Some ways to peek into the behavior of the Linux kernel

To understand the behavior of the Linux kernel, you need a certain voyeur experience, which can be roughly divided into the following:

1. Use printk

directly in the kernel code or module code you want Peeping somewhere printk some information. This approach requires you to compile the kernel code and compile the kernel module, and install it correctly into the kernel and launch it. Although it takes so much knowledge, this method is more earthy. Unless you have to, you must have a simpler method than this.

2. View dmesg

This method depends on what information the kernel will output. The information displayed by dmesg is generally more important information.

3. Proficient procfs

procfs contains a lot of useful and interesting information, either you look directly (special format, difficult to understand), or through tool analysis, such as rtstat, conntrack, etc. The tools are all parsing the files under proc and displaying them in a readable form. Some statistical information about the kernel has a corresponding stat file for analysis.

4. Using kprobe

This is a debugging method, but it is generally not used and is not used.

5. Use some small means

It depends on your intelligence, come up with some logic of your own, guide or smash the kernel, make it into your trap, confirm your guess.