System information

Kernel Probes 91
6.4.1 How to List Registered Kernel
Probes
The list of all currently registered kprobes is in the /sys/kernel/de
bug/kprobes/list file.
saturn.example.com:~ # cat /sys/kernel/debug/kprobes/list
c015d71a k vfs_read+0x0 [DISABLED]
c011a316 j do_fork+0x0
c03dedc5 r tcp_v4_rcv+0x0
The first column lists the address in the kernel where the probe is inserted. The sec-
ond column prints the type of the probe: k for kprobe, j for jprobe, and r for return
probe. The third column specifies the symbol, offset and optional module name of the
probe. The following optional columns include the status information of the probe. If
the probe is inserted on a virtual address which is not valid anymore, it is marked with
[GONE]. If the probe is temporarily disabled, it is marked with [DISABLED].
6.4.2 How to Switch All Kernel Probes On
or Off
The /sys/kernel/debug/kprobes/enabled file represents a switch with
which you can globally and forcibly turn on or off all the registered kernel probes. To
turn them off, simply enter
echo "0" > /sys/kernel/debug/kprobes/enabled
on the command line as root. To turn them on again, enter
echo "1" > /sys/kernel/debug/kprobes/enabled
Note that this way you do not change the status of the probes. If a probe is temporari-
ly disabled, it will not be enabled automatically but will remain in the [DISABLED]
state after entering the latter command.
6.5 For More Information
To learn more about kernel probes, look at the following sources of information: