Red Hat Training

A Red Hat training course is available for Red Hat Enterprise Linux

3.2. Probe aliases

The general syntax is as follows. 
probe <alias> = <probepoint> { <prologue_stmts> }
probe <alias> += <probepoint> { <epilogue_stmts> }
New probe points may be defined using aliases. A probe point alias looks similar to probe definitions, but instead of activating a probe at the given point, it defines a new probe point name as an alias to an existing one. New probe aliases may refer to one or more existing probe aliases. The following is an example. 
probe socket.sendmsg = kernel.function ("sock_sendmsg") { ... }
probe socket.do_write = kernel.function ("do_sock_write") { ... }
probe socket.send = socket.sendmsg, socket.do_write { ... }
There are two types of aliases, the prologue style and the epilogue style which are identified by the equal sign (=) and "+=" respectively.
A probe that names the new probe point will create an actual probe, with the handler of the alias pre-pended.
This pre-pending behavior serves several purposes. It allows the alias definition to pre-process the context of the probe before passing control to the handler specified by the user. This has several possible uses, demonstrated as follows. 
# Skip probe unless given condition is met:
if ($flag1 != $flag2) next

# Supply values describing probes:
name = "foo"

# Extract the target variable to a plain local variable:
var = $var

3.2.1. Prologue-style aliases (=)

For a prologue style alias, the statement block that follows an alias definition is implicitly added as a prologue to any probe that refers to the alias. The following is an example. 
# Defines a new probe point syscall.read, which expands to
# kernel.function("sys_read"), with the given statement as
# a prologue.
#
probe syscall.read = kernel.function("sys_read") {
fildes = $fd
}

3.2.2. Epilogue-style aliases (+=)

The statement block that follows an alias definition is implicitly added as an epilogue to any probe that refers to the alias. It is not useful to define new variable there (since no subsequent code will see it), but rather the code can take action based upon variables left set by the prologue or by the user code. The following is an example: 
# Defines a new probe point with the given statement as an
# epilogue.
#
probe syscall.read += kernel.function("sys_read") {
if (traceme) println ("tracing me")
}

3.2.3. Probe alias usage

A probe alias is used the same way as any built-in probe type, by naming it: 
probe syscall.read {
printf("reading fd=%d\n", fildes)
}

3.2.4. Unused alias variables

An unused alias variable is a variable defined in a probe alias, usually as one of a group of var = $var assignments, which is not actually used by the script probe that instantiates the alias. These variables are discarded.