13:05 <gilfoyle> I'm trying to work out how to write a script to match certain data being sent via sys_sendmsg. I've defined a probe kprobe.function("sys_sendmsg") {} and within, I've added a printf. The `buf` is not recognized as a variable, and the argstr is coming up empty. How can I find what are the right arguments to use when introspecting specific syscalls?

13:46 <gilfoyle> sudo -s

13:46 <gilfoyle> 9Foxford!

13:47 <gilfoyle> ls

13:47 <gilfoyle> cd /var/log/nov

13:47 <gilfoyle> grep 545e4d85-1fe8-49cb-ae00-3ef8eb898755ls

13:48 <gilfoyle> grep 545e4d85-1fe8-49cb-ae00-3ef8eb898755 nova-sc;

13:48 <fche> hi gilfoyle

13:49 <fche> try probe syscall.sendmsg for the probe point and msg_uaddr as the way to get access to the userspace buffer pointer

13:51 <gilfoyle> list

13:51 <gilfoyle> nova-mana

13:51 <gilfoyle> openst hypervisor-list

13:51 <gilfoyle> sour/roop

13:51 <gilfoyle> openst hypervisor-list

13:51 <gilfoyle> openst hypervisor list

13:51 <fche> boy, that escalated quickly

13:56 <gilfoyle> sour/roopcd /pwd

14:11 <gilfoyle> apologies :) I had my terminal in broadcast mode

14:12 <gilfoyle> > try probe syscall.sendmsg for the probe point and msg_uaddr as the way to get access to the userspace buffer pointer

14:12 <gilfoyle> I was trying that just now

14:14 <fche> user_string() to dereference the pointer and isinstr() or regexps to find substrings

14:41 <gilfoyle> https://paste.ubuntu.com/p/BMwKS9WGPr/

14:41 <gilfoyle> this is what I'm seeing

14:42 <gilfoyle> let me try with the user_string

14:53 <fche> msg_uaddr is only an address(pointer) so yeah you need user_string or similar

15:40 <gilfoyle> https://paste.ubuntu.com/p/rn4YZJJk7Y/

15:40 <gilfoyle> are the debuginfos strictly necessary/

15:40 <gilfoyle> ..

15:40 <gilfoyle> ...?

15:41 <gilfoyle> (the above may sound like I am impatient and/or demanding, apologies, just multitasking between various oncall tasks.. :D)

15:41 <fche> in this case it seems to be

15:41 <gilfoyle> thanks, I'll fix it

15:50 <irker963> systemtap: sapatel systemtap.git:refs/heads/sapatel/pr23285 * release-4.1-69-g7c5b90b / bpf-translate.cxx stapbpf/bpfinterp.cxx: removed redundant string copying and added comments about validity of c_str() http://tinyurl.com/yxunm4ph

15:54 <gilfoyle> I just installed them, but it doesn't seem to have made a difference.. any idea what could be wrong here?

15:58 <gilfoyle> by not made a difference, I meant it stills prompts me to install them

15:58 <gilfoyle> and the errors remain the same

16:14 <gilfoyle> https://paste.ubuntu.com/p/Ttrmfd2sHK/

16:17 <gilfoyle> (The reason I'm not using debuginfo-install is simply because we don't have access to the debuginfo repos and hence I copied the rpms manually to the server)

16:19 <fche> my guess is you got the wrong versions

16:19 <fche> # stap-report ?

16:20 <gilfoyle> I think I found one missing package, hold on :)

16:22 <gilfoyle> kernel-debuginfo is missing. I had kernel-debug-debuginfo and kernel-debuginfo-common only

16:27 <gilfoyle> the stap-report is interesting!

16:40 <gilfoyle> so that didn't work either. What should I look for in the stap report?

16:43 <fche> is stap still complaining about debuginfo problems?

16:43 <fche> can you fpaste the report?

16:44 <fche> I'd look for an exact n-v-r version match for your running kernel and the auxiliary subrpms

16:45 <gilfoyle> I can paste it, but just need to obfuscate some stuff within (hostnames, users, etc)

16:47 <gilfoyle> https://paste.ubuntu.com/p/8v8w8B8SvR/

17:24 <fche> missing kernel-debuginfo-3.10.0-693.11.6.el7.x86_64

17:25 <fche> the warning::debuginfo / error::pass2 man pages note the issue

17:26 <fche> (the kernel-debug vs kernel-debuginfo confusion)

20:25 <irker772> systemtap: wcohen systemtap.git:refs/heads/wcohen/pr23478 * release-4.1-68-gcd5ff25 / bpf-translate.cxx: stapbpf PR23478:: Initial support to allow use of multi-dimensional arrays. http://tinyurl.com/yygz8yuf

22:33 <gilfoyle> qq, is it possible to identify if a given file descriptor is a socket or some other kind within systemtap?

22:33 <gilfoyle> qq, is it possible to identify if a given file descriptor is a socket or some other kind within systemtap?

22:33 <gilfoyle> qq, is it possible to identify if a given file descriptor is a socket or some other kind within systemtap?

22:33 <gilfoyle> qq, is it possible to identify if a given file descriptor is a socket or some other kind within systemtap?