// Copyright (C) 2006 IBM Corp. // // This file is part of systemtap, and is free software. You can // redistribute it and/or modify it under the terms of the GNU General // Public License (GPL); either version 2, or (at your option) any // later version. global usr_field_name, usr_evt_fmt global have_userevent %{ #define _MAXGROUPID 0xFF #define _MAXHOOKID 0xFF int get_fmtcode(char *fmt) { if(strncmp(fmt, "INT8", 4) != 0 && strncmp(fmt, "INT16", 5) != 0 && strncmp(fmt, "INT32", 5) != 0 && strncmp(fmt, "INT64", 5) != 0 && strncmp(fmt, "STRING", 6) != 0) return -1; else return 0; } void _register_event(int grpid, int hookid, int evt_type, char *fmt, char *names) { char in_fmt[512], in_name[512]; char *p_in_fmt, *p_in_name; char *_fmt, *name; _stp_pbuf * pb; int cpu = smp_processor_id(); char *total_length; p_in_fmt = in_fmt; p_in_name = in_name; if(!strncmp(fmt,"",1) && !strncmp(names,"",1)) { _lket_trace(_GROUP_REGEVT,evt_type,"%1b%1b",(_FMT_)grpid, (_FMT_)hookid); goto reg_epilogue; } if( grpid <= 0 || grpid > _MAXGROUPID || hookid <= 0 || hookid > _MAXHOOKID) { _stp_warn("register_event: wrong groupid/hookid, type: %d, grp:%d, hkid:%d\n", evt_type, grpid, hookid); _stp_exit(); } strncpy(in_fmt, fmt, 512); strncpy(in_name, names, 512); _fmt = strsep(&p_in_fmt, ":"); name = strsep(&p_in_name, ":"); while(_fmt!=NULL && name!=NULL) { if(get_fmtcode(_fmt) == -1) { _stp_warn("error in fmt string\n"); _stp_exit(); } _fmt = strsep(&p_in_fmt, ":"); name = strsep(&p_in_name, ":"); } if(_fmt!=NULL || name != NULL) { _stp_warn("unpaired types/names, grpid:%d, hookid:%d\n", grpid, hookid); _stp_exit(); } _lket_trace(_GROUP_REGEVT, evt_type, "%1b%1b%0s%0s", (_FMT_)grpid, (_FMT_)hookid, fmt, names); reg_epilogue: #if !defined(ASCII_TRACE) pb = per_cpu_ptr(Stp_pbuf, smp_processor_id()); total_length = &(pb->buf[0]); *(int16_t *)total_length = pb->len - 4; #endif _stp_print_flush(); } void _register_evt_desc(int grpid, int hookid, int evt_type, char *desc) { _stp_pbuf * pb; char *total_length; int cpu = smp_processor_id(); if(!strncmp(desc,"",1)) { _stp_warn("empty event description for grpid:%d, hookid:%d\n", grpid, hookid); _stp_exit(); } if( grpid <= 0 || grpid > _MAXGROUPID || hookid <= 0 || hookid > _MAXHOOKID) { _stp_warn("_register_evt_desc: wrong groupid/hookid, type: %d, event: %s, grp:%d, hkid:%d\n", evt_type, desc, grpid, hookid); _stp_exit(); _stp_exit(); } _lket_trace(_GROUP_REGEVT, evt_type, "%1b%1b%0s", (_FMT_)grpid, (_FMT_)hookid, desc); #if !defined(ASCII_TRACE) pb = per_cpu_ptr(Stp_pbuf, smp_processor_id()); total_length = &(pb->buf[0]); *(int16_t *)total_length = pb->len - 4; #endif _stp_print_flush(); } void _register_sys_event (char *event_desc, int grpid, int hookid, char *fmt, char *field_name) { _register_evt_desc(grpid, hookid, _HOOKID_REGEVTDESC, event_desc); _register_event(grpid, hookid, _HOOKID_REGSYSEVT, fmt, field_name); } %} function dummy_c_function() %{ %} function register_user_event(grpid:long, hookid:long,fmt:string, field_name:string) { usr_evt_fmt[grpid, hookid] = fmt usr_field_name[grpid, hookid] = field_name dummy_c_function() /* ensure register_user_event won't be compiled away */ } function write_events_desc() { if(have_userevent == 1) { foreach([grpid, hookid] in usr_evt_fmt) { register_event(grpid, hookid, HOOKID_REGUSREVT, usr_evt_fmt[grpid, hookid], usr_field_name[grpid, hookid]) } delete usr_field_name delete usr_evt_fmt } } function register_event(grpid:long, hookid:long, evt_type:long, fmt:string, names:string) %{ _register_event(THIS->grpid, THIS->hookid, THIS->evt_type, THIS->fmt, THIS->names); %} function register_sys_events() %{ _register_sys_event("syscall.entry", _GROUP_SYSCALL, _HOOKID_SYSCALL_ENTRY, "STRING", "syscall"); _register_sys_event("syscall.return", _GROUP_SYSCALL, _HOOKID_SYSCALL_RETURN, "STRING", "syscall"); _register_sys_event("process_snapshot", _GROUP_PROCESS, _HOOKID_PROCESS_SNAPSHOT, "INT32:INT32:INT32:STRING", "tid:pid:ppid:pname"); _register_sys_event("process.execve", _GROUP_PROCESS, _HOOKID_PROCESS_EXECVE, "INT32:INT32:INT32:STRING", "tid:pid:ppid:pname"); _register_sys_event("process.fork", _GROUP_PROCESS, _HOOKID_PROCESS_FORK, "INT32:INT32:INT32", "tid:pid:ppid"); _register_sys_event("process.exit.entry", _GROUP_PROCESS, _HOOKID_PROCESS_EXIT_ENTRY, "