4.2. Disk The following sections showcase scripts that monitor disk and I/O activity. 4.2.1. Summarizing Disk Read/Write Traffic This section describes how to identify which processes are performing the heaviest disk reads/writes to the system. disktop.stp disktop.stp outputs the top ten processes responsible for the heaviest reads/writes to disk. Example 4.5, "disktop.stp Sample Output" displays a sample output for this script, and includes the following data per listed process: UID - user ID. A user ID of 0 refers to the root user. PID - the ID of the listed process. PPID - the process ID of the listed process's parent process . CMD - the name of the listed process. DEVICE - which storage device the listed process is reading from or writing to. T - the type of action performed by the listed process; W refers to write, while R refers to read. BYTES - the amount of data read to or written from disk. The time and date in the output of disktop.stp is returned by the functions ctime() and gettimeofday_s() . ctime() derives calendar time in terms of seconds passed since the Unix epoch (January 1, 1970). gettimeofday_s() counts the actual number of seconds since Unix epoch, which gives a fairly accurate human-readable timestamp for the output. In this script, the USDreturn is a local variable that stores the actual number of bytes each process reads or writes from the virtual file system. USDreturn can only be used in return probes (for example vfs.read.return and vfs.read.return ). Example 4.5. disktop.stp Sample Output

Commands:
#!/usr/bin/stap # Copyright (C) 2007 Oracle Corp. # Get the status of reading/writing disk every 5 seconds, output top ten entries # This is free software,GNU General Public License (GPL); either version 2, or (at your option) any later version. # Usage: ./disktop.stp # global io_stat,device global read_bytes,write_bytes probe vfs.read.return { if (USDreturn>0) { if (devname!="N/A") {/*skip read from cache*/ io_stat[pid(),execname(),uid(),ppid(),"R"] += USDreturn device[pid(),execname(),uid(),ppid(),"R"] = devname read_bytes += USDreturn } } } probe vfs.write.return { if (USDreturn>0) { if (devname!="N/A") { /*skip update cache*/ io_stat[pid(),execname(),uid(),ppid(),"W"] += USDreturn device[pid(),execname(),uid(),ppid(),"W"] = devname write_bytes += USDreturn } } } probe timer.ms(5000) { /* skip non-read/write disk */ if (read_bytes+write_bytes) { printf("\n%-25s, %-8s%4dKb/sec, %-7s%6dKb, %-7s%6dKb\n\n", ctime(gettimeofday_s()), "Average:", ((read_bytes+write_bytes)/1024)/5, "Read:",read_bytes/1024, "Write:",write_bytes/1024) /* print header */ printf("%8s %8s %8s %25s %8s %4s %12s\n", "UID","PID","PPID","CMD","DEVICE","T","BYTES") } /* print top ten I/O */ foreach ([process,cmd,userid,parent,action] in io_stat- limit 10) printf("%8d %8d %8d %25s %8s %4s %12d\n", userid,process,parent,cmd, device[process,cmd,userid,parent,action], action,io_stat[process,cmd,userid,parent,action]) /* clear data */ delete io_stat delete device read_bytes = 0 write_bytes = 0 } probe end{ delete io_stat delete device delete read_bytes delete write_bytes }
[...] Mon Sep 29 03:38:28 2008 , Average: 19Kb/sec, Read: 7Kb, Write: 89Kb UID PID PPID CMD DEVICE T BYTES 0 26319 26294 firefox sda5 W 90229 0 2758 2757 pam_timestamp_c sda5 R 8064 0 2885 1 cupsd sda5 W 1678 Mon Sep 29 03:38:38 2008 , Average: 1Kb/sec, Read: 7Kb, Write: 1Kb UID PID PPID CMD DEVICE T BYTES 0 2758 2757 pam_timestamp_c sda5 R 8064 0 2885 1 cupsd sda5 W 1678