ktap

A New Scripting Dynamic Tracing Tool For Linux
www.ktap.org

ktap is a new scripting dynamic tracing tool for Linux, it uses a scripting language and lets users trace the Linux kernel dynamically. ktap is designed to give operational insights with interoperability that allows users to tune, troubleshoot and extend the kernel and applications. It's similar to Linux Systemtap and Solaris Dtrace.

ktap has different design principles from Linux mainstream dynamic tracing language in that it's based on bytecode, so it doesn't depend upon GCC, doesn't require compiling kernel module for each script, safe to use in production environment, fulfilling the embedded ecosystem's tracing needs.

More information can be found at ktap homepage.

Highlights

• a simple but powerful scripting language
• register based interpreter (heavily optimized) in Linux kernel
• small and lightweight
• not depend on the gcc toolchain for each script run
• easy to use in embedded environments without debugging info
• support for tracepoint, kprobe, uprobe, function trace, timer, and more
• supported in x86, arm, ppc, mips
• safety in sandbox

Building & Running

1. Clone ktap from github

   $ git clone http://github.com/ktap/ktap.git
   

2. Compiling ktap

   $ cd ktap
   $ make       #generate ktapvm kernel module and ktap binary
   

3. Load ktapvm kernel module(make sure debugfs mounted)

   $ make load  #need to be root or have sudo access
   

4. Running ktap

   $ ./ktap samples/helloworld.kp
   

Examples

1. simplest one-liner command to enable all tracepoints

   ktap -e "trace *:* { print(argstr) }"
   

2. syscall tracing on target process

   ktap -e "trace syscalls:* { print(argstr) }" -- ls

3. from https://github.com/ktap/ktap