INT64", "code"); _register_sys_event("ioscheduler.elv_next_request.entry", _GROUP_IOSCHED, _HOOKID_IOSCHED_NEXT_REQ_ENTRY, "STRING", "elv_name"); _register_sys_event("ioscheduler.elv_next_request.return", _GROUP_IOSCHED, _HOOKID_IOSCHED_NEXT_REQ_RETURN, "INT8:INT8:INT64:INT64", "major:minor:req_addr:req_flags"); _register_sys_event("ioscheduler.elv_add_request", _GROUP_IOSCHED, _HOOKID_IOSCHED_ADD_REQ, "STRING:INT8:INT8:INT64:INT64", "elv_name:major:minor:request:req_flags"); _register_sys_event("ioscheduler.elv_completed_request", _GROUP_IOSCHED, _HOOKID_IOSCHED_COMPLETE_REQ, "STRING:INT8:INT8:INT64:INT64", "elv_name:major:minor:request:req_flags"); _register_sys_event("tskdispatch.ctxswitch", _GROUP_TASK, _HOOKID_TASK_CTXSWITCH, "INT32:INT32:INT8", "prev_pid:next_pid:prev_state"); _register_sys_event("tskdispatch.cpuidle", _GROUP_TASK, _HOOKID_TASK_CPUIDLE, "INT32", "cur_pid"); _register_sys_event("scsi.ioentry", _GROUP_SCSI, _HOOKID_SCSI_IOENTRY, "INT8:INT8:INT8:INT64", "major:minor:sdev_state:request_addr"); _register_sys_event("scsi.iodispatching", _GROUP_SCSI, _HOOKID_SCSI_IO_TO_LLD, "INT8:INT8:INT8:INT8:INT8:INT8:INT64:INT32:INT64", "host:channel:lun:dev_id:dev_state:data_dir:reqbuf_addr:reqbuf_len:request_addr"); _register_sys_event("scsi.iodone", _GROUP_SCSI, _HOOKID_SCSI_IODONE_BY_LLD, "INT8:INT8:INT8:INT8:INT8:INT8:INT64", "host:channel:lun:dev_id:dev_state:data_dir:request_addr"); _register_sys_event("scsi.iocompleted", _GROUP_SCSI, _HOOKID_SCSI_IOCOMP_BY_MIDLEVEL, "INT8:INT8:INT8:INT8:INT8:INT8:INT64:INT32", "host:channel:lun:dev_id:dev_state:data_dir:request_addr:done_bytes"); _register_sys_event("pagefault", _GROUP_PAGEFAULT, _HOOKID_PAGEFAULT, "INT64:INT8", "addr:write"); _register_sys_event("netdev.receive", _GROUP_NETDEV, _HOOKID_NETDEV_RECEIVE, "STRING:INT32:INT16:INT32", "dev_name:data_len:protocol:buff_size"); _register_sys_event("netdev.transmit", _GROUP_NETDEV, _HOOKID_NETDEV_TRANSMIT, "STRING:INT32:INT16:INT32", "dev_name:data_len:protocol:buff_size"); _register_sys_event("iosyscall.open.entry", _GROUP_IOSYSCALL, _HOOKID_IOSYSCALL_OPEN_ENTRY, "STRING:INT32:INT32", "filename:flags:mode"); _register_sys_event("iosyscall.open.return", _GROUP_IOSYSCALL, _HOOKID_IOSYSCALL_OPEN_RETURN, "INT64", "return"); _register_sys_event("iosyscall.close.entry", _GROUP_IOSYSCALL, _HOOKID_IOSYSCALL_CLOSE_ENTRY, "INT64", "fd"); _register_sys_event("iosyscall.close.return", _GROUP_IOSYSCALL, _HOOKID_IOSYSCALL_CLOSE_RETURN, "INT64", "return"); _register_sys_event("iosyscall.read.entry", _GROUP_IOSYSCALL, _HOOKID_IOSYSCALL_READ_ENTRY, "INT64:INT64:INT64", "fd:buff_addr:count"); _register_sys_event("iosyscall.read.return", _GROUP_IOSYSCALL, _HOOKID_IOSYSCALL_READ_RETURN, "INT64", "return"); _register_sys_event("iosyscall.write.entry", _GROUP_IOSYSCALL, _HOOKID_IOSYSCALL_WRITE_ENTRY, "INT64:INT64:INT64", "fd:buff_addr:count"); _register_sys_event("iosyscall.write.return", _GROUP_IOSYSCALL, _HOOKID_IOSYSCALL_WRITE_RETURN, "INT64", "return"); _register_sys_event("iosyscall.readv.entry", _GROUP_IOSYSCALL, _HOOKID_IOSYSCALL_READV_ENTRY, "INT64:INT64:INT64", "fd:vector_uaddr:count"); _register_sys_event("iosyscall.readv.return", _GROUP_IOSYSCALL, _HOOKID_IOSYSCALL_READV_RETURN, "INT64", "return"); _register_sys_event("iosyscall.writev.entry", _GROUP_IOSYSCALL, _HOOKID_IOSYSCALL_WRITEV_ENTRY, "INT64:INT64:INT64", "fd:vector_uaddr:count"); _register_sys_event("iosyscall.writev.return", _GROUP_IOSYSCALL, _HOOKID_IOSYSCALL_WRITEV_RETURN, "INT64", "return"); _register_sys_event("iosyscall.pread64.entry", _GROUP_IOSYSCALL, _HOOKID_IOSYSCALL_PREAD64_ENTRY, "INT64:INT64:INT64:INT64", "fd:buff_uaddr:count:offset"); _register_sys_event("iosyscall.pread64.return", _GROUP_IOSYSCALL, _HOOKID_IOSYSCALL_PREAD64_RETURN, "INT64", "return"); _register_sys_event("iosyscall.pwrite64.entry", _GROUP_IOSYSCALL, _HOOKID_IOSYSCALL_PWRITE64_ENTRY, "INT64:INT64:INT64:INT64", "fd:buff_uaddr:count:offset"); _register_sys_event("iosyscall.pwrite64.return", _GROUP_IOSYSCALL, _HOOKID_IOSYSCALL_PWRITE64_RETURN, "INT64", "return"); _register_sys_event("iosyscall.readahead.entry", _GROUP_IOSYSCALL, _HOOKID_IOSYSCALL_READAHEAD_ENTRY, "INT64:INT64:INT64", "fd:offset:count"); _register_sys_event("iosyscall.readahead.return", _GROUP_IOSYSCALL, _HOOKID_IOSYSCALL_READAHEAD_RETURN, "INT64", "return"); _register_sys_event("iosyscall.sendfile.entry", _GROUP_IOSYSCALL, _HOOKID_IOSYSCALL_SENDFILE_ENTRY, "INT64:INT64:INT64:INT64", "out_fd:in_fd:offset_uaddr:count"); _register_sys_event("iosyscall.sendfile.return", _GROUP_IOSYSCALL, _HOOKID_IOSYSCALL_SENDFILE_RETURN, "INT64", "return"); _register_sys_event("iosyscall.lseek.entry", _GROUP_IOSYSCALL, _HOOKID_IOSYSCALL_LSEEK_ENTRY, "INT64:INT64:INT8", "fd:offset:whence"); _register_sys_event("iosyscall.lseek.return", _GROUP_IOSYSCALL, _HOOKID_IOSYSCALL_LSEEK_RETURN, "INT64", "return"); _register_sys_event("iosyscall.llseek.entry", _GROUP_IOSYSCALL, _HOOKID_IOSYSCALL_LLSEEK_ENTRY, "INT64:INT64:INT64:INT64:INT8b", "fd:offset_high:offset_low:result_uaddr:whence"); _register_sys_event("iosyscall.llseek.return", _GROUP_IOSYSCALL, _HOOKID_IOSYSCALL_LLSEEK_RETURN, "INT64", "return"); _register_sys_event("iosyscall.sync.entry", _GROUP_IOSYSCALL, _HOOKID_IOSYSCALL_SYNC_ENTRY, "", ""); _register_sys_event("iosyscall.sync.return", _GROUP_IOSYSCALL, _HOOKID_IOSYSCALL_SYNC_RETURN, "INT64", "return"); _register_sys_event("iosyscall.fsync.entry", _GROUP_IOSYSCALL, _HOOKID_IOSYSCALL_FSYNC_ENTRY, "INT64", "fd"); _register_sys_event("iosyscall.fsync.return", _GROUP_IOSYSCALL, _HOOKID_IOSYSCALL_FSYNC_RETURN, "INT64", "return"); _register_sys_event("iosyscall.fdatasync.entry", _GROUP_IOSYSCALL, _HOOKID_IOSYSCALL_FDATASYNC_ENTRY, "INT64", "fd"); _register_sys_event("iosyscall.fdatasync.return", _GROUP_IOSYSCALL, _HOOKID_IOSYSCALL_FDATASYNC_RETURN, "INT64", "return"); _register_sys_event("iosyscall.flock.entry", _GROUP_IOSYSCALL, _HOOKID_IOSYSCALL_FLOCK_ENTRY, "INT64:INT32", "fd:operation"); _register_sys_event("iosyscall.flock.return", _GROUP_IOSYSCALL, _HOOKID_IOSYSCALL_FLOCK_RETURN, "INT64", "return"); _register_sys_event("aio.io_setup.entry", _GROUP_AIO, _HOOKID_AIO_IO_SETUP_ENTRY, "INT32:INT64", "nr_events:ctxp_uaddr"); _register_sys_event("aio.io_setup.return", _GROUP_AIO, _HOOKID_AIO_IO_SETUP_RETURN, "INT64", "return"); _register_sys_event("aio.io_submit.entry", _GROUP_AIO, _HOOKID_AIO_IO_SUBMIT_ENTRY, "INT64:INT32:INT64", "ctx_id:nr:iocbpp_uaddr"); _register_sys_event("aio.io_submit.return", _GROUP_AIO, _HOOKID_AIO_IO_SUBMIT_RETURN, "INT64", "return"); _register_sys_event("aio.io_submit_one.entry", _GROUP_AIO, _HOOKID_AIO_IO_SUBMIT_ONE_ENTRY, "INT64:INT64:INT16:INT16:INT32:INT64:INT64:INT64", "ctx:user_iocb_uaddr:aio_lio_opcode:aio_reqprio:aio_fildes:aio_buf:aio_nbytes:aio_offset"); _register_sys_event("aio.io_submit_one.return", _GROUP_AIO, _HOOKID_AIO_IO_SUBMIT_ONE_RETURN, "INT64", "return"); _register_sys_event("aio.io_destroy.entry", _GROUP_AIO, _HOOKID_AIO_IO_DESTROY_ENTRY, "INT64", "ctx"); _register_sys_event("aio.io_destroy.return", _GROUP_AIO, _HOOKID_AIO_IO_DESTROY_RETURN, "INT64", "return"); _register_sys_event("aio.io_getevents.entry", _GROUP_AIO, _HOOKID_AIO_IO_GETEVENTS_ENTRY, "INT64:INT32:INT32:INT64:INT32:INT32", "ctx_id:min_nr:nr:events_uaddr:tv_sec:tv_nsec"); _register_sys_event("aio.io_getevents.return", _GROUP_AIO, _HOOKID_AIO_IO_GETEVENTS_RETURN, "INT64", "return"); _register_sys_event("aio.io_cancel.entry", _GROUP_AIO, _HOOKID_AIO_IO_CANCEL_ENTRY, "INT64:INT64:INT64", "ctx_id:iocb_uaddr:result_uaddr"); _register_sys_event("aio.io_cancel.return", _GROUP_AIO, _HOOKID_AIO_IO_CANCEL_RETURN, "INT64", "return"); _register_sys_event("signal.send.entry", _GROUP_SIGNAL, _HOOKID_SIGNAL_SEND_ENTRY, "INT8:INT8:INT8:INT32", "sig:shared:send2queue:pid"); _register_sys_event("signal.send.return", _GROUP_SIGNAL, _HOOKID_SIGNAL_SEND_RETURN, "INT8", "return"); _register_sys_event("signal.syskill.entry", _GROUP_SIGNAL, _HOOKID_SIGNAL_SYSKILL_ENTRY, "INT32:INT8", "pid:sig"); _register_sys_event("signal.syskill.return", _GROUP_SIGNAL, _HOOKID_SIGNAL_SYSKILL_RETURN, "INT8", "return"); _register_sys_event("signal.systgkill.entry", _GROUP_SIGNAL, _HOOKID_SIGNAL_SYSTGKILL_ENTRY, "INT32:INT32:INT8", "tid:pid:sig"); _register_sys_event("signal.systgkill.return", _GROUP_SIGNAL, _HOOKID_SIGNAL_SYSTGKILL_RETURN, "INT8", "return"); _register_sys_event("signal.systkill.entry", _GROUP_SIGNAL, _HOOKID_SIGNAL_SYSTKILL_ENTRY, "INT32:INT8", "pid:sig"); _register_sys_event("signal.systkill.return", _GROUP_SIGNAL, _HOOKID_SIGNAL_SYSTKILL_RETURN, "INT8", "return