Skip to content

Instantly share code, notes, and snippets.

What would you like to do?
import re
import io
class FtraceEventParser(object):
"""FTraceEventParser parses the text form of a single event
to a tuple of all the event's arguments.
Example usage:
TRACE = '/sys/kernel/debug/tracing/events'
event = 'tcp_set_state'
EVT = TRACE + '/tcp/' + event
with open(EVT + '/format') as fd:
parser = FtraceEventParser.from_fileobj(fd)
with open(EVT + '/enable') as fd:
for line in open(TRACE + '/trace'):
if not (event+':') in line:
prefix, trace = line.split(' %s: ' % event)
sport, dport, saddr, daddr, saddrv6, daddrv6, oldstate, newstate = parser.parse(trace)
ts = float(prefix[prefix.rfind(' ')+1:-1])
with open(EVT + '/enable') as fd:
def parse(self, s):
m = self.regexp.match(s)
if not m:
return None
return m.groups()
def __init__(self, fileobj):
self.regexp = self.re_from_format(fileobj)
def from_fileobj(cls, fileobj):
return cls(fileobj)
def from_string(cls, s):
return cls(io.StringIO(s))
def re_from_format(fd):
"""This would parse an event format string, and create a capturing regexp
that is able to sort-of-parse format string, under reasonable assumptions.
For example, tcp_set_state printf-like format string is:
"sport=%hu dport=%hu saddr=%pI4 daddr=%pI4 saddrv6=%pI6c daddrv6=%pI6c oldstate=%s newstate=%s"
and would generate the regexp
sport=([^ ]*) dport=([^ ]*) saddr=([^ ]*) daddr=([^ ]*) saddrv6=([^ ]*) daddrv6=([^ ]*) oldstate=([^ ]*) newstate=(.*)
Note, we're assuming that a pattern of the form '%s:' would not have the %s contain ':'
prefix = 'print fmt:'
pattern = re.compile('(%[a-z0-9.]*)([^a-z0-9.])', re.IGNORECASE)
end_pattern = re.compile('(%[a-z0-9.]*)$', re.IGNORECASE)
for line in fd.readlines():
if not line.startswith(prefix):
line = line[len(prefix)+2:]
fmt = line[:line.index('"')]
while True:
m =
if not m:
fmt = pattern.sub(r'([^\2]*)\2', fmt)
m =
if not m:
fmt = end_pattern.sub('(.*)$', fmt)
return re.compile(fmt)
if __name__ == '__main__':
with open('/sys/kernel/debug/tracing/events/tcp/tcp_set_state/format') as fd:
parser = FtraceEventParser.from_fileobj(fd)
example = 'sport=54192 dport=443 saddr= daddr= saddrv6=::ffff: daddrv6=::ffff: oldstate=TCP_ESTABLISHED newstate=TCP_CLOSE_WAIT'
m = parser.parse(example)
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment