From 492d227f2caa558c4fdcd4e7aae65cf32b4549cc Mon Sep 17 00:00:00 2001
From: William Cohen <wcohen@redhat.com>
Date: Mon, 2 Feb 2009 11:18:01 -0500
Subject: Revise tcp_connections.stp example and place in sysemtap.examples
 directory.

---
 testsuite/systemtap.examples/index.html            |  3 ++
 testsuite/systemtap.examples/index.txt             | 10 +++++++
 testsuite/systemtap.examples/keyword-index.html    | 14 +++++++++-
 testsuite/systemtap.examples/keyword-index.txt     | 32 ++++++++++++++++++++++
 .../network/tcp_connections.meta                   | 13 +++++++++
 .../systemtap.examples/network/tcp_connections.stp | 14 ++++++++++
 6 files changed, 85 insertions(+), 1 deletion(-)
 create mode 100644 testsuite/systemtap.examples/network/tcp_connections.meta
 create mode 100644 testsuite/systemtap.examples/network/tcp_connections.stp

(limited to 'testsuite/systemtap.examples')

diff --git a/testsuite/systemtap.examples/index.html b/testsuite/systemtap.examples/index.html
index 87a5a50e..3395edca 100644
--- a/testsuite/systemtap.examples/index.html
+++ b/testsuite/systemtap.examples/index.html
@@ -76,6 +76,9 @@ keywords: <a href="keyword-index.html#NETWORK">NETWORK</a> <a href="keyword-inde
 <li><a href="network/socket-trace.stp">network/socket-trace.stp</a> - Trace Functions called in Network Socket Code<br>
 keywords: <a href="keyword-index.html#NETWORK">NETWORK</a> <a href="keyword-index.html#SOCKET">SOCKET</a> <br>
 <p>The script instrument each of the functions inn the Linux kernel's net/socket.c file. The script prints out trace. The first element of a line is  time delta in microseconds from the previous entry. This is followed by the command name and the PID. The "->" and "<-" indicates function entry and  function exit, respectively. The last element of the line is the function name.</p></li>
+<li><a href="network/tcp_connections.stp">network/tcp_connections.stp</a> - Track Creation of Incoming TCP Connections<br>
+keywords: <a href="keyword-index.html#NETWORK">NETWORK</a> <a href="keyword-index.html#TCP">TCP</a> <a href="keyword-index.html#SOCKET">SOCKET</a> <br>
+<p>The tcp_connections.stp script prints information for each new incoming TCP connection accepted by the computer. The information includes the UID, the command accepting the connection, the PID of the command, the port the connection is on, and the IP address of the originator of the request.</p></li>
 <li><a href="process/futexes.stp">process/futexes.stp</a> - System-Wide Futex Contention<br>
 keywords: <a href="keyword-index.html#SYSCALL">SYSCALL</a> <a href="keyword-index.html#LOCKING">LOCKING</a> <a href="keyword-index.html#FUTEX">FUTEX</a> <br>
 <p>The script watches the futex syscall on the system. On exit the futexes address, the number of contentions, and the average time for each contention on the futex are printed from lowest pid number to highest.</p></li>
diff --git a/testsuite/systemtap.examples/index.txt b/testsuite/systemtap.examples/index.txt
index 5ffc341a..ddf24471 100644
--- a/testsuite/systemtap.examples/index.txt
+++ b/testsuite/systemtap.examples/index.txt
@@ -109,6 +109,16 @@ keywords: network socket
   element of the line is the function name.
 
 
+network/tcp_connections.stp - Track Creation of Incoming TCP Connections
+keywords: network tcp socket
+
+  The tcp_connections.stp script prints information for each new
+  incoming TCP connection accepted by the computer. The information
+  includes the UID, the command accepting the connection, the PID of
+  the command, the port the connection is on, and the IP address of the
+  originator of the request.
+
+
 process/futexes.stp - System-Wide Futex Contention
 keywords: syscall locking futex
 
diff --git a/testsuite/systemtap.examples/keyword-index.html b/testsuite/systemtap.examples/keyword-index.html
index 9ff68c8d..6c367ad7 100644
--- a/testsuite/systemtap.examples/keyword-index.html
+++ b/testsuite/systemtap.examples/keyword-index.html
@@ -39,7 +39,7 @@
          	</ul>
 
 <h2>Examples by Keyword</h2>
-<p><tt><a href="#BACKTRACE">BACKTRACE</a> <a href="#CALLGRAPH">CALLGRAPH</a> <a href="#CPU">CPU</a> <a href="#DISK">DISK</a> <a href="#FUNCTIONS">FUNCTIONS</a> <a href="#FUTEX">FUTEX</a> <a href="#GRAPH">GRAPH</a> <a href="#INTERRUPT">INTERRUPT</a> <a href="#IO">IO</a> <a href="#LOCKING">LOCKING</a> <a href="#NETWORK">NETWORK</a> <a href="#PER-PROCESS">PER-PROCESS</a> <a href="#PROFILING">PROFILING</a> <a href="#READ">READ</a> <a href="#SCHEDULER">SCHEDULER</a> <a href="#SIGNALS">SIGNALS</a> <a href="#SIMPLE">SIMPLE</a> <a href="#SLEEP">SLEEP</a> <a href="#SOCKET">SOCKET</a> <a href="#SYSCALL">SYSCALL</a> <a href="#TIME">TIME</a> <a href="#TRACE">TRACE</a> <a href="#TRAFFIC">TRAFFIC</a> <a href="#USE">USE</a> <a href="#WAIT4">WAIT4</a> <a href="#WRITE">WRITE</a> </tt></p>
+<p><tt><a href="#BACKTRACE">BACKTRACE</a> <a href="#CALLGRAPH">CALLGRAPH</a> <a href="#CPU">CPU</a> <a href="#DISK">DISK</a> <a href="#FUNCTIONS">FUNCTIONS</a> <a href="#FUTEX">FUTEX</a> <a href="#GRAPH">GRAPH</a> <a href="#INTERRUPT">INTERRUPT</a> <a href="#IO">IO</a> <a href="#LOCKING">LOCKING</a> <a href="#NETWORK">NETWORK</a> <a href="#PER-PROCESS">PER-PROCESS</a> <a href="#PROFILING">PROFILING</a> <a href="#READ">READ</a> <a href="#SCHEDULER">SCHEDULER</a> <a href="#SIGNALS">SIGNALS</a> <a href="#SIMPLE">SIMPLE</a> <a href="#SLEEP">SLEEP</a> <a href="#SOCKET">SOCKET</a> <a href="#SYSCALL">SYSCALL</a> <a href="#TCP">TCP</a> <a href="#TIME">TIME</a> <a href="#TRACE">TRACE</a> <a href="#TRAFFIC">TRAFFIC</a> <a href="#USE">USE</a> <a href="#WAIT4">WAIT4</a> <a href="#WRITE">WRITE</a> </tt></p>
 <h3><a name="BACKTRACE">BACKTRACE</a></h3>
 <ul>
 <li><a href="interrupt/scf.stp">interrupt/scf.stp</a> - Tally Backtraces for Inter-Processor Interrupt (IPI)<br>
@@ -132,6 +132,9 @@ keywords: <a href="keyword-index.html#NETWORK">NETWORK</a> <a href="keyword-inde
 <li><a href="network/socket-trace.stp">network/socket-trace.stp</a> - Trace Functions called in Network Socket Code<br>
 keywords: <a href="keyword-index.html#NETWORK">NETWORK</a> <a href="keyword-index.html#SOCKET">SOCKET</a> <br>
 <p>The script instrument each of the functions inn the Linux kernel's net/socket.c file. The script prints out trace. The first element of a line is  time delta in microseconds from the previous entry. This is followed by the command name and the PID. The "->" and "<-" indicates function entry and  function exit, respectively. The last element of the line is the function name.</p></li>
+<li><a href="network/tcp_connections.stp">network/tcp_connections.stp</a> - Track Creation of Incoming TCP Connections<br>
+keywords: <a href="keyword-index.html#NETWORK">NETWORK</a> <a href="keyword-index.html#TCP">TCP</a> <a href="keyword-index.html#SOCKET">SOCKET</a> <br>
+<p>The tcp_connections.stp script prints information for each new incoming TCP connection accepted by the computer. The information includes the UID, the command accepting the connection, the PID of the command, the port the connection is on, and the IP address of the originator of the request.</p></li>
 </ul>
 <h3><a name="PER-PROCESS">PER-PROCESS</a></h3>
 <ul>
@@ -198,6 +201,9 @@ keywords: <a href="keyword-index.html#SYSCALL">SYSCALL</a> <a href="keyword-inde
 <li><a href="network/socket-trace.stp">network/socket-trace.stp</a> - Trace Functions called in Network Socket Code<br>
 keywords: <a href="keyword-index.html#NETWORK">NETWORK</a> <a href="keyword-index.html#SOCKET">SOCKET</a> <br>
 <p>The script instrument each of the functions inn the Linux kernel's net/socket.c file. The script prints out trace. The first element of a line is  time delta in microseconds from the previous entry. This is followed by the command name and the PID. The "->" and "<-" indicates function entry and  function exit, respectively. The last element of the line is the function name.</p></li>
+<li><a href="network/tcp_connections.stp">network/tcp_connections.stp</a> - Track Creation of Incoming TCP Connections<br>
+keywords: <a href="keyword-index.html#NETWORK">NETWORK</a> <a href="keyword-index.html#TCP">TCP</a> <a href="keyword-index.html#SOCKET">SOCKET</a> <br>
+<p>The tcp_connections.stp script prints information for each new incoming TCP connection accepted by the computer. The information includes the UID, the command accepting the connection, the PID of the command, the port the connection is on, and the IP address of the originator of the request.</p></li>
 </ul>
 <h3><a name="SYSCALL">SYSCALL</a></h3>
 <ul>
@@ -220,6 +226,12 @@ keywords: <a href="keyword-index.html#SYSCALL">SYSCALL</a> <br>
 keywords: <a href="keyword-index.html#SYSCALL">SYSCALL</a> <a href="keyword-index.html#WAIT4">WAIT4</a> <br>
 <p>The script watches each wait4 syscall on the system. At the end of each wait4 syscall the script prints out a line with a timestamp in microseconds, the pid, the executable name in paretheses, the "wait4:" key, the duration of the wait and the PID that the wait4 was waiting for. If the waited for PID is not specified , it is "-1".</p></li>
 </ul>
+<h3><a name="TCP">TCP</a></h3>
+<ul>
+<li><a href="network/tcp_connections.stp">network/tcp_connections.stp</a> - Track Creation of Incoming TCP Connections<br>
+keywords: <a href="keyword-index.html#NETWORK">NETWORK</a> <a href="keyword-index.html#TCP">TCP</a> <a href="keyword-index.html#SOCKET">SOCKET</a> <br>
+<p>The tcp_connections.stp script prints information for each new incoming TCP connection accepted by the computer. The information includes the UID, the command accepting the connection, the PID of the command, the port the connection is on, and the IP address of the originator of the request.</p></li>
+</ul>
 <h3><a name="TIME">TIME</a></h3>
 <ul>
 <li><a href="io/iotime.stp">io/iotime.stp</a> - Trace Time Spent in Read and Write for Files <br>
diff --git a/testsuite/systemtap.examples/keyword-index.txt b/testsuite/systemtap.examples/keyword-index.txt
index 0127f3a8..3cb0c3cf 100644
--- a/testsuite/systemtap.examples/keyword-index.txt
+++ b/testsuite/systemtap.examples/keyword-index.txt
@@ -204,6 +204,16 @@ keywords: network socket
   element of the line is the function name.
 
