系統技術非業餘研究 » Linux下方便的socket讀寫檢視器（socktop）
晚上 雕樑 說要找個工具來調查下unix域套接字的傳送和接受情況，比如說A程式是否送出，B程式是否接收到，他找了tcpdump ,wireshark什麼的，貌似都不支援。
這時候還是偉大的systemtap來救助了。 因為所有的socket通訊都是通過socket介面來的，任何family的通訊包括unix域套接都要走的，所以只要截獲了socket 讀寫的幾個syscall 就搞定了.
systemtap發行版本提供了個工具socktop， 位於 /usr/share/doc/systemtap/examples/network/socktop, 是個非常方便的工具, 幹這個事情最合適了。
socktop原始碼裡面的版權和簡單的功能介紹：
# Socktop systemtap script
# Copyright (C) 2006 IBM Corp.
#
# This file is part of systemtap, and is free software. You can
# redistribute it and/or modify it under the terms of the GNU General
# Public License (GPL); either version 2, or (at your option) any
# later version.###
### socktop – Combination shell/systemtap script to track reads and writes
### on sockets by process. Can be filtered by process IDs and
### names, protocols, protocol families, users and socket type.
###
$ uname -r
2.6.18-164.el5
$ rpm -i kernel-debuginfo-common-2.6.18-164.el5.x86_64.rpm
$ rpm -i kernel-debuginfo-2.6.18-164.el5.x86_64.rpm
#使用幫助
$ /usr/share/doc/systemtap/examples/network/socktop -h
USAGE: socktop [-d] [-i interval] [-N num] [-P protocol]... [-f family]...
[-t stype]... [-n pname]... [-p pid]... [-u username]... [-h]
-d # print network device traffic (default: off)
-i interval # interval in seconds between printing (default: 5)
-N num # number of top processes and devices to print (default: 10)
-f family # this protocol family only (default: all)
-P protocol # this protocol only (default: all)
-t stype # this socket type only (default: all)
-n pname # this process name only (default: all)
-p pid # this process ID only (default: all)
-u username # this user only (default: all)
-c count # number of iteration
-m mod_name # generate instrumentation (but do not run)
-h # print this help text
Protocol Families:
LOCAL, INET, INET6, IPX, NETLINK, X25, AX25, ATMPVC, APPLETALK, PACKET
Protocols:
TCP, UDP, SCTP, IP, FC, ... (see /etc/protocols for complete list)
Socket Types:
STREAM, DGRAM, RAW, RDM, SEQPACKET, DCCP, PACKET
上面的使用寫的很明白了，我們要過濾的是unix套接字， 每5秒報告下情況， 還順手把網路裝置的流量打出來。
$sudo /usr/share/doc/systemtap/examples/network/socktop -f LOCAL -i 5 -d ======================= Thu Mar 31 21:23:03 2011 ======================== ------------------------------- PROCESSES ------------------------------- PID UID #SEND #RECV SEND_KB RECV_KB PROT FAMILY COMMAND 24821 50453 1 0 0 0 IP LOCAL crond 3840 0 0 2 0 0 IP LOCAL syslog-ng -------------------------------- DEVICES -------------------------------- DEV #XMIT #RECV XMIT_KB RECV_KB eth0 457 250 102 38 bond0 457 0 102 0 lo 24 24 2 2 eth1 0 10 0 0 =========================================================================
我們很清楚的看到了，crond在發，syslog-ng在收。
如果你想知道報文的內容的話，可以改改指令碼把報文也dump出來。
玩得開心!
Post Footer automatically generated by wp-posturl plugin for wordpress.