Don't Reinvent the Wheel
Knowing the exact kernel function name for a given operation is fragile — function names change between kernel versions, and the same logical operation may be implemented differently on x86 vs. ARM. Tapsets solve this problem.
A tapset is a .stp library file (stored in /usr/share/systemtap/tapset/) that defines probe aliases — stable, human-readable names that map to the correct underlying kernel functions for your kernel version.
Instead of:
probe kernel.function("do_sys_open") // Only works on some kernel versions
You write:
probe syscall.open // Works across kernel versions
The tapset layer handles the version-specific mapping transparently. It also pre-extracts useful variables so you don't have to navigate raw kernel data structures.
Discovering available tapsets: The stap -L flag lists a wildcard pattern of probes along with the variables each one pre-extracts — for example, syscall.open exposes filename, flags, mode, and name directly. Those variables are ready to use in your script body — no $ prefix, no user_string() call needed.
Common tapset namespaces:
| Namespace | What it covers |
|---|---|
syscall.* |
All system calls with pre-extracted arguments |
kernel.function("*") |
Any kernel C function by name |
process("binary").function("func") |
User-space function in a specific binary |
java("class").method("method") |
Java method entry/return (via USDT) |
timer.s(N) / timer.ms(N) |
Periodic timers |
begin / end |
Script startup and shutdown |