Probes
A probe is a location or activity to which a set of actions can be bound. The syntax for specifying a probe is a colon specified list of up to four items:
Provider - the instrumentation to be used. Some providers you will encounter are syscall to monitor system calls, io for disk io, and many others.
Module - a specific program location. It could be the name of the module the probe is located in. It could also be the name of a kernel module or the name of a user library.
Function - A specific function name.
Name - An indication of the probe’s semantic meaning. entry and return are common ones.
In keventwatch.d, the only probe was syscall::kevent:entry. The provider is syscall, there is no module, the function is kevent, and the name ...
Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
and much more.
Read now
Unlock full access