 
+network/tcp_connections.stp - Track Creation of Incoming TCP Connections
+keywords: network tcp socket
+
+  The tcp_connections.stp script prints information for each new
+  incoming TCP connection accepted by the computer. The information
+  includes the UID, the command accepting the connection, the PID of
+  the command, the port the connection is on, and the IP address of the
+  originator of the request.
+
+
 = PER-PROCESS =
 
 network/nettop.stp - Periodic Listing of Processes Using Network Interfaces
@@ -352,6 +362,16 @@ keywords: network socket
   element of the line is the function name.
 
 
+network/tcp_connections.stp - Track Creation of Incoming TCP Connections
+keywords: network tcp socket
+
+  The tcp_connections.stp script prints information for each new
+  incoming TCP connection accepted by the computer. The information
+  includes the UID, the command accepting the connection, the PID of
+  the command, the port the connection is on, and the IP address of the
+  originator of the request.
+
+
 = SYSCALL =
 
 io/iotime.stp - Trace Time Spent in Read and Write for Files 
@@ -415,6 +435,18 @@ keywords: syscall wait4
   waiting for. If the waited for PID is not specified , it is "-1".
 
 
+= TCP =
+
+network/tcp_connections.stp - Track Creation of Incoming TCP Connections
+keywords: network tcp socket
+
+  The tcp_connections.stp script prints information for each new
+  incoming TCP connection accepted by the computer. The information
+  includes the UID, the command accepting the connection, the PID of
+  the command, the port the connection is on, and the IP address of the
+  originator of the request.
+
+
 = TIME =
 
 io/iotime.stp - Trace Time Spent in Read and Write for Files 
diff --git a/testsuite/systemtap.examples/network/tcp_connections.meta b/testsuite/systemtap.examples/network/tcp_connections.meta
new file mode 100644
index 00000000..0bc9bcb1
--- /dev/null
+++ b/testsuite/systemtap.examples/network/tcp_connections.meta
@@ -0,0 +1,13 @@
+title: Track Creation of Incoming TCP Connections
+name: tcp_connections.stp
+version: 1.0
+author: anonymous
+keywords: network tcp socket
+subsystem: kernel
+status: production
+exit: user-controlled
+output: trace
+scope: system-wide
+description: The tcp_connections.stp script prints information for each new incoming TCP connection accepted by the computer. The information includes the UID, the command accepting the connection, the PID of the command, the port the connection is on, and the IP address of the originator of the request.
+test_check: stap -p4 tcp_connections.stp
+test_installcheck: stap tcp_connections.stp -c "sleep 1"
diff --git a/testsuite/systemtap.examples/network/tcp_connections.stp b/testsuite/systemtap.examples/network/tcp_connections.stp
new file mode 100644
index 00000000..bd2db76a
--- /dev/null
+++ b/testsuite/systemtap.examples/network/tcp_connections.stp
@@ -0,0 +1,14 @@
+#! /usr/bin/env stap
+
+probe begin {
+  printf("%6s %16s %6s %6s %16s\n",
+         "UID", "CMD", "PID", "PORT", "IP_SOURCE")
+}
+
+probe kernel.function("tcp_accept").return?,
+      kernel.function("inet_csk_accept").return? {
+  sock = $return
+  if (sock != 0)
+    printf("%6d %16s %6d %6d %16s\n", uid(), execname(), pid(),
+           inet_get_local_port(sock), inet_get_ip_source(sock))
+}
-- 
cgit