|
|
|
#!/usr/sbin/dtrace -qs
|
|
|
|
|
|
|
|
/*
|
|
|
|
* Copyright 2017, David Wilson
|
|
|
|
*
|
|
|
|
* Redistribution and use in source and binary forms, with or without
|
|
|
|
* modification, are permitted provided that the following conditions are met:
|
|
|
|
*
|
|
|
|
* 1. Redistributions of source code must retain the above copyright notice, this
|
|
|
|
* list of conditions and the following disclaimer.
|
|
|
|
*
|
|
|
|
* 2. Redistributions in binary form must reproduce the above copyright notice,
|
|
|
|
* this list of conditions and the following disclaimer in the documentation
|
|
|
|
* and/or other materials provided with the distribution.
|
|
|
|
*
|
|
|
|
* 3. Neither the name of the copyright holder nor the names of its contributors
|
|
|
|
* may be used to endorse or promote products derived from this software without
|
|
|
|
* specific prior written permission.
|
|
|
|
*
|
|
|
|
* THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND
|
|
|
|
* ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
|
|
|
|
* WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
|
|
|
|
* DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE
|
|
|
|
* FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
|
|
|
|
* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
|
|
|
|
* SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
|
|
|
|
* CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
|
|
|
|
* OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
|
|
|
|
* OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
|
|
|
|
*/
|
|
|
|
|
|
|
|
/*
|
|
|
|
* OS X DTrace script to record the CPU time consumed by any python2.7 or SSH
|
|
|
|
* process, and the exact read/write sizes to any AF_INET socket opened by an
|
|
|
|
* SSH process.
|
|
|
|
*
|
|
|
|
* This introduces significant tracing overhead of between 5-10%, most likely
|
|
|
|
* due to the SCHED events.
|
|
|
|
*
|
|
|
|
* Produces a CSV file containing columns:
|
|
|
|
* - wall_nsec: Nanoseconds wall time.
|
|
|
|
* - op: One of START, SCHED, EXIT, READ, WRITE
|
|
|
|
* - nbytes: for READ/WRITE, size of AF_INET data read/written
|
|
|
|
* - cpu_nsec: for SCHED, nanoseconds spent scheduled.
|
|
|
|
* - pid: Process ID.
|
|
|
|
* - execname: argv[0]
|
|
|
|
*
|
|
|
|
* Operations:
|
|
|
|
* - START: thread relevant to the trace started up.
|
|
|
|
* - EXIT: thread relevant to the trace ended, cpu_nsec contains total
|
|
|
|
* time scheduled
|
|
|
|
* - SCHED: thread relevant to the trace was scheduled, cpu_nsec contains
|
|
|
|
* time spent before it went off-cpu again.
|
|
|
|
* - READ: SSH process performed a nbytes read from an AF_INET socket.
|
|
|
|
* - WRITE: SSH process performed a nbytes write to an AF_INET socket.
|
|
|
|
*/
|
|
|
|
|
|
|
|
inline string SSH = "ssh";
|
|
|
|
inline string PYTHON = "python2.7";
|
|
|
|
inline int PF_INET = 2;
|
|
|
|
|
|
|
|
dtrace:::BEGIN
|
|
|
|
{
|
|
|
|
printf("wall_nsec,op,nbytes,cpu_nsec,pid,execname\n");
|
|
|
|
}
|
|
|
|
|
|
|
|
syscall::socket:entry
|
|
|
|
/execname == SSH/
|
|
|
|
{
|
|
|
|
self->is_inet = (arg0 == PF_INET);
|
|
|
|
}
|
|
|
|
|
|
|
|
syscall::socket:return
|
|
|
|
/self->is_inet/
|
|
|
|
{
|
|
|
|
self->inet_fds[arg0] = 1;
|
|
|
|
}
|
|
|
|
|
|
|
|
syscall::close:entry
|
|
|
|
/execname == SSH/
|
|
|
|
{
|
|
|
|
self->inet_fds[arg0] = 0;
|
|
|
|
}
|
|
|
|
|
|
|
|
syscall::write:entry,
|
|
|
|
syscall::write_nocancel:entry
|
|
|
|
{
|
|
|
|
self->fd = arg0;
|
|
|
|
}
|
|
|
|
|
|
|
|
syscall::write:return,
|
|
|
|
syscall::write_nocancel:return
|
|
|
|
/self->inet_fds[self->fd] && arg0 > 0/
|
|
|
|
{
|
|
|
|
printf("%d,WRITE,%d,,,\n", walltimestamp, arg0);
|
|
|
|
}
|
|
|
|
|
|
|
|
syscall::read:entry,
|
|
|
|
syscall::read_nocancel:entry
|
|
|
|
{
|
|
|
|
self->fd = arg0;
|
|
|
|
}
|
|
|
|
|
|
|
|
syscall::read*:return,
|
|
|
|
syscall::read_nocancel:return
|
|
|
|
/self->inet_fds[self->fd] && arg0 > 0/
|
|
|
|
{
|
|
|
|
printf("%d,READ,%d,,,\n", walltimestamp, arg0);
|
|
|
|
}
|
|
|
|
|
|
|
|
proc:::lwp-start
|
|
|
|
/execname == SSH || execname == PYTHON/
|
|
|
|
{
|
|
|
|
self->start_vtime = vtimestamp;
|
|
|
|
printf("%d,START,,,%d,%s\n", walltimestamp, pid, execname);
|
|
|
|
}
|
|
|
|
|
|
|
|
proc:::lwp-exit
|
|
|
|
/(execname == SSH || execname == PYTHON) && self->start_vtime/
|
|
|
|
{
|
|
|
|
this->nsecs = vtimestamp - self->start_vtime;
|
|
|
|
printf("%d,EXIT,,%d,%d,%s\n", walltimestamp, this->nsecs, pid, execname);
|
|
|
|
/* Kernel threads are recycled, variables hang around. */
|
|
|
|
self->start_vtime = 0;
|
|
|
|
self->ontime = 0;
|
|
|
|
}
|
|
|
|
|
|
|
|
sched:::on-cpu
|
|
|
|
/self->start_vtime/
|
|
|
|
{
|
|
|
|
self->ontime = timestamp;
|
|
|
|
}
|
|
|
|
|
|
|
|
sched:::off-cpu
|
|
|
|
/self->ontime/
|
|
|
|
{
|
|
|
|
printf("%d,SCHED,,%d,%d,%s\n",
|
|
|
|
walltimestamp,
|
|
|
|
timestamp - self->ontime,
|
|
|
|
pid,
|
|
|
|
execname
|
|
|
|
);
|
|
|
|
}
|