For the most part, SystemTap scripts are the foundation of each SystemTap session. The SystemTap scripts you use or write yourself instruct SystemTap on what type of information to trap, and what to do once that information is trapped. As stated in , SystemTap scripts are made up of two components: events and handlers. Once a SystemTap session is underway, SystemTap monitors the operating system for the specified events and executes the handlers as they occur. An event and its corresponding handler is collectively called a probe. A SystemTap script can have multiple probes, in the same manner that each event can have multiple corresponding handlers. In terms of application development, using events and handlers is similar to inserting print statements in a program's sequence of commands. These print statements allow you to view a history of commands executed once the program is run. SystemTap scripts go one step further by allowing you more flexibility with regard to handlers. Events serve as the triggers for handlers to run; handlers can be specified to trap specified data and print it in a certain manner.

SystemTap scripts use the following format: