/usr/sbin/syscount-perf is in perf-tools-unstable 0.0.1~20160212+git0c13e83-2.
This file is owned by root:root, with mode 0o755.
The actual contents of the file can be viewed below.
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131 132 133 134 135 136 137 138 139 140 141 142 143 144 145 146 147 148 149 150 151 152 153 154 155 156 157 158 159 160 161 162 163 164 165 166 167 168 169 170 171 172 173 174 175 176 177 178 179 180 181 182 183 184 185 186 187 188 189 190 191 192 | #!/bin/bash
#
# syscount - count system calls.
# Written using Linux perf_events (aka "perf").
#
# This is a proof-of-concept using perf_events capabilities for older kernel
# versions, that lack custom in-kernel aggregations. Once they exist, this
# script can be substantially rewritten and improved (lower overhead).
#
# USAGE: syscount [-chv] [-t top] {-p PID|-d seconds|command}
#
# Run "syscount -h" for full usage.
#
# REQUIREMENTS: Linux perf_events: add linux-tools-common, run "perf", then
# add any additional packages it requests. Also needs awk.
#
# OVERHEADS: Modes that report syscall names only (-c, -cp PID, -cd secs) have
# lower overhead, since they use in-kernel counts. Other modes which report
# process IDs (-cv) or process names (default) create a perf.data file for
# post processing, and you will see messages about it doing this. Beware of
# the file size (test for short durations, or use -c to see counts based on
# in-kernel counters), and gauge overheads based on the perf.data size.
#
# Note that this script delibrately does not pipe perf record into
# perf script, which would avoid perf.data, because it can create a feedback
# loop where the perf script syscalls are recorded. Hopefully there will be a
# fix for this in a later perf version, so perf.data can be skipped, or other
# kernel features to aggregate by process name in-kernel directly (eg, via
# eBPF, ktap, or SystemTap).
#
# From perf-tools: https://github.com/brendangregg/perf-tools
#
# See the syscount(8) man page (in perf-tools) for more info.
#
# COPYRIGHT: Copyright (c) 2014 Brendan Gregg.
#
# This program is free software; you can redistribute it and/or
# modify it under the terms of the GNU General Public License
# as published by the Free Software Foundation; either version 2
# of the License, or (at your option) any later version.
#
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
# GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License
# along with this program; if not, write to the Free Software Foundation,
# Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
#
# (http://www.gnu.org/copyleft/gpl.html)
#
# 07-Jul-2014 Brendan Gregg Created this.
# default variables
opt_count=0; opt_pid=0; opt_verbose=0; opt_cmd=0; opt_duration=0; opt_tail=0
tnum=; pid=; duration=; cmd=; cpus=-a; opts=; tcmd=cat; ttext=
trap '' INT QUIT TERM PIPE HUP
stdout_workaround=1 # needed for older perf versions
write_workaround=1 # needed for perf versions that trace their own writes
### parse options
while getopts cd:hp:t:v opt
do
case $opt in
c) opt_count=1 ;;
d) opt_duration=1; duration=$OPTARG ;;
p) opt_pid=1; pid=$OPTARG ;;
t) opt_tail=1; tnum=$OPTARG ;;
v) opt_verbose=1 ;;
h|?) cat <<-END >&2
USAGE: syscount [-chv] [-t top] {-p PID|-d seconds|command}
syscount # count by process name
-c # show counts by syscall name
-h # this usage message
-v # verbose: shows PID
-p PID # trace this PID only
-d seconds # duration of trace
-t num # show top number only
command # run and trace this command
eg,
syscount # syscalls by process name
syscount -c # syscalls by syscall name
syscount -d 5 # trace for 5 seconds
syscount -cp 923 # syscall names for PID 923
syscount -c ls # syscall names for "ls"
See the man page and example file for more info.
END
exit 1
esac
done
shift $(( $OPTIND - 1 ))
### option logic
if (( $# > 0 )); then
opt_cmd=1
cmd="$@"
cpus=
fi
if (( opt_pid + opt_duration + opt_cmd > 1 )); then
echo >&2 "ERROR: Pick one of {-p PID|-n name|-d seconds|command}"
exit 1
fi
if (( opt_tail )); then
tcmd="tail -$tnum"
ttext=" Top $tnum only."
fi
if (( opt_duration )); then
cmd="sleep $duration"
echo "Tracing for $duration seconds.$ttext.."
fi
if (( opt_pid )); then
cpus=
cmd="-p $pid"
echo "Tracing PID $pid.$ttext.. Ctrl-C to end."
fi
(( opt_cmd )) && echo "Tracing while running: \"$cmd\".$ttext.."
(( opt_pid + opt_duration + opt_cmd == 0 )) && \
echo "Tracing.$ttext.. Ctrl-C to end."
(( stdout_workaround )) && opts="-o /dev/stdout"
ulimit -n 32768 # often needed
### execute syscall name mode
if (( opt_count && ! opt_verbose )); then
: ${cmd:=sleep 999999}
out=$(perf stat $opts -e 'syscalls:sys_enter_*' $cpus $cmd)
printf "%-17s %8s\n" "SYSCALL" "COUNT"
echo "$out" | awk '
$1 && $2 ~ /syscalls:/ {
sub("syscalls:sys_enter_", ""); sub(":", "")
gsub(",", "")
printf "%-17s %8s\n", $2, $1
}' | sort -n -k2 | $tcmd
exit
fi
### execute syscall name with pid mode
if (( opt_count && opt_verbose )); then
if (( write_workaround )); then
# this list must end in write to associate the filter
tp=$(perf list syscalls:sys_enter_* | awk '
$1 != "syscalls:sys_enter_write" && $1 ~ /syscalls:/ { printf "-e %s ", $1 }')
tp="$tp -e syscalls:sys_enter_write"
sh -c "perf record $tp --filter 'common_pid != '\$\$ $cpus $cmd"
else
perf record 'syscalls:sys_enter_*' $cpus $cmd
# could also pipe direct to perf script
fi
printf "%-6s %-16s %-17s %8s\n" "PID" "COMM" "SYSCALL" "COUNT"
perf script --fields pid,comm,event | awk '$1 != "#" {
sub("syscalls:sys_enter_", ""); sub(":", "")
a[$1 ";" $2 ";" $3]++
}
END {
for (k in a) {
split(k, b, ";");
printf "%-6s %-16s %-17s %8d\n", b[2], b[1], b[3], a[k]
}
}' | sort -n -k4 | $tcmd
exit
fi
### execute process name mode
tp="-e raw_syscalls:sys_enter"
if (( write_workaround )); then
sh -c "perf record $tp --filter 'common_pid != '\$\$ $cpus $cmd"
else
perf record $tp $cpus $cmd
fi
if (( opt_verbose )); then
printf "%-6s %-16s %8s\n" "PID" "COMM" "COUNT"
perf script --fields pid,comm | awk '$1 != "#" { a[$1 ";" $2]++ }
END {
for (k in a) {
split(k, b, ";");
printf "%-6s %-16s %8d\n", b[2], b[1], a[k]
}
}' | sort -n -k3 | $tcmd
else
printf "%-16s %8s\n" "COMM" "COUNT"
perf script --fields comm | awk '$1 != "#" { a[$1]++ }
END {
for (k in a) {
printf "%-16s %8d\n", k, a[k]
}
}' | sort -n -k2 | $tcmd
fi
|