)
<sj0rz> example of the difference in what, output?
<fche> yea
<fche> so the stap equivalent - difference between that _count_envp and _get_argv
<sj0rz> oh, if i just modify the default stp file directly you mean? so was i correct in concluding that there is no convenient way to overwrite the behavior from my custom .stp file?
<sj0rz> i thought if i just don't use the alias name, but instead define my overwriting probe for kprobe.function("sys_execve")
<sj0rz> it should overwrite, but that doesn't seem to work as i expected
<fche> you can write your own probe in your own stp file probe kprobe.function("sys_exceve") { /* do whatever you want */ }
<fche> to change a default, so that the env_str is depicted differently for every user from now on, yeah change the tapset .stp file
drsmith is now known as drsmith_away
drsmith_away is now known as drsmith
<sj0rz> ok i'll do that
<sj0rz> so what is the idea between the non arch specific vs arch specific .stp file?
<sj0rz> what purpose does the /tapset/linux/sysc_execve.stp file serve
<sj0rz> or when are the arch specific versions used
gila has quit [Ping timeout: 255 seconds]
<sj0rz> (sorry for all the questions, appreciate the help)
gila has joined #systemtap
<fche> the arch specific ones supplement the non-arch-specific ones
<fche> ignore the ARCH/sysc_execve.stp files - they're backward compatibility related
<irker466> systemtap: dsmith systemtap.git:refs/heads/master * release-3.1-96-gdf8ae71 / tapset/linux/memory.stp: Updated the vm.oom_kill probe for more recent kernels. http://tinyurl.com/yb26ozyy
mbenitez has quit [Remote host closed the connection]
mbenitez has joined #systemtap
wcohen has quit [Remote host closed the connection]
wcohen has joined #systemtap
orivej has joined #systemtap
brolley has quit [Ping timeout: 260 seconds]
<irker466> systemtap: amerey systemtap.git:refs/heads/master * release-3.1-97-g4d98ef8 / : Add new probe alias input.char http://tinyurl.com/y7cpg6aj
zodbot has quit [Read error: Connection reset by peer]
brolley has joined #systemtap
<sj0rz> is it possible that registering a broken probe at one point might've broken my system wide systemtap setup?
<sj0rz> i rebuilt my module and removed ~/.systemtap/cache
<sj0rz> but execve probes no longer get hit no matter what i try =\
<sj0rz> (the broken probe was execve)
<sj0rz> i even rebooted
mbenitez has quit [Quit: To office]
hkshaw has quit [Ping timeout: 240 seconds]
zodbot has joined #systemtap
pwithnall____ has quit [Quit: pwithnall____]
orivej has quit [Read error: Connection reset by peer]
brolley has quit [Ping timeout: 276 seconds]
orivej has joined #systemtap
mbenitez has joined #systemtap
brolley has joined #systemtap
brolley has left #systemtap [#systemtap]
<drsmith> sj0rz: Hmm, that doesn
<drsmith> let me try again
<drsmith> sj0rz: that doesn't sound reasonable
<drsmith> what exactly do you mean by a "broken" probe?
brolley has joined #systemtap
orivej has quit [Ping timeout: 255 seconds]
<irker466> systemtap: fche systemtap.git:refs/heads/rth/bpf * release-3.1-90-g6475a78 / loc2stap.cxx: staptree loc2stap: de-duplicate ctx target_symbol nodes http://tinyurl.com/yas5pg92
mjw has quit [Quit: Leaving]
przemoc has quit [Quit: reboot]
przemoc has joined #systemtap
scox has quit [Ping timeout: 240 seconds]
wcohen has quit [Ping timeout: 240 seconds]
mbenitez has quit [Quit: Leaving]
orivej has joined #systemtap
pwithnall_ has joined #systemtap
brolley has left #systemtap [#systemtap]
scox has joined #systemtap
drsmith is now known as drsmith_away
wcohen has joined #systemtap
pwithnall_ has quit [Ping timeout: 240 seconds]
pwithnall____ has joined #systemtap
pwithnall____ has quit [Quit: pwithnall____]
orivej has quit [Ping timeout: 246 seconds]
orivej has joined #systemtap
hkshaw has joined #systemtap