ktap

ktap is an open source, completely free, lightweight and small command-line software project that aims to provide GNU/Linux users with a next generation script-based dynamic tracing program.

Features at a glance

Key features include a simple, yet powerful scripting language, a register-based interpreter that is heavily optimized in the Linux kernel, and does not depend on GCC (GNU Compiler Collection) for each running script. It also supports Linux kernel 3.1 and later.

The utility is easy to use in embedded environments, without debugging information, supports k(ret)probe, tracepoint, u(ret)probe, timer, function trace, etc. ktap can be used on 32-bit (x86), ARM, PPC (PowerPC), and MIPS architectures supported in the mainline Linux kernel.

Getting started with ktap

Installing ktap is quite easy. It must be compiled against your Linux kernel, so make sure that you install the Linux kernel headers package(s) prior to attempting installing the software. Download the latest release of ktap from Softoware, save it on your Home directory and unpack it.

Open the Terminal app, move to the location where you’ve extracted the archive file (e.g. cd /home/softoware/ktap-0.4), run the ‘make’ command to compile the program, followed by the ‘make load’ command to load the ktapvm kernel module.

Install it by running the ‘sudo make install’ command as a privileged user, or the ‘make install’ command as root. You can then interact with ktap by running the ‘ktap samples/helloworld.kp’ command.

Command-line options

Run the ‘ktap -h’ command in a terminal emulator to view the program’s default command-line options. These will allow you to send the script output to a file, instead of stderr, to specify the CPU to monitor, to display timestamp for events, to enable verbose mode, as well as to list byte codes, pre-defined events in system, or available function and sdt notes from DSO.

What is new in this release:

• Support tracepoints, k(ret)probe, u(ret)probe, timer, function tracing, sdt, etc.
• Support x86, x86-64, powerpc, arm.
• Support kernel 3.1 and newer versions, include Linux mainline.
• Support FFI (call kernel function from script)

What is new in version 0.3:

• simple new tracing block syntax:
• trace EVENTDEF { action }
• trace_end { action }
• New event tracing keywords: argevent, argname, arg1..arg9:
• trace "syscalls:*" function () {
• print(argevent)
• New timer block syntax:
• tick-N { action }
• profile-N { action }
• Basic aggregation support:
• It's similar with systemtap, use "