16 files changed, 82 insertions, 13 deletions
diff --git a/testsuite/systemtap.examples/index.html b/testsuite/systemtap.examples/index.html
index a5fddb4e..c485713c 100644
--- a/testsuite/systemtap.examples/index.html
+++ b/testsuite/systemtap.examples/index.html
@@ -112,6 +112,9 @@ keywords: <a href="keyword-index.html#NETWORK">NETWORK</a> <a href="keyword-inde
 <li><a href="process/errsnoop.stp">process/errsnoop.stp</a> - tabulate system call errors<br>
 keywords: <a href="keyword-index.html#PROCESS">PROCESS</a> <a href="keyword-index.html#SYSCALL">SYSCALL</a> <br>
 <p>The script prints a periodic tabular report about failing system calls, by process and by syscall failure.  The first optional argument specifies the reporting interval (in seconds, default 5); the second optional argument gives a screen height (number of lines in the report, default 20).</p></li>
+<li><a href="process/forktracker.stp">process/forktracker.stp</a> - Trace Creation of Processes<br>
+keywords: <a href="keyword-index.html#PROCESS">PROCESS</a> <a href="keyword-index.html#SCHEDULER">SCHEDULER</a> <br>
+<p>The forktracker.stp script prints out a time-stamped entry showing each fork and exec operation on the machine. This can be useful for determine what process is creating a flurry of short-lived processes.</p></li>
 <li><a href="process/futexes.stp">process/futexes.stp</a> - System-Wide Futex Contention<br>
 keywords: <a href="keyword-index.html#SYSCALL">SYSCALL</a> <a href="keyword-index.html#LOCKING">LOCKING</a> <a href="keyword-index.html#FUTEX">FUTEX</a> <br>
 <p>The script watches the futex syscall on the system. On exit the futexes address, the number of contentions, and the average time for each contention on the futex are printed from lowest pid number to highest.</p></li>
diff --git a/testsuite/systemtap.examples/index.txt b/testsuite/systemtap.examples/index.txt
index 95e81435..caf1a5ff 100644
--- a/testsuite/systemtap.examples/index.txt
+++ b/testsuite/systemtap.examples/index.txt
@@ -224,6 +224,14 @@ keywords: process syscall
   in the report, default 20).
 
 
+process/forktracker.stp - Trace Creation of Processes
+keywords: process scheduler
+
+  The forktracker.stp script prints out a time-stamped entry showing
+  each fork and exec operation on the machine. This can be useful for
+  determine what process is creating a flurry of short-lived processes.
+
+
 process/futexes.stp - System-Wide Futex Contention
 keywords: syscall locking futex
 
