How to Use SystemTap to Trace the Linux Kernel

Updated: 22 October 2026 · Applies to: SystemTap on Fedora/RHEL-family Linux

SystemTap lets you monitor and trace a running Linux kernel dynamically, with scriptable filtering and statistics, without recompiling or rebooting. It instruments the kernel using Kprobes and return probes, and with utrace it can also probe user-space executables and shared libraries.

Installation

On Fedora, as root:

yum install systemtap kernel-devel
debuginfo-install kernel

Running a probe

The stap command is SystemTap's front end. Run it in verbose mode with -v, and use -e to pass a script directly on the command line:

stap -v -e 'probe syscall.read {printf("syscall %s arguments %s \n", name, argstr); exit()}'

This runs through five passes: parsing and checking the script (1 to 2), translating it to C (3), compiling that C into a kernel module (4), then loading and running the module (5). Once loaded, the probe fires every time its event occurs; here, that is every read system call.

Probe syntax

probe EVENT { HANDLER }

EVENT is one of kernel.function, process.statement, timer.ms, begin, end, or a tapset alias (see the stapprobes man page). HANDLER can use filtering and conditionals (if, next) and control structures (foreach, while). You do not need to declare variable types; they are inferred from context, and predefined functions such as pid(), execname() and log() are available. The full reference is installed as a PDF at /usr/share/doc/systemtap-<version>/langref.pdf.

Ways to invoke stap

stap -e '<script>' [-c <target program>]
stap script.stp [-c <target program>]
stap -l '<event>'

Tapset libraries

Tapsets are reusable probe aliases and functions, not probes you run directly. The syscall.read alias used above comes from /usr/share/systemtap/tapset/syscalls2.stp, which defines it roughly as:

probe syscall.read = kernel.function("SyS_read").call !,
                     kernel.function("sys_read").call
{
  name = "read"
  fd = $fd
  buf_uaddr = $buf
  count = $count
  argstr = sprintf("%d, %p, %d", $fd, $buf, $count)
}