怎么在linux系统下面找到，对磁盘操作最多的进程，systemtap自带的例子disktop.stp，就能实现这个功能，在doc/systemtap/examples/io目录里面，运行一下看看stap -v disktop.stp，显示如下 
由上图可以看出最繁忙的进程和磁盘了，贴一下代码，------后面为我写的备注
# Copyright (C) 2007 Oracle Corp.
#
# Get the status of reading/writing disk every 5 seconds,
# output top ten entries
#
# This is free software,GNU General Public License (GPL);
# either version 2, or (at your option) any later version.
#
# Usage:
# ./disktop.stp
#
global io_stat,device
global read_bytes,write_bytes
probe vfs.read.return {
if ($return>0) { ----vfs_read返回的为读取的字节书，这边表示读取的字节书大于0
if (devname!="N/A") {/*skip read from cache*/
io_stat[pid(),execname(),uid(),ppid(),"R"] += $return -----累计每个进程读取的字节数
device[pid(),execname(),uid(),ppid(),"R"] = devname
read_bytes += $return ------总的读取字节数
}
}
}
probe vfs.write.return {
if ($return>0) {
if (devname!="N/A") { /*skip update cache*/
io_stat[pid(),execname(),uid(),ppid(),"W"] += $return
device[pid(),execname(),uid(),ppid(),"W"] = devname
write_bytes += $return
}
}
}
probe timer.ms(5000) { ----每5000ms操作一次
/* skip non-read/write disk */
if (read_bytes+write_bytes) {
printf("\n%-25s, %-8s%4dKb/sec, %-7s%6dKb, %-7s%6dKb\n\n",
ctime(gettimeofday_s()),
"Average:", ((read_bytes+write_bytes)/1024)/5,
"Read:",read_bytes/1024,
"Write:",write_bytes/1024)
/* print header */
printf("%8s %8s %8s %25s %8s %4s %12s\n",
"UID","PID","PPID","CMD","DEVICE","T","BYTES")
}
/* print top ten I/O */
foreach ([process,cmd,userid,parent,action] in io_stat- limit 10) -----iostat-表示降序排序，limit表示取前10
printf("%8d %8d %8d %25s %8s %4s %12d\n",
userid,process,parent,cmd,
device[process,cmd,userid,parent,action],
action,io_stat[process,cmd,userid,parent,action])
/* clear data */
delete io_stat
delete device
read_bytes = 0
write_bytes = 0
}
probe end{
delete io_stat
delete device
delete read_bytes
delete write_bytes
}
有个疑问，上面的devname值从何而来，看一下tapset/vfs.stp，里面有一段
probe vfs.read.return = kernel.function("vfs_read").return
{
name = "vfs.read"
retstr = sprintf("%d", $return)
file = $file ---vfs_read传入的参数
pos = $pos ---vfs_read传入的参数
buf = $buf ---vfs_read传入的参数
bytes_to_read = $count ---vfs_read传入的参数
dev = __file_dev($file)
devname = __find_bdevname(dev, __file_bdev($file))
ino = __file_ino($file)
ret = $return
bytes_read = $return > 0 ? $return : 0
error = $return < 0 ? $return : 0
error_str = error ? errno_str(error) : ""
}
vfs_read函数原型ssize_t vfs_read(struct file *file, char __user *buf, size_t count, loff_t *pos)
其实用stap -L 'kernel.function("vfs_read")就会把参数和返回值都列出来
这么简单的代码就把一个复杂的监控给实现了，systemtap真神器！