VMware Communities : Thread List - VProbes

vprobes status

fixitchris — Wed, 23 Sep 2009 18:06:01 GMT

Has there been any advancements in vprobes? Any cool, new things to show us?

Technology Exchange Developer Day - Vprobes -Observing the software stack from top to bottom

navadavuluri — Wed, 19 Aug 2009 02:03:19 GMT

Hello,

We are happy to announce about our demo at Technology Exchange Developer Day 2009, Vprobes -Observing the software stack from top to bottom

Presenter: Rob Benson

Demo ID: DS-21

Time: 10:45 - 11:45 AM

Abstract:

VProbes is an instrumentation framework that enables users to observe VMware and guest software during runtime.
We will also provide a brief overview of the current technology and what the future may hold.

should getsystemtime work under Workstation 6.5 for a linux guest?

visbrero — Thu, 30 Jul 2009 04:23:02 GMT

In the documentation, getsystemtime takes an integer output variable as an argument and returns an integer indicating success (so: int getsystemtime(int)). In practice, it would appear to have a signature of void getsystemtime(int) and do nothing whatsoever. Should it work? Are there platform limitations?

What I want is a way to retrieve the current time (from the perspective of the guest) for a guest that is being replayed. I was hoping getsystemtime would be my solution. My current solution (for a 32-bit Ubuntu 9.04 linux guest using 2.6.28-13) is to retrieve the 8-byte xtime value having looked up the offset via kallsyms. The deficiency is that time only advances when the kernel updates it.

Does VMware maintain a better internal time-clock (or at least a monotonically increasing counter) during replay that is relatively immune to the time cost of running vprobes (and does not increment when suspended)? My overall use-case is to record the execution of a program with no vprobes active. Once I have the recording, I want to replay it with (potentially expensive, at least in aggregate) vprobes in place while also having an idea of what the original timeline was.

If xtime is my best option, I won't complain if you tell me how to turn up the resolution and what would be a reasonable setting to avoid making the execution less realistic because the VM spends all its time handling timer interrupts.

VProbes in PowerShell

fixitchris — Sat, 14 Feb 2009 18:11:02 GMT

I am running into the same issue with PS that I ran into with CMD. Any ideas?

vprobeLoad: error: EOF while looking for ')'
vprobeLoad: 0 warnings, 1 errors*
Error: Unknown error

$execBinary = new-object System.String "C:\Program Files\VMware\VMware Server\vmrun.exe"
$connectParams = new-object System.String "-T server -h https://localhost:8333/sdk -u user -p pass "
$commandParam = new-object System.String "vprobeLoad "
$vmxParam = new-object System.String '"[standard] store\Windows Server 2003 Standard Edition.vmx" '
$vpParam = @"
'(vprobe VMM1Hz (printf "hello "))'
"@

$startinfo = new-object System.Diagnostics.ProcessStartInfo
$startinfo.FileName = $execBinary
$startinfo.Arguments = $connectParams + $commandParam + $vmxParam + $vpParam
$startinfo.UseShellExecute = $false
$startinfo.RedirectStandardOutput = $true 
$process = [http://System.Diagnostics.Process|http://System.Diagnostics.Process]::Start($startinfo)
$process.WaitForExit()
$process.StandardOutput.ReadToEnd()

vmrun vprobeLoad my.vmx '(vprobe VMM1Hz (printf "hello!\n"))'
The cmd command tool on Windows permits nesting of like‐type quotes only, either single or double quotes
but not both, so the above vmrun command produces the error message “unknown ident windows” and fails.
You probably want to install Cygwin so you can run VP scripts in a standard bash shell.

Using WinDbg symbol files

fixitchris — Fri, 06 Mar 2009 14:20:16 GMT

1. Install WinDbg inside the guest. You will need to generate symbol files from the guest since this is the Windows version you will be hooking vprobes to.

2. Create a local or remote symbol server per Debugging Applications for Microsoft .NET and Microsoft Windows Part I, Chapter 2 and run the following command from the WinDbg folder:
google:Applications_net_windows

cscript ossyms2.0.js \\symbols\path

This will take some time to complete and you should end up with a couple gigs of modules and their PDBs.

3. Run WinDbg in local kernel debugging mode on the guest and issue the following command, replacing <modulename> with an actual module name:

x <modulename>!*

4. Save the output from WinDbg: Edit > Write Window Text to File

5. Place the saved file in the guest datastore directory.

6. Stop the guest.

7. Edit the VMX file to include

vprobe.enable = "TRUE"
vprobe.guestSyms = "symbolFile.TXT"

8. Start the guest.

9. Issue the vprobeListProbes command to view your imported events.

The attached probes.txt file contains all my events with the NT module imported. nt.txt is the file I am importing with vprobe.guestSyms. I am not sure if this will be a problem but the event names look like:


GUEST:t!MiShutdownSystem*

instead of


GUEST:nt!MiShutdownSystem*

Any insight on this?

UPDATE FROM VMWARE:

This looks like an issue with our internal parsing logic for windbg-style symbol text files. Try adding a "0`" (w/o the double quotes) to each of the lines and you should see the full, intact probe names.

I will check this out and post my results...

http://windbg.info

Configuration Parameters

fixitchris — Wed, 18 Feb 2009 21:20:40 GMT

Can you elaborate on the extensibility and limitations of the various parameters? In particular, I am interested on using IO-streams with vpFile and outFile.

Table 3-2. VProbes-Relates Configuration Parameters
Parameter Description
vprobe.allow Site‐wide flag globally allowing or disallowing VProbes usage.
vprobe.enable Per‐VM flag enabling VProbes.
vprobe.vpFile An alternate method to specify a VP source file.
vprobe.outFile Use a different file for Vprobes output.
vprobe.guestSyms File containing guest symbols.
vprobe.syscalls File containing a list equating syscall numbers with names.

Fix for linux26-32-process.emt

nitingupta — Fri, 03 Apr 2009 18:49:40 GMT

I noticed junk returned by curprocname() defined in linux26-32-process.emt (included in vprobe-toolkit)

Following patch fixes it:

$ diff -u /tmp/linux26-32-process.emt vp/linux26-32-process.emt
--- /tmp/linux26-32-process.emt 2009-04-04 00:03:42.182700000 +0530
+++ vp/linux26-32-process.emt   2009-04-03 23:58:58.436700000 +0530
@@ -45,7 +45,7 @@
       _pidOffset = offatret("sys_getpid");
       _nameOffset = offatstrcpy("get_task_comm");
    }
-   return RSP & 0xffffe000;
+   return RSP & 0xfffff000;
 }

This is because all recent Linux kernels have 4K per-process kernel stack.
$ cat /boot/config-2.6.27.19-170.2.35.fc10.i686 | grep 4KSTACKS
CONFIG_4KSTACKS=y

BTW, where can I find documentation for 'offatret()' and 'offatstrcpy()' used in curthrptr() ?

Thanks,
Nitin

Memory accesses of OS processes

moussaba — Tue, 21 Apr 2009 00:45:25 GMT

Good Day,

I would like to gather statistics on memory accesses for processes under a vm, things like number of memory read, writes, time of occurence for specific processes in a VM. Does vprobe have events and mechanisms allowing me to gather this information? I am interested on gathering this data for both linux and windows.

Thank you.

GUEST_READ GUEST_WRITE address ranges?

moussaba — Wed, 22 Apr 2009 04:54:32 GMT

Is it possible to define a data probe for a range of addresses. In other words, GUEST_READ triggers a data probe when a particular address is read. Is it possible to define a data probe for a range of address where an event will be generated whenever a range is read or written to.

vprobe and Fusion

moussaba — Wed, 22 Apr 2009 04:52:36 GMT

Looking at the vprobes programmer's reference. There is mention of enabling fusion via /Library.... I assume this means that Fusion 2.0 has full vprobes support.

Vprobe-toolkit in Windows

fixitchris — Sun, 15 Feb 2009 16:29:57 GMT

#1 Enable Vprobes on Server 2.0 per http://communities.vmware.com/thread/193662, including CYGWIN install
#2 Install TortoiseSVN http://tortoisesvn.tigris.org/
#3 SVN Checkout... https://vprobe-toolkit.svn.sourceforge.net/svnroot/vprobe-toolkit
#4 Install WinHugs http://www-users.cs.york.ac.uk/~ndm/downloads/
#5 Place winprobe script in your vprobe-toolkit\bin folder created in step #3

There are some user defined constants in the winprobe script. I would like it if somebody posted an update to the winprobe script as I am not familiar with bash scripting.

