Senior LevelLinux Commands & SysAdmin
How do ftrace, kprobes, and uprobes trace internal Linux kernel and user-space function execution?
❓ Interview Prompt: Explain ftrace (/sys/kernel/debug/tracing/), kprobes (kernel dynamic probes), uprobes (user-space probes), and tracepoints.
Linux provides dynamic instrumentation tools to inspect kernel and user-space function calls in real time:
•
ftrace: Built-in kernel function tracer utilizing compiler '-pg' profiling hooks mapped in '/sys/kernel/debug/tracing/'.
•
kprobes: Dynamically patches kernel instruction bytes with breakpoint traps to inspect kernel functions at runtime.
•
uprobes: Dynamically places instrumentation probes inside user-space executables and shared libraries ('libc.so').
Code Implementation Example
bash
# Enable function tracer in ftrace
sudo sh -c 'echo function > /sys/kernel/debug/tracing/current_tracer'
# Trace specific kernel function execution
sudo sh -c 'echo sys_execve > /sys/kernel/debug/tracing/set_ftrace_filter'
# Read trace pipe output
sudo cat /sys/kernel/debug/tracing/trace_pipe💡Tracing kernel function calls using ftrace tracefs interface.
🎯 Interview Key Takeaway
Use kprobes and uprobes for dynamic non-intrusive runtime function tracing across Linux kernel and user-space binaries.
#ftrace#kprobes#uprobes#Tracing#Senior
Back to all Linux Commands & SysAdmin Questions→