systemtap-scripts

mem_leak_libc.stap

trace glibc malloc andd free to find leak function

mem_static.stap

trace glibc malloc calloc realloc function to find the top malloc funtion which may cause memory fragmentation

bytes(not free yet): 16280320000
value |-------------------------------------------------- count
8192 | 0
16384 | 0
32768 |@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@ 317975
65536 | 0
131072 | 0
ngx_alloc+0xf [nginx]
ngx_palloc_large+0x13 [nginx]
ngx_palloc+0x42 [nginx]
ngx_create_temp_buf+0x27 [nginx]
ngx_http_subs_match+0xa99 [nginx]

io_static.stap

find the process and file who makes io top

TODO

1. Also we can change this script to trace some process's logs, if we donot kown whether some dynamic lib such as (rocketxclean uses rocketmq-cpp, librocketmq.so) logging at /root/logs/rocketmq-cpp/ silently until making the disk usage bombs at produce environment. Make this Check as a Tool Service when you start a new program,just like standard background services's core_check.sh 、core_clear.sh、delete_logs.sh、service_check.sh and so on.
2. change the script to trace a tmp file which is deleted instantly is created by who Also we can use strace, but use systemtap can make tools more quickly.
3. why this stap cannot watch 'du -ah --max-depth=1',but iotop can?

START####################
Process PID inode KB Read	KB Written Path
dig 14665	34072580 10 0	/etc/pki/tls/openssl.cnf
dig 14668	34072580 10 0	/etc/pki/tls/openssl.cnf
srs 13109	4026532015 2 0 /proc/vmstat
tail 14666 1359 2 0	/usr/share/locale/locale.alias
grep 14667 1359 2 0	/usr/share/locale/locale.alias
END###################
START####################
Process PID inode KB Read	KB Written Path
rocketxclean 4015	34313132 0 6	/root/logs/rocketmq-cpp/4015_rocketmq-cpp.log.0
PullMsgTP 4016	58426974 0 4	/root/logs/rocketmq-cpp/4016_rocketmq-cpp.log.0
DispatchTP 4016	58426974 0 4	/root/logs/rocketmq-cpp/4016_rocketmq-cpp.log.0
DispatchTP 4015	34313132 0 3	/root/logs/rocketmq-cpp/4015_rocketmq-cpp.log.0
lpqd 14680 1359 2 0	/usr/share/locale/locale.alias
END###################

nginx_https.stap

capture https flow when service with nginx. other service's stap script need to make a change. This is a diffrent way with ssldump or tcpdump and wireshark

TODO

1. capture ssl handshark infos
2. coordinate with goreplay to make a mirror of https follw. Also we can change it as http2 follow

curl -voa https://127.0.0.1:8443 -H "aaa.fjsdn.com" -k

GET / HTTP/1.1
User-Agent: curl/7.29.0
Host: 127.0.0.1:8443
Accept: */*
1024