SystemTap
also: stap
SystemTap is a dynamic tracing framework that lets you inspect and monitor running Linux kernel and user-space processes without recompiling or restarting the system.
SystemTap works by injecting instrumentation code into a running kernel at runtime, allowing you to trace system calls, function calls, and other events. It compiles a simple scripting language into kernel modules that are dynamically loaded, making it powerful for performance analysis and debugging.
A SystemTap script (with .stp extension) defines what to probe and what data to collect. For example, you can trace every call to a specific function, capture variable values, or measure latency:
probe kernel.function("sys_open") {
println("Opening file:", filename)
}SystemTap is particularly useful for production diagnostics since probes can be installed and removed on live systems without downtime. It competes with tools like kprobes, uprobes, and modern eBPF-based tracers, but offers a higher-level scripting interface.