diff --git a/testsuite/systemtap.examples/keyword-index.html b/testsuite/systemtap.examples/keyword-index.html
index e144337c..9852c992 100644
--- a/testsuite/systemtap.examples/keyword-index.html
+++ b/testsuite/systemtap.examples/keyword-index.html
@@ -210,6 +210,9 @@ keywords: <a href="keyword-index.html#NETWORK">NETWORK</a> <a href="keyword-inde
 <li><a href="process/errsnoop.stp">process/errsnoop.stp</a> - tabulate system call errors<br>
 keywords: <a href="keyword-index.html#PROCESS">PROCESS</a> <a href="keyword-index.html#SYSCALL">SYSCALL</a> <br>
 <p>The script prints a periodic tabular report about failing system calls, by process and by syscall failure.  The first optional argument specifies the reporting interval (in seconds, default 5); the second optional argument gives a screen height (number of lines in the report, default 20).</p></li>
+<li><a href="process/forktracker.stp">process/forktracker.stp</a> - Trace Creation of Processes<br>
+keywords: <a href="keyword-index.html#PROCESS">PROCESS</a> <a href="keyword-index.html#SCHEDULER">SCHEDULER</a> <br>
+<p>The forktracker.stp script prints out a time-stamped entry showing each fork and exec operation on the machine. This can be useful for determine what process is creating a flurry of short-lived processes.</p></li>
 <li><a href="process/schedtimes.stp">process/schedtimes.stp</a> - Track Time Processes Spend in Various States using Tracepoints<br>
 keywords: <a href="keyword-index.html#PROCESS">PROCESS</a> <a href="keyword-index.html#SCHEDULER">SCHEDULER</a> <a href="keyword-index.html#TIME">TIME</a> <a href="keyword-index.html#TRACEPOINT">TRACEPOINT</a> <br>
 <p>The schedtimes.stp script instruments the scheduler to track the amount of time that each process spends running, sleeping, queued, and waiting for io. On exit the script prints out the accumulated time for each state of processes observed.  Optionally, this script can be used with the '-c' or '-x' options to focus on a specific PID.</p></li>
@@ -243,6 +246,9 @@ keywords: <a href="keyword-index.html#SYSCALL">SYSCALL</a> <a href="keyword-inde
 </ul>
 <h3><a name="SCHEDULER">SCHEDULER</a></h3>
 <ul>
+<li><a href="process/forktracker.stp">process/forktracker.stp</a> - Trace Creation of Processes<br>
+keywords: <a href="keyword-index.html#PROCESS">PROCESS</a> <a href="keyword-index.html#SCHEDULER">SCHEDULER</a> <br>
+<p>The forktracker.stp script prints out a time-stamped entry showing each fork and exec operation on the machine. This can be useful for determine what process is creating a flurry of short-lived processes.</p></li>
 <li><a href="process/schedtimes.stp">process/schedtimes.stp</a> - Track Time Processes Spend in Various States using Tracepoints<br>
 keywords: <a href="keyword-index.html#PROCESS">PROCESS</a> <a href="keyword-index.html#SCHEDULER">SCHEDULER</a> <a href="keyword-index.html#TIME">TIME</a> <a href="keyword-index.html#TRACEPOINT">TRACEPOINT</a> <br>
 <p>The schedtimes.stp script instruments the scheduler to track the amount of time that each process spends running, sleeping, queued, and waiting for io. On exit the script prints out the accumulated time for each state of processes observed.  Optionally, this script can be used with the '-c' or '-x' options to focus on a specific PID.</p></li>
diff --git a/testsuite/systemtap.examples/keyword-index.txt b/testsuite/systemtap.examples/keyword-index.txt
index 8305e208..4778afc7 100644
--- a/testsuite/systemtap.examples/keyword-index.txt
+++ b/testsuite/systemtap.examples/keyword-index.txt
@@ -390,6 +390,14 @@ keywords: process syscall
   in the report, default 20).
 
 
+process/forktracker.stp - Trace Creation of Processes
+keywords: process scheduler
+
+  The forktracker.stp script prints out a time-stamped entry showing
+  each fork and exec operation on the machine. This can be useful for
+  determine what process is creating a flurry of short-lived processes.
+
+
 process/schedtimes.stp - Track Time Processes Spend in Various States using Tracepoints
 keywords: process scheduler time tracepoint
 
@@ -480,6 +488,14 @@ keywords: syscall read write time io
 
 = SCHEDULER =
 
+process/forktracker.stp - Trace Creation of Processes
+keywords: process scheduler
+
+  The forktracker.stp script prints out a time-stamped entry showing
+  each fork and exec operation on the machine. This can be useful for
+  determine what process is creating a flurry of short-lived processes.
+
+
 process/schedtimes.stp - Track Time Processes Spend in Various States using Tracepoints
 keywords: process scheduler time tracepoint
 