"); _register_sys_event("signal.pending.entry", _GROUP_SIGNAL, _HOOKID_SIGNAL_PENDING_ENTRY, "INT32:INT32", "sigset_addr:setsize");; _register_sys_event("signal.pending.return", _GROUP_SIGNAL, _HOOKID_SIGNAL_PENDING_RETURN, "INT8", "return"); _register_sys_event("signal.do_action.entry", _GROUP_SIGNAL, _HOOKID_SIGNAL_DOACTION_ENTRY, "INT8:INT64", "sig:handler"); _register_sys_event("signal.do_action.return", _GROUP_SIGNAL, _HOOKID_SIGNAL_DOACTION_RETURN, "INT16", "return"); _register_sys_event("signal.procmask.entry", _GROUP_SIGNAL, _HOOKID_SIGNAL_PROC_MASK_ENTRY, "INT8:INT64", "how:sigset"); _register_sys_event("signal.procmask.return", _GROUP_SIGNAL, _HOOKID_SIGNAL_PROC_MASK_RETURN, "INT8", "return"); _register_sys_event("signal.flush.entry", _GROUP_SIGNAL, _HOOKID_SIGNAL_FLUSH_ENTRY, "INT32", "pid"); _register_sys_event("sunrpc.clnt.create_client.entry", _GROUP_SUNRPC, _HOOKID_SUNRPC_CLNT_CREATE_CLIENT_ENTRY, "STRING:INT64:INT8:INT16:INT16:INT8", "server:prog:vers:prot:port:authflavor"); _register_sys_event("sunrpc.clnt.create_client.return", _GROUP_SUNRPC, _HOOKID_SUNRPC_CLNT_CREATE_CLIENT_RETURN, "INT64", "return"); _register_sys_event("sunrpc.clnt.clone_client.entry", _GROUP_SUNRPC, _HOOKID_SUNRPC_CLNT_CLONE_CLIENT_ENTRY, "STRING:INT64:INT8:INT16:INT16:INT8", "server:prog:vers:prot:port:authflavor"); _register_sys_event("sunrpc.clnt.clone_client.return", _GROUP_SUNRPC, _HOOKID_SUNRPC_CLNT_CLONE_CLIENT_RETURN, "INT64", "return"); _register_sys_event("sunrpc.clnt.shutdown_client.entry", _GROUP_SUNRPC, _HOOKID_SUNRPC_CLNT_SHUTDOWN_CLIENT_ENTRY, "STRING:INT64:INT16:INT16:INT32", "server:prog:clones:tasks:rpccount"); _register_sys_event("sunrpc.clnt.shutdown_client.return", _GROUP_SUNRPC, _HOOKID_SUNRPC_CLNT_SHUTDOWN_CLIENT_RETURN, "INT8", "void"); _register_sys_event("sunrpc.clnt.bind_new_program.entry", _GROUP_SUNRPC, _HOOKID_SUNRPC_CLNT_BIND_NEW_PROGRAM_ENTRY, "STRING:INT64:INT8:INT64:INT8", "server:old_prog:old_vers:new_prog:new_vers"); _register_sys_event("sunrpc.clnt.bind_new_program.return", _GROUP_SUNRPC, _HOOKID_SUNRPC_CLNT_BIND_NEW_PROGRAM_RETURN, "INT64", "return"); _register_sys_event("sunrpc.clnt.call_sync.entry", _GROUP_SUNRPC, _HOOKID_SUNRPC_CLNT_CALL_SYNC_ENTRY, "STRING:INT64:INT8:INT64:INT64", "server:prog:vers:proc:flags"); _register_sys_event("sunrpc.clnt.call_sync.return", _GROUP_SUNRPC, _HOOKID_SUNRPC_CLNT_CALL_SYNC_RETURN, "INT64", "return"); _register_sys_event("sunrpc.clnt.call_async.entry", _GROUP_SUNRPC, _HOOKID_SUNRPC_CLNT_CALL_ASYNC_ENTRY, "STRING:INT64:INT8:INT64:INT64", "server:prog:vers:proc:flags"); _register_sys_event("sunrpc.clnt.call_async.return", _GROUP_SUNRPC, _HOOKID_SUNRPC_CLNT_CALL_ASYNC_RETURN, "INT64", "return"); _register_sys_event("sunrpc.clnt.restart_call.entry", _GROUP_SUNRPC, _HOOKID_SUNRPC_CLNT_RESTART_CALL_ENTRY, "INT64:INT64", "tk_pid:tk_flags"); _register_sys_event("sunrpc.clnt.restart_call.return", _GROUP_SUNRPC, _HOOKID_SUNRPC_CLNT_RESTART_CALL_RETURN, "INT8", "void"); _register_sys_event("sunrpc.svc.register.entry", _GROUP_SUNRPC, _HOOKID_SUNRPC_SVC_REGISTER_ENTRY, "STRING:INT64:INT16:INT32", "service:program:protocol:prot"); _register_sys_event("sunrpc.svc.register.return", _GROUP_SUNRPC, _HOOKID_SUNRPC_SVC_REGISTER_RETURN, "INT64", "return"); _register_sys_event("sunrpc.svc.create.entry", _GROUP_SUNRPC, _HOOKID_SUNRPC_SVC_CREATE_ENTRY, "INT64:INT8:INT32", "prog:nvers:bufsize"); _register_sys_event("sunrpc.svc.create.return", _GROUP_SUNRPC, _HOOKID_SUNRPC_SVC_CREATE_RETURN, "INT64", "return"); _register_sys_event("sunrpc.svc.destroy.entry", _GROUP_SUNRPC, _HOOKID_SUNRPC_SVC_DESTROY_ENTRY, "STRING:INT64:INT32", "service:program:num_threads"); _register_sys_event("sunrpc.svc.destroy.return", _GROUP_SUNRPC, _HOOKID_SUNRPC_SVC_DESTROY_RETURN, "INT8", "void"); _register_sys_event("sunrpc.svc.process.entry", _GROUP_SUNRPC, _HOOKID_SUNRPC_SVC_PROCESS_ENTRY, "STRING:INT64:INT64:INT64:INT64:INT8:INT8", "service:sv_prog:peer_ip:rq_xid:rq_prog:rq_vers:rq_proc"); _register_sys_event("sunrpc.svc.process.return", _GROUP_SUNRPC, _HOOKID_SUNRPC_SVC_PROCESS_RETURN, "INT64", "return"); _register_sys_event("sunrpc.svc.authorise.entry", _GROUP_SUNRPC, _HOOKID_SUNRPC_SVC_AUTHORISE_ENTRY, "STRING:INT64:INT64:INT64:INT8:INT64", "service:peer_ip:xid:prog:vers:proc"); _register_sys_event("sunrpc.svc.authorise.return", _GROUP_SUNRPC, _HOOKID_SUNRPC_SVC_AUTHORISE_RETURN, "INT64", "return"); _register_sys_event("sunrpc.svc.send.entry", _GROUP_SUNRPC, _HOOKID_SUNRPC_SVC_SEND_ENTRY, "STRING:INT64:INT64:INT64:INT8:INT64", "sv_name:peer_ip:xid:prog:vers:proc"); _register_sys_event("sunrpc.svc.send.return", _GROUP_SUNRPC, _HOOKID_SUNRPC_SVC_SEND_RETURN, "INT64", "return"); _register_sys_event("sunrpc.svc.recv.entry", _GROUP_SUNRPC, _HOOKID_SUNRPC_SVC_RECV_ENTRY, "STRING:INT64", "sv_name:timeout"); _register_sys_event("sunrpc.svc.recv.return", _GROUP_SUNRPC, _HOOKID_SUNRPC_SVC_RECV_RETURN, "INT64", "return"); _register_sys_event("sunrpc.svc.drop.entry", _GROUP_SUNRPC, _HOOKID_SUNRPC_SVC_DROP_ENTRY, "STRING:INT64:INT64:INT64:INT8:INT64", "sv_name:peer_ip:xid:prog:vers:proc"); _register_sys_event("sunrpc.svc.drop.return", _GROUP_SUNRPC, _HOOKID_SUNRPC_SVC_DROP_RETURN, "INT8", "void"); _register_sys_event("sunrpc.sched.new_task.entry", _GROUP_SUNRPC, _HOOKID_SUNRPC_SCHED_NEW_TASK_ENTRY, "INT64:INT64:INT8:INT64:INT64", "xid:prog:vers:prot:flags"); _register_sys_event("sunrpc.sched.new_task.return", _GROUP_SUNRPC, _HOOKID_SUNRPC_SCHED_NEW_TASK_RETURN, "INT64", "return"); _register_sys_event("sunrpc.sched.release_task.entry", _GROUP_SUNRPC, _HOOKID_SUNRPC_SCHED_RELEASE_TASK_ENTRY, "INT64:INT64:INT8:INT64:INT64", "xid:prog:vers:prot:flags"); _register_sys_event("sunrpc.sched.release_task.return", _GROUP_SUNRPC, _HOOKID_SUNRPC_SCHED_RELEASE_TASK_RETURN, "INT8", "void"); _register_sys_event("sunrpc.sched.execute.entry", _GROUP_SUNRPC, _HOOKID_SUNRPC_SCHED_EXECUTE_ENTRY, "INT64:INT64:INT8:INT64:INT64:INT64", "xid:prog:vers:prot:tk_pid:tk_flags"); _register_sys_event("sunrpc.sched.execute.return", _GROUP_SUNRPC, _HOOKID_SUNRPC_SCHED_EXECUTE_RETURN, "INT64", "return"); _register_sys_event("sunrpc.sched.delay.entry", _GROUP_SUNRPC, _HOOKID_SUNRPC_SCHED_DELAY_ENTRY, "INT64:INT64:INT64:INT64:INT64", "xid:prog:tk_pid:tk_flags:delay"); _register_sys_event("sunrpc.sched.delay.return", _GROUP_SUNRPC, _HOOKID_SUNRPC_SCHED_DELAY_RETURN, "INT8", "void"); _register_sys_event("cpu_freq", _GROUP_CPUFREQ, _HOOKID_SWITCH_CPUFREQ, "INT64", "cpufreq"); _register_sys_event("nfs.fop.llseek.entry", _GROUP_NFS, _HOOKID_NFS_FOP_LLSEEK_ENTRY, "INT8:INT8:INT64:INT64:INT8", "major:minor:ino:offset:origin"); _register_sys_event("nfs.fop.llseek.return", _GROUP_NFS, _HOOKID_NFS_FOP_LLSEEK_RETURN, "INT32","return"); _register_sys_event("nfs.fop.read.entry", _GROUP_NFS, _HOOKID_NFS_FOP_READ_ENTRY, "INT8:INT8:INT64:INT64:INT64:INT64", "major:minor:ino:buf:len:pos"); _register_sys_event("nfs.fop.read.return", _GROUP_NFS, _HOOKID_NFS_FOP_READ_RETURN, "INT32","return"); _register_sys_event("nfs.fop.write.entry", _GROUP_NFS, _HOOKID_NFS_FOP_WRITE_ENTRY, "INT8:INT8:INT64:INT64:INT64:INT64", "major:minor:ino:buf:len:pos"); _register_sys_event("nfs.fop.write.return", _GROUP_NFS, _HOOKID_NFS_FOP_WRITE_RETURN, "INT32","return"); _register_sys_event("nfs.fop.aio_read.entry", _GROUP_NFS, _HOOKID_NFS_FOP_AIOREAD_ENTRY, "INT8:INT8:INT64:INT64:INT64:INT64", "major:minor:ino:buf:len:pos"); _register_sys_event("nfs.fop.aio_read.return", _GROUP_NFS, _HOOKID_NFS_FOP_AIOREAD_RETURN, "INT32","return"); _register_sys_event("nfs.fop.aio_write.entry", _GROUP_NFS, _HOOKID_NFS_FOP_AIOWRITE_ENTRY, "INT8:INT8:INT64:INT64:INT64:INT64", "major:minor:ino:buf:len:pos"); _register_sys_event("nfs.fop.aio_write.return", _GROUP_NFS, _HOOKID_NFS_FOP_AIOWRITE_RETURN, "INT32","return"); _register_sys_event("nfs.fop.mmap.entry", _GROUP_NFS, _HOOKID_NFS_FOP_MMAP_ENTRY, "INT8:INT8:INT64:INT64:INT64:INT32", "major:minor:ino:vm_start:vm_end:vm_flags"); _register_sys_event("nfs.fop.mmap.return", _GROUP_NFS, _HOOKID_NFS_FOP_MMAP_RETURN, "INT32","return"); _register_sys_event("nfs.fop.open.entry", _GROUP_NFS, _HOOKID_NFS_FOP_OPEN_ENTRY, "INT8:INT8:INT64:INT32:STRING", "major:minor:ino:flag:filename"); _register_sys_event("nfs.fop.open.return", _GROUP_NFS, _HOOKID_NFS_FOP_OPEN_RETURN, "INT32","return"); _register_sys_event("nfs.fop.flush.entry", _GROUP_NFS, _HOOKID_NFS_FOP_FLUSH_ENTRY, "INT8:INT8:INT64:INT32", "major:minor:ino:ndirty"); _register_sys_event("nfs.fop.flush.return", _GROUP_NFS, _HOOKID_NFS_FOP_FLUSH_RETURN, "INT32","return"); _register_sys_event("nfs.fop.release.entry", _GROUP_NFS, _HOOKID_NFS_FOP_RELEASE_ENTRY, "INT8:INT8:INT64:INT16", "major:minor:ino:mode"); _register_sys_event("nfs.fop.release.return", _GROUP_NFS, _HOOKID_NFS_FOP_RELEASE_RETURN, "INT32","return"); _register_sys_event("nfs.fop.fsync.entry", _GROUP_NFS, _HOOKID_NFS_FOP_FSYNC_ENTRY, "INT8:INT8:INT64:INT32", "major:minor:ino:ndirty"); _register_sys_event("nfs.fop.fsync.return", _GROUP_NFS, _HOOKID_NFS_FOP_FSYNC_RETURN, "INT32","return"); _register_sys_event("nfs.fop.lock.entry", _GROUP_NFS, _HOOKID_NFS_FOP_LOCK_ENTRY, "INT8:INT8:INT64:INT64:INT64:INT8:INT8:INT32", "major:minor:ino:fl_start:fl_end:fl_type:fl_flag:cmd"); _register_sys_event("nfs.fop.lock.return", _GROUP_NFS, _HOOKID_NFS_FOP_LOCK_RETURN, "INT32","return"); _register_sys_event("nfs.fop.sendfile.entry", _GROUP_NFS, _HOOKID_NFS_FOP_SENDFILE_ENTRY, "INT8:INT8:INT64:INT64:INT64", "major:minor:ino:count:pos"); _register_sys_event("nfs.fop.sendfile.return", _GROUP_NFS, _HOOKID_NFS_FOP_SENDFILE_RETURN, "INT32","return"); _register_sys_event("nfs.fop.check_flags.entry", _GROUP_NFS, _HOOKID_NFS_FOP_CHECKFLAGS_ENTRY, "INT32","flag"); ////TODO unable to resovle $return _register_sys_event("nfs.fop.check_flags.return", _GROUP_NFS, _HOOKID_NFS_FOP_CHECKFLAGS_RETURN, "INT32","return"); _register_sys_event("nfs.aop.readpage.entry", _GROUP_NFS, _HOOKID_NFS_AOP_READPAGE_ENTRY, "INT64:INT32:INT64:INT64", "ino:rsize:__page:page_index"); _register_sys_event("nfs.aop.readpage.return", _GROUP_NFS, _HOOKID_NFS_AOP_READPAGE_RETURN, "INT32","return"); _register_sys_event("nfs.aop.readpages.entry", _GROUP_NFS, _HOOKID_NFS_AOP_READPAGES_ENTRY, "INT64:INT32:INT32", "ino:rpages:nr_pages"); _register_sys_event("nfs.aop.readpages.return", _GROUP_NFS, _HOOKID_NFS_AOP_READPAGES_RETURN, "INT32","return"); _register_sys_event("nfs.aop.writepage.entry", _GROUP_NFS, _HOOKID_NFS_AOP_WRITEPAGE_ENTRY, "INT64:INT32:INT64:INT64", "ino:wsize:__page:page_index"); _register_sys_event("nfs.aop.writepage.return", _GROUP_NFS, _HOOKID_NFS_AOP_WRITEPAGE_RETURN, "INT32","return"); _register_sys_event("nfs.aop.writepages.entry", _GROUP_NFS, _HOOKID_NFS_AOP_WRITEPAGES_ENTRY, "INT64:INT32:INT64", "ino:wpages:nr_to_write"); _register_sys_event("nfs.aop.writepages.return", _GROUP_NFS, _HOOKID_NFS_AOP_WRITEPAGES_RETURN, "INT32","return"); _register_sys_event("nfs.aop.prepare_write.entry", _GROUP_NFS, _HOOKID_NFS_AOP_PREPAREWRITE_ENTRY, "INT64:INT64:INT64", "ino:__page:page_index"); _register_sys_event("nfs.aop.prepare_write.return", _GROUP_NFS, _HOOKID_NFS_AOP_PREPAREWRITE_RETURN, "INT32","return"); _register_sys_event("nfs.aop.commit_write.entry", _GROUP_NFS, _HOOKID_NFS_AOP_COMMITWRITE_ENTRY, "INT64:INT64:INT64:INT32:INT32", "ino:__page:page_index:offset:count"); _register_sys_event("nfs.aop.commit_write.return", _GROUP_NFS, _HOOKID_NFS_AOP_COMMITWRITE_RETURN, "INT32","return"); _register_sys_event("nfs.aop.set_page_dirty.entry", _GROUP_NFS, _HOOKID_NFS_AOP_SETPAGEDIRTY_ENTRY, "INT64:INT8", "__page:page_flag"); _register_sys_event("nfs.aop.set_page_dirty.return", _GROUP_NFS, _HOOKID_NFS_AOP_SETPAGEDIRTY_RETURN, "INT32","return"); _register_sys_event("nfs.aop.release_page.entry", _GROUP_NFS, _HOOKID_NFS_AOP_RELEASEPAGE_ENTRY, "INT64:INT64", "__page:page_index"); _register_sys_event("nfs.aop.release_page.return", _GROUP_NFS, _HOOKID_NFS_AOP_RELEASEPAGE_RETURN, "INT32","return"); _register_sys_event("nfs.proc.lookup.entry", _GROUP_NFS, _HOOKID_NFS_PROC_LOOKUP_ENTRY, "INT8:INT8:INT64:INT8:STRING", "major_device:minor_device:fileid:version:filename"); _register_sys_event("nfs.proc.lookup.return", _GROUP_NFS, _HOOKID_NFS_PROC_LOOKUP_RETURN, "INT32","return"); _register_sys_event("nfs.proc.read.entry", _GROUP_NFS, _HOOKID_NFS_PROC_READ_ENTRY, "INT8:INT8:INT64:INT8:INT32:INT64", "major_device:minor_device:fileid:version:count:offset"); _register_sys_event("nfs.proc.read.return", _GROUP_NFS, _HOOKID_NFS_PROC_READ_RETURN, "INT32","return"); _register_sys_event("nfs.proc.write.entry", _GROUP_NFS, _HOOKID_NFS_PROC_WRITE_ENTRY, "INT8:INT8:INT64:INT8:INT32:INT64", "major_device:minor_device:fileid:version:count:offset"); _register_sys_event("nfs.proc.write.return", _GROUP_NFS, _HOOKID_NFS_PROC_WRITE_RETURN, "INT32","return"); _register_sys_event("nfs.proc.commit.entry", _GROUP_NFS, _HOOKID_NFS_PROC_COMMIT_ENTRY, "INT8:INT8:INT64:INT8:INT32:INT64", "major_device:minor_device:fileid:version:count:offset"); _register_sys_event("nfs.proc.commit.return", _GROUP_NFS, _HOOKID_NFS_PROC_COMMIT_RETURN, "INT32","return"); _register_sys_event("nfs.proc.read_setup.entry", _GROUP_NFS, _HOOKID_NFS_PROC_READSETUP_ENTRY, "INT8:INT8:INT64:INT8:INT32:INT64", "major_device:minor_device:fileid:version:count:offset"); _register_sys_event("nfs.proc.write_setup.entry", _GROUP_NFS, _HOOKID_NFS_PROC_WRITESETUP_ENTRY, "INT8:INT8:INT64:INT8:INT8:INT32:INT64", "major_device:minor_device:fileid:version:how:count:offset"); _register_sys_event("nfs.proc.commit_setup.entry", _GROUP_NFS, _HOOKID_NFS_PROC_COMMITSETUP_ENTRY, "INT8:INT8:INT64:INT8:INT32:INT64", "major_device:minor_device:fileid:version:count:offset"); _register_sys_event("nfs.proc.read_done.entry", _GROUP_NFS, _HOOKID_NFS_PROC_READDONE_ENTRY, "INT8:INT8:INT64:INT8:INT32:INT32", "major_device:minor_device:fileid:version:status:count"); _register_sys_event("nfs.proc.read_done.return", _GROUP_NFS, _HOOKID_NFS_PROC_READDONE_RETURN, "INT32","return"); _register_sys_event("nfs.proc.write_done.entry", _GROUP_NFS, _HOOKID_NFS_PROC_WRITEDONE_ENTRY, "INT8:INT8:INT64:INT8:INT32:INT32", "major_device:minor_device:fileid:version:status:count"); _register_sys_event("nfs.proc.write_done.return", _GROUP_NFS, _HOOKID_NFS_PROC_WRITEDONE_RETURN, "INT32","return"); _register_sys_event("nfs.proc.commit_done.entry", _GROUP_NFS, _HOOKID_NFS_PROC_COMMITDONE_ENTRY, "INT8:INT8:INT64:INT8:INT32:INT32", "major_device:minor_device:fileid:version:status:count"); _register_sys_event("nfs.proc.commit_done.return", _GROUP_NFS, _HOOKID_NFS_PROC_COMMITDONE_RETURN, "INT32","return"); _register_sys_event("nfs.proc.open.entry", _GROUP_NFS, _HOOKID_NFS_PROC_OPEN_ENTRY, "INT8:INT8:INT64:INT8:STRING:INT32:INT32", "major_device:minor_device:fileid:version:filename:flag:mode"); _register_sys_event("nfs.proc.open.return", _GROUP_NFS, _HOOKID_NFS_PROC_OPEN_RETURN, "INT32","return"); _register_sys_event("nfs.proc.release.entry", _GROUP_NFS, _HOOKID_NFS_PROC_RELEASE_ENTRY, "INT8:INT8:INT64:INT8:STRING:INT32:INT32", "major_device:minor_device:fileid:version:filename:flag:mode"); _register_sys_event("nfs.proc.release.return", _GROUP_NFS, _HOOKID_NFS_PROC_RELEASE_RETURN, "INT32","return"); _register_sys_event("nfs.proc.create.entry", _GROUP_NFS, _HOOKID_NFS_PROC_CREATE_ENTRY, "INT8:INT8:INT64:INT8:STRING:INT32", "major_device:minor_device:fileid:version:filename:mode"); _register_sys_event("nfs.proc.create.return", _GROUP_NFS, _HOOKID_NFS_PROC_CREATE_RETURN, "INT32","return"); _register_sys_event("nfs.proc.rename.entry", _GROUP_NFS, _HOOKID_NFS_PROC_RENAME_ENTRY, "INT8:INT8:INT8:INT64:STRING:INT8:INT8:INT64:STRING", "version:major_old:minor_old:fileid_old:filename_old:major_new:minor_new:fileid_new:filename_new"); _register_sys_event("nfs.proc.rename.return", _GROUP_NFS, _HOOKID_NFS_PROC_RENAME_RETURN, "INT32","return"); _register_sys_event("nfs.proc.remove.entry", _GROUP_NFS, _HOOKID_NFS_PROC_REMOVE_ENTRY, "INT8:INT8:INT64:INT8:STRING", "major_dev:minor_dev:field_id:version:filename");; _register_sys_event("nfs.proc.remove.return", _GROUP_NFS, _HOOKID_NFS_PROC_REMOVE_RETURN, "INT32", "return");; _register_sys_event("nfsd.dispatch.entry", _GROUP_NFSD, _HOOKID_NFSD_DISPATCH_ENTRY, "INT8:INT8:INT32:INT32:INT32", "proto:version:xid:proc:client_ip"); _register_sys_event("nfsd.dispatch.return", _GROUP_NFSD, _HOOKID_NFSD_DISPATCH_RETURN, "INT32","return"); _register_sys_event("nfsd.open.entry", _GROUP_NFSD, _HOOKID_NFSD_OPEN_ENTRY, "INT8:INT64:INT64:INT64:INT32:INT8", "size:ino0:ino1:ino2:type:access"); _register_sys_event("nfsd.open.return", _GROUP_NFSD, _HOOKID_NFSD_OPEN_RETURN, "INT32","return"); _register_sys_event("nfsd.read.entry", _GROUP_NFSD, _HOOKID_NFSD_READ_ENTRY, "INT8:INT64:INT64:INT64:INT64:INT64:INT64:INT64", "size:ino0:ino1:ino2:count:offset:iov_len:vlen"); _register_sys_event("nfsd.read.return", _GROUP_NFSD, _HOOKID_NFSD_READ_RETURN, "INT32","return"); _register_sys_event("nfsd.write.entry", _GROUP_NFSD, _HOOKID_NFSD_WRITE_ENTRY, "INT8:INT64:INT64:INT64:INT64:INT64:INT64:INT64", "size:ino0:ino1:ino2:count:offset:iov_len:vlen"); _register_sys_event("nfsd.write.return", _GROUP_NFSD, _HOOKID_NFSD_WRITE_RETURN, "INT32","return"); _register_sys