Access component parts of probe name
Author: ajorCreated Apr 29, 2024Updated Aug 21, 2026
Labelsgood first issuedifficulty: medium
Is your feature request related to a problem? Please describe.
When aggregating data from tracepoint probes, it is only currently possible to distinguish the data from each tracepoint by using the probe builtin:
tracepoint:syscalls:sys_enter_*
{
@syscalls[probe] = count();
}@syscalls[tracepoint:syscalls:sys_enter_close]: 35883
@syscalls[tracepoint:syscalls:sys_enter_openat]: 37641
@syscalls[tracepoint:syscalls:sys_enter_read]: 49833
@syscalls[tracepoint:syscalls:sys_enter_newfstatat]: 78194It would be nice to have a way to access only part of the attach point's definition, so that we could generate output like this:
@syscalls[sys_enter_close]: 35883
@syscalls[sys_enter_openat]: 37641
@syscalls[sys_enter_read]: 49833
@syscalls[sys_enter_newfstatat]: 78194Describe the solution you'd like
Provide a way to access component parts of a probe's definition. probe will still return the full probe name, but individual pieces could be accessed as if it was an array:
probe; // tracepoint:syscalls:sys_enter_read
probe[0]; // tracepoint
probe[1]; // syscalls
probe[2]; // sys_enter_readOr tuple style:
probe.0; // tracepoint
probe.1; // syscalls
probe.2; // sys_enter_readDescribe alternative solutions or features you've considered
func is an alternative for some use-cases (e.g. kprobes), but it doesn't work for all probe types (e.g. tracepoints) and its semantics are still not fully defined when tracing inlined functions.
Problems
- I suppose this could only work if all attachment points of a probe were of the same type, i.e. all tracepoints or all USDTs. A mixture would lead to strange behaviour.
- What do we do about probes types which take a variable number of parameters? e.g.
kfunc:foovskfunc:module:foo
Source: bpftrace/bpftrace