diff --git a/testsuite/systemtap.examples/process/forktracker.meta b/testsuite/systemtap.examples/process/forktracker.meta
new file mode 100644
index 00000000..f3ef3709
--- /dev/null
+++ b/testsuite/systemtap.examples/process/forktracker.meta
@@ -0,0 +1,13 @@
+title: Trace Creation of Processes
+name: forktracker.stp
+version: 0.1
+author: Phil Muldoon at Red Hat
+keywords: process scheduler 
+subsystem: scheduler
+status: production
+exit: user-controlled
+output: trace
+scope: system-wide
+description: The forktracker.stp script prints out a time-stamped entry showing each fork and exec operation on the machine. This can be useful for determine what process is creating a flurry of short-lived processes.
+test_check: stap -p4 forktracker.stp
+test_installcheck: stap forkracker.stp -c "sleep 1"
diff --git a/testsuite/systemtap.examples/process/forktracker.stp b/testsuite/systemtap.examples/process/forktracker.stp
new file mode 100755
index 00000000..525aa0a5
--- /dev/null
+++ b/testsuite/systemtap.examples/process/forktracker.stp
@@ -0,0 +1,23 @@
+#! /usr/bin/env stap
+#
+# This is a stap script to monitor process creations (fork(), exec()'s).
+# Based off of stap script found: http://picobot.org/wordpress/?p=27
+# With some minor modifications (i.e. timestamping)
+# 
+# Usage: stap forktracker.stp
+#
+# Sample output:
+#
+# timestamp: process_name (pid) new_pid
+#
+# Version 0.1
+
+probe kprocess.create {
+  printf("%-25s: %s (%d) created %d\n",
+         ctime(gettimeofday_s()), execname(), pid(), new_pid)
+}
+
+probe kprocess.exec {
+  printf("%-25s: %s (%d) is exec'ing %s\n",
+         ctime(gettimeofday_s()), execname(), pid(), filename)
+}
diff --git a/testsuite/systemtap.printf/end1.exp b/testsuite/systemtap.printf/end1.exp
index 590340d3..ab1de590 100644
--- a/testsuite/systemtap.printf/end1.exp
+++ b/testsuite/systemtap.printf/end1.exp
@@ -11,15 +11,15 @@ if {[catch {exec mktemp -t staptestXXXXXX} tmpfile]} {
 }
 
 if {[catch {exec stap -o $tmpfile $tpath} res]} {
-    untested $TEST_NAME
-    puts "$res"
+    fail $TEST_NAME
+    puts "stap failed: $res"
     catch {exec rm -f $tmpfile}
     return
 }
 
 if {[catch {exec cmp $tmpfile $srcdir/$subdir/large_output} res]} {
-    fail $TEST_NAME
     puts "$res"
+    fail $TEST_NAME
     catch {exec rm -f $tmpfile}
     return
 }
diff --git a/testsuite/systemtap.printf/end1b.exp b/testsuite/systemtap.printf/end1b.exp
index bea5736e..46cdc9c7 100644
--- a/testsuite/systemtap.printf/end1b.exp
+++ b/testsuite/systemtap.printf/end1b.exp
@@ -16,8 +16,8 @@ if {[catch {exec mktemp -t staptestXXXXXX} tmpfile]} {
 }
 
 if {[catch {exec stap -b -o $tmpfile $test} res]} {
-    untested $TEST_NAME
     puts "stap failed: $res"
+    fail $TEST_NAME
     as_root "/bin/rm -f [glob ${tmpfile}*]"
     return
 }
diff --git a/testsuite/systemtap.printf/mixed_out.exp b/testsuite/systemtap.printf/mixed_out.exp
index 3b66e7c0..55320e80 100644
--- a/testsuite/systemtap.printf/mixed_out.exp
+++ b/testsuite/systemtap.printf/mixed_out.exp
@@ -11,8 +11,8 @@ if {[catch {exec mktemp -t staptestXXXXXX} tmpfile]} {
 }
 
 if {[catch {exec stap -DMAXACTION=100000 -o $tmpfile $tpath} res]} {
-    untested $TEST_NAME
-    puts "$res"
+    fail $TEST_NAME
+    puts "stap failed: $res"
     catch {exec rm -f $tmpfile}
     return
 }
diff --git a/testsuite/systemtap.printf/mixed_outb.exp b/testsuite/systemtap.printf/mixed_outb.exp
index db82cc79..c15520b1 100644
--- a/testsuite/systemtap.printf/mixed_outb.exp
+++ b/testsuite/systemtap.printf/mixed_outb.exp
@@ -16,7 +16,7 @@ if {[catch {exec mktemp -t staptestXXXXXX} tmpfile]} {
 }
 
