[Solus Linux] /sys/kernel/debug/tracing/events/syscalls No such file or directory about procmon-for-linux

[ckorn]

$ sudo ls /sys/kernel/debug/tracing/events/
alarmtimer	  enable	  huge_memory  kyber	power	      signal   vsyscall
bcache		  exceptions	  hwmon        libata	printk	      skb      wbt
block		  ext4		  i2c	       mce	qdisc	      smbus    workqueue
bpf_test_run	  fib		  initcall     mei	random	      sock     writeback
bridge		  fib6		  intel_iommu  migrate	ras	      spi      x86_fpu
btrfs		  filelock	  iomap        module	raw_syscalls  swiotlb  xdp
cgroup		  filemap	  iommu        msr	rcu	      task     xfs
clk		  fs_dax	  io_uring     napi	regmap	      tcp      xfs_scrub
compaction	  ftrace	  irq	       neigh	regulator     thermal  xhci-hcd
context_tracking  gpio		  irq_matrix   net	resctrl       timer
cpuhp		  hda		  irq_vectors  nmi	rpm	      tlb
cros_ec		  hda_controller  jbd2	       nvme	rseq	      tls
devlink		  hda_intel	  kmem	       oom	rtc	      udp
dma_fence	  header_event	  kvm	       pagemap	sched	      v4l2
drm		  header_page	  kvmmmu       percpu	scsi	      vmscan

$ uname -r
5.6.18-156.current

I don't know what Solus is based.
How ever this seems to be the config of the kernel (found in /lib/modules/5.6.18-156.current/build/.config)

kernel_config.zip

[sebastiandeorowicz]

Same problem under WSL2 Ubuntu 20.04 LTS.

[josalem]

I'm not familiar with this distro, but it sounds like it doesn't come with debugfs mounted by default. You can read more details on it here, but to turn it on, you should be able to run mount -t debugfs none /sys/kernel/debug to mount it. Try running again after that.

That being said, I think we should have a better failure path than simply throwing an exception from the fs iterator.

[ckorn]

Thanks for the quick response!

Unfortunately this did not work.
It is already mounted but syscalls are just missing there:

$ LANG=C sudo mount -t debugfs none /sys/kernel/debug
mount: /sys/kernel/debug: none already mounted on /sys/fs/bpf.
$  sudo ls /sys/kernel/debug/tracing
available_events	    events	     saved_cmdlines_size  trace_clock
available_filter_functions  free_buffer      saved_tgids	  trace_marker
available_tracers	    instances	     set_event		  trace_marker_raw
buffer_percent		    kprobe_events    set_event_pid	  trace_options
buffer_size_kb		    kprobe_profile   set_ftrace_filter	  trace_pipe
buffer_total_size_kb	    max_graph_depth  set_ftrace_notrace   tracing_cpumask
current_tracer		    options	     set_ftrace_pid	  tracing_on
dynamic_events		    per_cpu	     set_graph_function   tracing_thresh
dyn_ftrace_total_info	    printk_formats   set_graph_notrace	  uprobe_events
enabled_functions	    README	     timestamp_mode	  uprobe_profile
error_log		    saved_cmdlines   trace

[josalem]

Interesting. What do you have under /sys/kernel/debug/tracing/events/?

Do you know what kernel version you have installed? Out of curiosity, what's the base distro for Solus? It's possible the kernel wasn't configured with syscall probes.

[josalem]

I'll try to get some time to take a look at kernel version 5.6 and see if the layout of this directory has changed. I see raw_syscall in there which means you should have the tracepoints needed for the BPF program I think. I'll add the kernel label to this issue and track it with our efforts to work on the newest kernels.

[Xcess]

solus is not based on other distros. It's standalone

[MarioHewardt]

For WSL2 you need to enable BPF first: https://gist.github.com/MarioHewardt/5759641727aae880b29c8f715ba4d30f

[jahabibi]

Closing stale issue.