_event("nfsd.lookup.entry", _GROUP_NFSD, _HOOKID_NFSD_LOOKUP_ENTRY, "INT8:INT64:INT64:INT64:STRING", "size:ino0:ino1:ino2:filename"); _register_sys_event("nfsd.lookup.return", _GROUP_NFSD, _HOOKID_NFSD_LOOKUP_RETURN, "INT32","return"); _register_sys_event("nfsd.commit.entry", _GROUP_NFSD, _HOOKID_NFSD_COMMIT_ENTRY, "INT8:INT64:INT64:INT64:INT64:INT64", "size:ino0:ino1:ino2:count:offset"); _register_sys_event("nfsd.commit.return", _GROUP_NFSD, _HOOKID_NFSD_COMMIT_RETURN, "INT32","return"); _register_sys_event("nfsd.create.entry", _GROUP_NFSD, _HOOKID_NFSD_CREATE_ENTRY, "INT8:INT64:INT64:INT64:STRING:INT32:INT16:INT32", "size:ino0:ino1:ino2:filename:type:iap_valid:iap_mode"); _register_sys_event("nfsd.create.return", _GROUP_NFSD, _HOOKID_NFSD_CREATE_RETURN, "INT32","return"); _register_sys_event("nfsd.createv3.entry", _GROUP_NFSD, _HOOKID_NFSD_CREATEV3_ENTRY, "INT8:INT64:INT64:INT64:STRING:INT8:INT16:INT32", "size:ino0:ino1:ino2:filename:createmode:iap_valid:iap_mode"); _register_sys_event("nfsd.createv3.return", _GROUP_NFSD, _HOOKID_NFSD_CREATEV3_RETURN, "INT32","return"); _register_sys_event("nfsd.unlink.entry", _GROUP_NFSD, _HOOKID_NFSD_UNLINK_ENTRY, "INT8:INT64:INT64:INT64:STRING:INT32", "size:ino0:ino1:ino2:filename:type"); _register_sys_event("nfsd.unlink.return", _GROUP_NFSD, _HOOKID_NFSD_UNLINK_RETURN, "INT32","return"); _register_sys_event("nfsd.rename.entry", _GROUP_NFSD, _HOOKID_NFSD_RENAME_ENTRY, "INT8:INT64:INT64:INT64:STRING:INT8:INT64:INT64:INT64:STRING", "old_size:old_ino0:old_ino1:old_ino2:old_filename:size:ino0:ino1:ino2:filename"); _register_sys_event("nfsd.rename.return", _GROUP_NFSD, _HOOKID_NFSD_RENAME_RETURN, "INT32","return"); _register_sys_event("nfsd.close.entry", _GROUP_NFSD, _HOOKID_NFSD_CLOSE_ENTRY, "STRING", "filename"); _register_sys_event("nfsd.close.return", _GROUP_NFSD, _HOOKID_NFSD_CLOSE_RETURN, "INT32","return"); _register_sys_event("nfsd.proc.lookup.entry", _GROUP_NFSD, _HOOKID_NFSD_PROC_LOOKUP_ENTRY, "INT8:INT64:INT64:INT64:INT8:STRING", "size:ino0:ino1:ino2:version:filename"); _register_sys_event("nfsd.proc.lookup.return", _GROUP_NFSD, _HOOKID_NFSD_PROC_LOOKUP_RETURN, "INT32","return"); _register_sys_event("nfsd.proc.read.entry", _GROUP_NFSD, _HOOKID_NFSD_PROC_READ_ENTRY, "INT8:INT64:INT64:INT64:INT8:INT64:INT64:INT64:INT64", "size:ino0:ino1:ino2:version:count:offset:iov_len:vlen"); _register_sys_event("nfsd.proc.read.return", _GROUP_NFSD, _HOOKID_NFSD_PROC_READ_RETURN, "INT32","return"); _register_sys_event("nfsd.proc.write.entry", _GROUP_NFSD, _HOOKID_NFSD_PROC_WRITE_ENTRY, "INT8:INT64:INT64:INT64:INT8:INT64:INT64:INT64:INT64", "size:ino0:ino1:ino2:version:count:offset:iov_len:vlen"); _register_sys_event("nfsd.proc.write.return", _GROUP_NFSD, _HOOKID_NFSD_PROC_WRITE_RETURN, "INT32","return"); _register_sys_event("nfsd.proc.commit.entry", _GROUP_NFSD, _HOOKID_NFSD_PROC_COMMIT_ENTRY, "INT8:INT64:INT64:INT64:INT8:INT64:INT64", "size:ino0:ino1:ino2:version:count:offset"); _register_sys_event("nfsd.proc.commit.return", _GROUP_NFSD, _HOOKID_NFSD_PROC_COMMIT_RETURN, "INT32","return"); _register_sys_event("nfsd.proc.compound.entry", _GROUP_NFSD, _HOOKID_NFSD_PROC_COMPOUND_ENTRY, "INT32","num"); _register_sys_event("nfsd.proc.compound.return", _GROUP_NFSD, _HOOKID_NFSD_PROC_COMPOUND_RETURN, "INT32","return"); _register_sys_event("nfsd.proc.remove.entry", _GROUP_NFSD, _HOOKID_NFSD_PROC_REMOVE_ENTRY, "INT8:INT64:INT64:INT64:INT8:STRING", "size:ino0:ino1:ino2:version:filename"); _register_sys_event("nfsd.proc.remove.return", _GROUP_NFSD, _HOOKID_NFSD_PROC_REMOVE_RETURN, "INT32","return"); _register_sys_event("nfsd.proc.rename.entry", _GROUP_NFSD, _HOOKID_NFSD_PROC_RENAME_ENTRY, "INT8:INT8:INT64:INT64:INT64:STRING:INT8:INT64:INT64:INT64:STRING", "version:old_size:old_ino0:old_ino1:old_ino2:old_filename:size:ino0:ino1:ino2:filename"); _register_sys_event("nfsd.proc.rename.return", _GROUP_NFSD, _HOOKID_NFSD_PROC_RENAME_RETURN, "INT32","return"); _register_sys_event("nfsd.proc.create.entry", _GROUP_NFSD, _HOOKID_NFSD_PROC_CREATE_ENTRY, "INT8:INT64:INT64:INT64:INT8:STRING", "size:ino0:ino1:ino2:version:filename"); _register_sys_event("nfsd.proc.create.return", _GROUP_NFSD, _HOOKID_NFSD_PROC_CREATE_RETURN, "INT32","return"); %} probe register_event = begin { have_userevent = 1 hookid_init() }