User defined winprobe constants:

COMPILER=/cygdrive/c/progra~1/winhugs/runhugs.exe
VMRUNCNX=" -T server -h https://localhost:8333/sdk -u user -p pass"
VMRUN=/cygdrive/c/progra~1/VMware/VMware~1/vmrun.exe$VMRUNCNX

out=$($COMPILER -98 c:\\vprobe-toolkit\\emmett\\main.lhs -c "$cmd" $compileargs $files) || die "compile error" 2
VMRUNOUT=$($VMRUN vprobeLoad "$VM" "$out" 2>&1)|| die "vmrun error:$VMRUNOUT" 3

winprobe execution takes three parameters to load a probe from a VP source file (Emmet script):

./winprobe [vpsourcefile] /path/to/vm /path/to/vm_directory

#6 Open CYGWIN shell and set environment variables to help with execution:

VM1="[standard] store\Windows Server 2003 Standard Edition.vmx"
VM1DIR="/cygdrive/d/virtua~1/store"

You can also set these variables permanently within the Windows System Environment Variables

#7 Load a probe:
hello.emt:

VMM10Hz {
   logstr("Hi\n");
}

./winprobe hello.emt "$VM1" "$VM1DIR"

You should see output every 100ms...

Shortcut Keys to Get out of Full Screen in WinXP (Vmware Fusion 1.1.1)

Rob95814 — Fri, 27 Feb 2009 22:46:05 GMT

What is the key combination to get Vmware to revert to the non-fullscreen display of WinXP (very basic question but I did not see the answer when it flashed past)

Vprobes w/o vmrun

fixitchris — Thu, 26 Feb 2009 00:28:16 GMT

I have been browsing through vix.dll 1.6.2 and I have noticed a couple of interesting functions:

VixVM_GetVProbes
VixVM_GetVProbesVersion
VixVM_VProbeGetGlobalVars
VixVM_VProbeLoad
VixVM_VProbeReset
etc...

Would it be possible to get their signatures?

Trying this out...

cwliner — Fri, 20 Feb 2009 19:49:00 GMT

I tried to use the sample code and am getting an error.

I tried to run:

vmrun vprobeLoad Windows\ XP\ Professional.vmx "'cat vptop.vp'"

vprobeLoad: error: illegal variable reference in top-level context

I thought it might be a bug in the example, but I tried going back to a simple Hello! type script and I get the same error. If I type it out on the command line, the Hello! script works, but in a file it does not.

If I put the vptop.vp example on the command line, I get another error.

vprobeLoad: error: unknown callee cpuprocname

Any ideas?

I am running Redhat ES 4.7 on this machine, with VMWorkstation 6.5.

Thanks!

Cameron Liner
Cameron.Liner@arnold.af.mil

VProbes: a stethoscope for your VM (blog, video)

JohnTroyer — Sat, 14 Feb 2009 00:53:19 GMT

Keith and I made this video some months ago to introduce VProbes and show it off a bit. It's the most entertaining 20 minutes about a very geeky subject you'll encounter today. Enjoy.

http://blogs.vmware.com/vmtn/2008/06/introducing-vpr.html

Community Sample Code Repository for VProbes ?

heyitspablo — Thu, 19 Feb 2009 00:32:48 GMT

Folks - If you have any interesting, and useful VProbes sample code you would like to share with our community please consider using our Community Sample Code repository: http://communities.vmware.com/community/developer/utilities?view=documents

If you do contribute please tag it by language and product so it makes it easier to search..

Many thanks

Pablo

existing examples/support code for probing user-level code?

visbrero — Wed, 18 Feb 2009 04:45:12 GMT

I would like to use vprobes to perform some user-level probing. I'd be shocked if someone hasn't aready done the legwork required to make this happen (aka making finding the linear address easier), but I'm having trouble finding such a thing. The closest thing I have found is dwarffrob.py in vprobe-toolkit's bin dir... it's not what's required, but it's in the same city as the ballpark.

VProbes on ESX

c_shanklin — Wed, 18 Feb 2009 15:59:35 GMT

Is this possible today with ESX 3.5? I think the answer is no but I'm honestly not sure.

How about with ESX 4?

Welcome VProbes Developers to our shiny new community

heyitspablo — Tue, 10 Feb 2009 19:18:06 GMT

Folks - we are very happy to open up our new shiny community for our VProbes Developers ! Enjoy

Pablo Roesch
http://vmware.com/developer