Server : Apache System : Linux server2.corals.io 4.18.0-348.2.1.el8_5.x86_64 #1 SMP Mon Nov 15 09:17:08 EST 2021 x86_64 User : corals ( 1002) PHP Version : 7.4.33 Disable Function : exec,passthru,shell_exec,system Directory :  /opt/rh/gcc-toolset-11/root/usr/share/systemtap/examples/profiling/

Upload File : current_dir [ Writeable ] document_root [ Writeable ]

title: Monitor which executables use ioctl syscalls and what kernel code is handling the ioctl
name: ioctl_handler.stp
version: 1.0
author: William Cohen
keywords: profiling
subsystem: process
status: production
exit: user-controlled
output: sorted-list
scope: system-wide
description: The ioctl systemcall is used to manipulate devices setting or special files.  The way that ioctl syscalls are handled depend greatly on the device the special file is associated with. Using strace to monitor the open and ioctl syscalls may not give a good indication of what kernel code is actually handling the ioctl operations.  The ioctl_handler.stp script is designed to provide more details. On exit the ioctl_handler.stp script provides a count of the ioctl syscalls for each executable run on the system. If there was some special device driver code used to handle to the ioctl, the output will have a tally of the times the function name and module was called for that executable.  The "--all-modules" option should be included on the command line so the script can provide function name information.
test_check: stap -p4 ioctl_handler.stp --all-modules
test_installcheck: stap ioctl_handler.stp --all-modules -T 1