Today I decided to have a play with systemtap and see if it worked on 2009.1, since it’s quite a need tool that Fedora has had for some time. Luckly enough, it looked like the was an RPM available for it, so installed it and gave it a go.. no such luck. The rpm is old and builds c code that won’t compile against the current kernel. The way systemtap works, is it takes a system tap script and compiles this script into C, It then compiles the C against the current kernel to build a kernel module, which is then loaded into the running kernel.
Not to be deterred by an out of date package (bug logged), I downloaded systemtap 0.9 from http://sourceware.org/systemtap/ftp/releases/ and compiled it. (required: lib64elfutils-static-devel, gcc-c++). It requires quite a lot of the kernel files, so installed kernel-server-debug, kernel-server-devel.
After that, it worked pretty well, I downloaded a few of the examples, like nettop.stp, which will output a nice top of network traffic by process. for example:
# stap nettop.stp PID UID DEV XMIT_PK RECV_PK XMIT_KB RECV_KB COMMAND 10219 500 eth0 101 67 19 73 firefox 0 0 eth0 55 92 3 46 swapper 2863 0 eth0 27 28 1 26 X 3583 500 eth0 13 4 5 0 sshd 3582 76 eth0 7 2 2 0 sshd 2913 0 eth0 4 4 0 0 python 2996 0 eth0 2 2 0 0 nmbd 4205 500 eth0 1 1 0 0 net_applet