SystemTap

Quality 0.50 · 1 view · Updated 2 months ago

Scripting language and tool

title: "SystemTap" type: doc version: 1 created: 2026-02-28 author: "Wikipedia contributors" status: active scope: public tags: ["free-software-programmed-in-c++", "free-system-software", "debuggers", "linux-kernel-features", "linux-only-free-software"] description: "Scripting language and tool" topic_path: "technology/operating-systems" source: "https://en.wikipedia.org/wiki/SystemTap" license: "CC BY-SA 4.0" wikipedia_page_id: 0 wikipedia_revision_id: 0

::summary Scripting language and tool ::

::data[format=table title="Infobox software"]

Field	Value
name	SystemTap
logo	Smileytap.svg
released
latest release version	5.3
latest release date
programming language	C, C++
operating system	Linux
genre	Tracing programming language
license	GNU General Public License
website
::

In computing, SystemTap () is a scripting language and tool for dynamically instrumenting running production Linux-based operating systems. System administrators can use SystemTap to extract, filter and summarize data in order to enable diagnosis of complex performance or functional problems.

SystemTap consists of free and open-source software and includes contributions from Red Hat, IBM, Intel, Hitachi, Oracle, the University of Wisconsin-Madison and other community members.

History

SystemTap debuted in 2005 in Red Hat Enterprise Linux 4 Update 2 as a technology preview.

After four years in development, SystemTap 1.0 was released in 2009.

, SystemTap runs fully supported in all Linux distributions including RHEL / CentOS 5 since update 2, SLES 10, Fedora, Debian and Ubuntu.

Tracepoints in the CPython VM and JVM were added in SystemTap 1.2 in 2009.

In November 2019, SystemTap 4.2 included prometheus exporter.

Usage

SystemTap files are written in the SystemTap language (saved as .stp files) and run with the stap command-line.Compare {{cite journal | title = SystemTap Language Reference: A guide to the constructs and syntax used in SystemTap scripts | first = Robb | last = Romans | year = 2009 | publisher = Red Hat | page = 4 | quote = SystemTap [...] requires root privileges to actually run the kernel objects it builds using the sudo command, applied to the staprun program.[...] staprun is a part of the SystemTap package, dedicated to module loading and unloading and kernel-touser data transfer. | citeseerx = 10.1.1.172.5186}}

The system carries out a number of analysis passes on the script before allowing it to run. Scripts may be executed with one of three backends selected by the --runtime= option. The default is a loadable kernel module, which has the fullest capability to inspect and manipulate any part of the system, and therefore requires most privilege. Another backend is based on the dynamic program analysis library DynInst to instrument the user's own user-space programs only, and requires least privilege. The newest backend{{cite web |url = https://sourceware.org/ml/systemtap/2017-q4/msg00096.htmlq1/msg00097.html |title = systemtap 3.2 release |last1 = Merey |first1 = Aaron |date = 2017-10-18 |access-date = 2017-10-18 |quote = The systemtap team announces release 3.2 [...] early experimental eBPF (extended Berkeley Packet Filter) backend [...]

Scripts generally focus on events (such as starting or finishing a script), compiled-in probe points such as Linux "tracepoints", or the execution of functions or statements in the kernel or user-space.

Some "guru mode" scripts may also have embedded C, which may run with the -g command-line option. However, use of guru mode is discouraged, and each SystemTap release includes more probe points designed to remove the need for guru-mode scripts. Guru mode is required in order to permit scripts to modify state in the instrumented software, such as to apply some types of emergency security fixes.

As of SystemTap version 1.7, the software implements the new stapsys group and privilege level.{{cite web | url = http://sourceware.org/ml/systemtap/2012-q1/msg00097.html | title = systemtap 1.7 release | last1 = Eigler | first1 = Frank Ch. | date = 2012-02-01 | access-date = 2013-03-26 | quote = The systemtap team announces release 1.7 [...] The new group and privilege level "stapsys" has been added [...]}}

Simple examples

The following script shows all applications setting TCP socket options on the system, what options are being set, and whether the option is set successfully or not.

::code[lang=vcl]

Show sockets setting options

Return enabled or disabled based on value of optval

function getstatus(optval) { if ( optval == 1 ) return "enabling" else return "disabling" }

probe begin { print ("\nChecking for apps setting socket options\n") }

# Set a socket option
probe tcp.setsockopt
{
    status = getstatus(user_int($optval))
	printf ("  App '%s' (PID %d) is %s socket option %s... ", execname(), pid(), status, optstr)
}

    # Check setting the socket option worked
    probe tcp.setsockopt.return
    {
        if ( ret == 0 )
            printf ("success")
        else
            printf ("failed")
        printf ("\n")
    }

probe end { print ("\nClosing down\n") } ::

Many other examples are shipped with SystemTap. There are also real-world examples of SystemTap use at the War Stories page.

Importing scripts from other tracing technologies

SystemTap can attach to DTrace markers when they are compiled into an application using macros from the sys/sdt.h header file.

References

"A SystemTap update". [[LWN.net]].
"Product Documentation for Red Hat Enterprise Linux". [[Red Hat]].
"Josh Stone - SystemTap release 1.0".
"Product Documentation". [[Red Hat]].
(10 October 2006). "Optional update for SystemTap". [[Novell]].
"Features/SystemtapStaticProbes - FedoraProject". Fedoraproject.
"SystemTap Language Reference".
"SystemTap Examples".
"WarStories - Systemtap Wiki".

::callout[type=info title="Wikipedia Source"] This article was imported from Wikipedia and is available under the Creative Commons Attribution-ShareAlike 4.0 License. Content has been adapted to SurfDoc format. Original contributors can be found on the article history page. ::