 if {[catch {exec stap -DMAXACTION=100000 -b -o $tmpfile $test} res]} {
-    untested $TEST_NAME
+    fail $TEST_NAME
     puts "stap failed: $res"
     as_root "/bin/rm -f [glob ${tmpfile}*]"
     return
diff --git a/testsuite/systemtap.printf/out1.exp b/testsuite/systemtap.printf/out1.exp
index 7577a54d..f973ae00 100644
--- a/testsuite/systemtap.printf/out1.exp
+++ b/testsuite/systemtap.printf/out1.exp
@@ -11,7 +11,7 @@ if {[catch {exec mktemp -t staptestXXXXXX} tmpfile]} {
 }
 
 if {[catch {exec stap -o $tmpfile $tpath} res]} {
-    untested $TEST_NAME
+    fail $TEST_NAME
     puts "$res"
     catch {exec rm -f $tmpfile}
     return
diff --git a/testsuite/systemtap.printf/out1b.exp b/testsuite/systemtap.printf/out1b.exp
index c3e21ba9..24efbf4c 100644
--- a/testsuite/systemtap.printf/out1b.exp
+++ b/testsuite/systemtap.printf/out1b.exp
@@ -16,7 +16,7 @@ if {[catch {exec mktemp -t staptestXXXXXX} tmpfile]} {
 }
 
 if {[catch {exec stap -b -o $tmpfile $test} res]} {
-    untested $TEST_NAME
+    fail $TEST_NAME
     puts "stap failed: $res"
     as_root "/bin/rm -f [glob ${tmpfile}*]"
     return
diff --git a/testsuite/systemtap.printf/out2.exp b/testsuite/systemtap.printf/out2.exp
index ce1f7c6e..8c66e73d 100644
--- a/testsuite/systemtap.printf/out2.exp
+++ b/testsuite/systemtap.printf/out2.exp
@@ -11,7 +11,7 @@ if {[catch {exec mktemp -t staptestXXXXXX} tmpfile]} {
 }
 
 if {[catch {exec stap -o $tmpfile $tpath} res]} {
-    untested $TEST_NAME
+    fail $TEST_NAME
     puts "$res"
     catch {exec rm -f $tmpfile}
     return
diff --git a/testsuite/systemtap.printf/out2b.exp b/testsuite/systemtap.printf/out2b.exp
index fcc12f63..70a98ea2 100644
--- a/testsuite/systemtap.printf/out2b.exp
+++ b/testsuite/systemtap.printf/out2b.exp
@@ -16,7 +16,7 @@ if {[catch {exec mktemp -t staptestXXXXXX} tmpfile]} {
 }
 
 if {[catch {exec stap -b -o $tmpfile $test} res]} {
-    untested $TEST_NAME
+    fail $TEST_NAME
     puts "stap failed: $res"
     as_root "/bin/rm -f [glob ${tmpfile}*]"
     return
diff --git a/testsuite/systemtap.printf/out3.exp b/testsuite/systemtap.printf/out3.exp
index 51124757..63a67d8f 100644
--- a/testsuite/systemtap.printf/out3.exp
+++ b/testsuite/systemtap.printf/out3.exp
@@ -11,7 +11,7 @@ if {[catch {exec mktemp -t staptestXXXXXX} tmpfile]} {
 }
 
 if {[catch {exec stap -DMAXACTION=100000 -o $tmpfile $tpath} res]} {
-    untested $TEST_NAME
+    fail $TEST_NAME
     puts "$res"
     catch {exec rm -f $tmpfile}
     return
diff --git a/testsuite/systemtap.printf/out3b.exp b/testsuite/systemtap.printf/out3b.exp
index 740a8b68..d49625e9 100644
--- a/testsuite/systemtap.printf/out3b.exp
+++ b/testsuite/systemtap.printf/out3b.exp
@@ -16,7 +16,7 @@ if {[catch {exec mktemp -t staptestXXXXXX} tmpfile]} {
 }
 
 if {[catch {exec stap -DMAXACTION=100000 -b -o $tmpfile $test} res]} {
-    untested $TEST_NAME
+    fail $TEST_NAME
     puts "stap failed: $res"
     as_root "/bin/rm -f [glob ${tmpfile}*]"
     return