<div class="gmail_quote">On Thu, Apr 12, 2012 at 10:38 AM, V.Ravikumar <span dir="ltr"><<a href="mailto:ravikumar.vallabhu@gmail.com">ravikumar.vallabhu@gmail.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
Hi all,<br>I'm probing sys_write system call using system tap to get modified file name along with UID.<br>Here is code snippet.<br><br>probe kernel.function ("vfs_write")<br>{<br> <br> filename = user_string($file->f_dentry->d_name->name) // for 2.6.18 kernel.<br>
printf ("%d %s\n",uid,filename)<br>}<br>I got sample program to get inode number as below<br>inode_nr = $file->f_path->dentry->d_inode->i_ino . This I changed to get file name, I'm getting file name as empty.<br>
<br>With above program i'm getting file name as unknown.<br>My question is does above code snippet is correct to get file name ? If not could somebody please let me know the correct implementation.<br><br>
</blockquote></div> <br>I got how to get file name properly.<br><br>
> filename = user_string($file->f_dentry->d_name->name) // for 2.6.18 <br>
Here I need to use kernel_string instead of user_string<br><br>Regards,<br>Ravi<br>