How can I probe file open and close at VFS using SystemTap

Question

I seen example of SystemTap script using probe syscall.open.return { } But there are some application doesn't call systemcall So how can I probe file open at VFS

Answer 1

If you know you want to probe vfs open operations, do:

# stap -L 'kernel.function("vfs_*")'
[...]
kernel.function("vfs_open@fs/open.c:862") $path:struct path const* $filp:struct file* $cred:struct cred const*
[...]

# stap -e 'probe kernel.function("vfs_open") { /* ... */ }'

where the ... could include printing context variables, identification of the calling process, backtraces, task_dentry_path(task_current(), $path->dentry, $path->mnt), etc.