Some methods for querying the behavior of Linux kernel

To learn about the behavior of the Linux kernel, you need a certain amount of experience, which can be roughly divided into the following:

1. Use printk

You can view some information about printk directly in the kernel code or module code. In this way, you need to compile the kernel code, compile the kernel module, correctly install it into the kernel, and start it. Although it requires so much knowledge, this method is quite earthy. Unless absolutely required, there must be a simpler method than this.

2. View dmesg

This method depends on what information the kernel will output. Dmesg displays important information.

3. proficient in procfs

Procfs contains a lot of useful and interesting information, either you can directly view the information (the format is special and difficult to understand) or analyze it using tools, such as rtstat, tools such as conntrack are analyzed and displayed in readable form In proc. In general, some kernel statistics have corresponding stat files for analysis.

4. Use kprobe

This is a debugging method, but it is generally not used or used.

5. Use small measures

It depends on your intelligence, come up with some of your own logic, guide or trash the kernel into your trap, and prove your guess.