PERF-SCRIPT-PYTHON(1)
💖 PERF-SCRIPT-PYTHON(1) 💖
okay bestie, welcome to the perf Manual page for perf-script-python — yes, the whole title is PERF-SCRIPT-PYTHON(1), and we're about to process trace data with a Python script. no cap, this is giving tutorial energy. 🐍✨
💅 NAME 💅
perf-script-python — process trace data with a Python script. that's literally the name, and it ate. 💅
✨ SYNOPSIS ✨
perf script [-s [Python]:script[.py] ]🌸 DESCRIPTION 🌸
this perf script option is the one that processes perf script data using perf's built-in Python interpreter. it reads and processes the input file and displays the results of the trace analysis implemented in the given Python script, if any. lowkey magic. 🪄
🎀 A QUICK EXAMPLE 🎀
okay so this section is the full start-to-finish glow-up of a working Python script that aggregates and extracts useful info from a raw perf script stream. if an example is enough for you, you can literally skip the rest of this document — but the rest is there to give you more details on each step and to list the library functions available to script writers. 💖
this example is actually the exact steps that were used to create the syscall-counts script you see when you list the available perf script scripts via perf script -l. so yes, this script also shows how to integrate your script into the list of general-purpose perf script scripts listed by that command. iykyk. 📋
the syscall-counts script is a simple script, but it demonstrates all the basic ideas necessary to create a useful script. here’s an example of its output — note that syscall names are not yet supported, they will appear as numbers:
syscall events:
event count
---------------------------------------- -----------
sys_write 455067
sys_getdents 4072
sys_close 3037
sys_swapoff 1769
sys_read 923
sys_sched_setparam 826
sys_open 331
sys_newfstat 326
sys_mmap 217
sys_munmap 216
sys_futex 141
sys_select 102
sys_poll 84
sys_setitimer 12
sys_writev 8
15 8
sys_lseek 7
sys_rt_sigprocmask 6
sys_wait4 3
sys_ioctl 3
sys_set_robust_list 1
sys_exit 1
56 1
sys_access 1basically our task is to keep a per-syscall tally that gets updated every time a system call occurs in the system. our script will do that, but first we need to record the data that will be processed by that script. theoretically, there are a couple of ways we could do that:
- we could enable every event under the
tracing/events/syscallsdirectory, but this is over 600 syscalls, well beyond the number allowable by perf. these individual syscall events will however be useful if we want to later use the guidance we get from the general-purpose scripts to drill down and get more detail about individual syscalls of interest. 👀 - we can enable the
sys_enterand/orsys_exitsyscalls found undertracing/events/raw_syscalls. these are called for all syscalls; theidfield can be used to distinguish between individual syscall numbers. 🔢
for this script, we only need to know that a syscall was entered; we don’t care how it exited, so we’ll use perf record to record only the sys_enter events:
# perf record -a -e raw_syscalls:sys_enter
^C[ perf record: Woken up 1 times to write data ]
[ perf record: Captured and wrote 56.545 MB perf.data (~2470503 samples) ]the options basically say: collect data for every syscall event system-wide and multiplex the per-cpu output into a single stream. that single stream will be recorded in a file in the current directory called perf.data. 🗂️
once we have a perf.data file containing our data, we can use the -g perf script option to generate a Python script that will contain a callback handler for each event type found in the perf.data trace stream (for more details, see the STARTER SCRIPTS section). ✨
# perf script -g python
generated Python script: perf-script.py
The output file created also in the current directory is named
perf-script.py. Here's the file in its entirety:
# perf script event handlers, generated by perf script -g python
# Licensed under the terms of the GNU GPL License version 2
# The common_* event handler fields are the most useful fields common to
# all events. They don't necessarily correspond to the 'common_*' fields
# in the format files. Those fields not available as handler params can
# be retrieved using Python functions of the form common_*(context).
# See the perf-script-python Documentation for the list of available functions.
import os
import sys
sys.path.append(os.environ['PERF_EXEC_PATH'] + \
'/scripts/python/Perf-Trace-Util/lib/Perf/Trace')
from perf_trace_context import *
from Core import *
def trace_begin():
print "in trace_begin"
def trace_end():
print "in trace_end"
def raw_syscalls__sys_enter(event_name, context, common_cpu,
common_secs, common_nsecs, common_pid, common_comm,
id, args):
print_header(event_name, common_cpu, common_secs, common_nsecs,
common_pid, common_comm)
print "id=%d, args=%s\n" % \
(id, args),
def trace_unhandled(event_name, context, event_fields_dict):
print ' '.join(['%s=%s'%(k,str(v))for k,v in sorted(event_fields_dict.items())])
def print_header(event_name, cpu, secs, nsecs, pid, comm):
print "%-20s %5u %05u.%09u %8u %-20s " % \
(event_name, cpu, secs, nsecs, pid, comm),at the top is a comment block followed by some import statements and a path append which every perf script script should include. periodt. 📌
following that are a couple generated functions, trace_begin() and trace_end(), which are called at the beginning and the end of the script respectively (for more details, see the SCRIPT_LAYOUT section below). 🫶
following those are the event handler functions generated one for every event in the perf record output. the handler functions take the form subsystem__event_name, and contain named parameters, one for each field in the event; in this case, there’s only one event, raw_syscalls__sys_enter(). (see the EVENT HANDLERS section below for more info on event handlers). 👑
the final couple of functions are, like the begin and end functions, generated for every script. the first, trace_unhandled(), is called every time the script finds an event in the perf.data file that doesn’t correspond to any event handler in the script. this could mean either that the record step recorded event types that it wasn’t really interested in, or the script was run against a trace file that doesn’t correspond to the script. 💀
the script generated by the -g option simply prints a line for each event found in the trace stream — i.e. it basically just dumps the event and its parameter values to stdout. the print_header() function is simply a utility function used for that purpose. let’s rename the script and run it to see the default output:
# mv perf-script.py syscall-counts.py
# perf script -s syscall-counts.py
raw_syscalls__sys_enter 1 00840.847582083 7506 perf id=1, args=
raw_syscalls__sys_enter 1 00840.847595764 7506 perf id=1, args=
raw_syscalls__sys_enter 1 00840.847620860 7506 perf id=1, args=
raw_syscalls__sys_enter 1 00840.847710478 6533 npviewer.bin id=78, args=
raw_syscalls__sys_enter 1 00840.847719204 6533 npviewer.bin id=142, args=
raw_syscalls__sys_enter 1 00840.847755445 6533 npviewer.bin id=3, args=
raw_syscalls__sys_enter 1 00840.847775601 6533 npviewer.bin id=3, args=
raw_syscalls__sys_enter 1 00840.847781820 6533 npviewer.bin id=3, args=
.
.
.of course, for this script, we’re not interested in printing every trace event, but rather aggregating it in a useful way. so we’ll get rid of everything to do with printing as well as the trace_begin() and trace_unhandled() functions, which we won’t be using. that leaves us with this minimalistic skeleton: 🦴
import os
import sys
sys.path.append(os.environ['PERF_EXEC_PATH'] + \
'/scripts/python/Perf-Trace-Util/lib/Perf/Trace')
from perf_trace_context import *
from Core import *
def trace_end():
print "in trace_end"
def raw_syscalls__sys_enter(event_name, context, common_cpu,
common_secs, common_nsecs, common_pid, common_comm,
id, args):in trace_end(), we’ll simply print the results, but first we need to generate some results to print. to do that we need to have our sys_enter() handler do the necessary tallying until all events have been counted. a hash table indexed by syscall id is a good way to store that information; every time the sys_enter() handler is called, we simply increment a count associated with that hash entry indexed by that syscall id:
syscalls = autodict()
try:
syscalls[id] += 1
except TypeError:
syscalls[id] = 1the autodict object from syscalls is a whole special kind of Python dictionary, ok?? (it lives in Core.py bestie, don't lose it) and it implements Perl's autovivifying hashes but in Python — which is literally just a fancy way of saying you can assign nested hash values without having to do all the tedious work of creating the intermediate levels yourself if they don't already exist. like, syscalls[comm][pid][id] = 1 will just manifest the intermediate hash levels and then finally assign the value 1 to the hash entry for id. and why?? because the value you're assigning isn't a hash object itself, so the initial value gets assigned in the TypeError exception. 🙈 there may be a better way to do this in Python but that's what works for now, and honestly? it ate. 💅
so when you drop that code into the raw_syscalls__sys_enter() handler, you basically end up with a single-level dictionary keyed on syscall id, with the counts you tallied just chilling there as the values. iconic behavior tbh.
then print_syscall_totals() swoops in and iterates over the entries in the dictionary, displaying a line for each entry containing the syscall name — because the dictionary keys contain the syscall ids, which get passed to the Util function syscall_name(), which translates those raw syscall numbers into the corresponding syscall name strings. the output is displayed after all the events in the trace have been processed, by calling print_syscall_totals() from the trace_end() handler that gets called at the end of script processing. no cap, that's the whole flow. 🦋
the final script producing the output shown above is shown in its entirety below (and bestie, note that the syscall_name() helper is not yet available at this point — you can only deal with ids for now 😭):
import os
import sys
sys.path.append(os.environ['PERF_EXEC_PATH'] + \
'/scripts/python/Perf-Trace-Util/lib/Perf/Trace')
from perf_trace_context import *
from Core import *
from Util import *
syscalls = autodict()
def trace_end():
print_syscall_totals()
def raw_syscalls__sys_enter(event_name, context, common_cpu,
common_secs, common_nsecs, common_pid, common_comm,
id, args):
try:
syscalls[id] += 1
except TypeError:
syscalls[id] = 1
def print_syscall_totals():
if for_comm is not None:
print "\nsyscall events for %s:\n\n" % (for_comm),
else:
print "\nsyscall events:\n\n",
print "%-40s %10s\n" % ("event", "count"),
print "%-40s %10s\n" % ("----------------------------------------", \
"-----------"),
for id, val in sorted(syscalls.iteritems(), key = lambda(k, v): (v, k), \
reverse = True):
print "%-40s %10d\n" % (syscall_name(id), val),and you run it exactly like before, no changes, no drama:
# perf script -s syscall-counts.pyso those are the essential steps for writing and running a script, periodt. ✨ the whole process can be generalized to literally any tracepoint or set of tracepoints you're interested in — basically find the tracepoint(s) you want by looking at the list of available events shown by perf list and/or peeking in /sys/kernel/tracing/events/ for detailed event and field info, record the corresponding trace data using perf record while passing it the list of interesting events, generate a skeleton script using perf script -g python, and then modify the code to aggregate and display it for your particular needs. you got this bestie 💪
after you've done all that you may end up with a general-purpose script that you want to keep around and have available for future use — and this is where it gets good. by writing a couple of very simple shell scripts and putting them in the right place, you can have your script listed alongside the other scripts listed by the perf script -l command, like so:
# perf script -l
List of available trace scripts:
wakeup-latency system-wide min/max/avg wakeup latency
rw-by-file <comm> r/w activity for a program, by file
rw-by-pid system-wide r/w activityand a nice side effect of doing this?? you also then capture the probably-lengthy perf record command needed to record the events for the script. multitasking queen behavior honestly 👑
to have the script appear as a built-in script, you write two simple scripts — one for recording and one for reporting. simple as that. 🎀
🌸 the record script 🌸
the record script is a shell script with the same base name as your script, but with -record appended. it should be put into the perf/scripts/python/bin directory in the kernel source tree. in that script, you write the perf record command-line needed for your script:
# cat kernel-source/tools/perf/scripts/python/bin/syscall-counts-record
#!/bin/bash
perf record -a -e raw_syscalls:sys_enter🦋 the report script 🦋
the report script is also a shell script with the same base name as your script, but with -report appended. it should also be located in the perf/scripts/python/bin directory. in that script, you write the perf script -s command-line needed for running your script:
# cat kernel-source/tools/perf/scripts/python/bin/syscall-counts-report
#!/bin/bash
# description: system-wide syscall counts
perf script -s ~/libexec/perf-core/scripts/python/syscall-counts.pyokay so note that the location of the Python script given in the shell script is in the libexec/perf-core/scripts/python directory — this is where the script will be copied by make install when you install perf. for the installation to actually install your script there, your script needs to be located in the perf/scripts/python directory in the kernel source tree:
# ls -al kernel-source/tools/perf/scripts/python
total 32
drwxr-xr-x 4 trz trz 4096 2010-01-26 22:30 .
drwxr-xr-x 4 trz trz 4096 2010-01-26 22:29 ..
drwxr-xr-x 2 trz trz 4096 2010-01-26 22:29 bin
-rw-r--r-- 1 trz trz 2548 2010-01-26 22:29 check-perf-script.py
drwxr-xr-x 3 trz trz 4096 2010-01-26 22:49 Perf-Trace-Util
-rw-r--r-- 1 trz trz 1462 2010-01-26 22:30 syscall-counts.pyonce you've done that — and bestie, do not forget to do a newmake install, otherwise your script won't show up at run-time 😭 —perf script -lshould show a new entry for your script:
# perf script -l
List of available trace scripts:
wakeup-latency system-wide min/max/avg wakeup latency
rw-by-file <comm> r/w activity for a program, by file
rw-by-pid system-wide r/w activity
syscall-counts system-wide syscall countsyou can now perform the record step via perf script record:
# perf script record syscall-countsand display the output using perf script report:
# perf script report syscall-counts✨ STARTER SCRIPTS ✨
you can quickly get started writing a script for a particular set of trace data by generating a skeleton script using perf script -g python in the same directory as an existing perf.data trace file. that will generate a starter script containing a handler for each of the event types in the trace file — and it simply prints every available field for each event in the trace file. literally a free starter pack, we love to see it 🎁
you can also look at the existing scripts in ~/libexec/perf-core/scripts/python for typical examples showing how to do basic things like aggregate event data, print results, etc. also, the check-perf-script.py script — while not interesting for its results — attempts to exercise all of the main scripting features. go little test script go 🧚
💜 EVENT HANDLERS 💜
when perf script is invoked using a trace script, a user-defined handler function gets called for each event in the trace. and if there's no handler function defined for a given event type?? the event is ignored (or passed to a trace_unhandled function, see below) and the next event is processed. moving on, no hard feelings. 💅
most of the event's field values are passed as arguments to the handler function; some of the less common ones aren't — those are available as calls back into the perf executable (see below).
as an example, the following perf record command can be used to record all sched_wakeup events in the system:
# perf record -a -e sched:sched_wakeuptraces meant to be processed using a script should be recorded with the above option: -a to enable system-wide collection. no skipping this one bestie, it's important 🫶
the format file for the sched_wakeup event defines the following fields (see /sys/kernel/tracing/events/sched/sched_wakeup/format):
format:
field:unsigned short common_type;
field:unsigned char common_flags;
field:unsigned char common_preempt_count;
field:int common_pid;
field:char comm[TASK_COMM_LEN];
field:pid_t pid;
field:int prio;
field:int success;
field:int target_cpu;the handler function for this event would be defined as:
def sched__sched_wakeup(event_name, context, common_cpu, common_secs,
common_nsecs, common_pid, common_comm,
comm, pid, prio, success, target_cpu):
passthe handler function takes the form subsystem__event_name. that's the naming rule, don't fight it, it's iconic. ✨
the common_* arguments in the handler's argument list are the set of arguments passed to all event handlers; some of the fields correspond to the common_* fields in the format file, but some are synthesized, and some of the common_* fields aren't common enough to be passed to every event as arguments but are available as library functions. it's giving "common but not that common" energy ngl 💀
here's a brief description of each of the invariant event args:
event_name— the name of the event as textcontext— an opaque 'cookie' used in calls back intoperfcommon_cpu— the cpu the event occurred oncommon_secs— the secs portion of the event timestampcommon_nsecs— the nsecs portion of the event timestampcommon_pid— the pid of the current taskcommon_comm— the name of the current process
all of the remaining fields in the event's format file have counterparts as handler function arguments of the same name, as you can see in the example above. matching names, matching vibes, matching everything. 🎀
and the above provides the basics needed to directly access every field of every event in a trace, which covers like 90% of what you need to know to write a useful trace script. the sections below cover the rest. you're doing amazing sweetie, keep going 💖
✨ SCRIPT LAYOUT ✨
okay bestie, every perf script Python script should start by setting up a Python module search path and importing a few support modules — the module descriptions are lowkey right below 🫶:
import os
import sys
sys.path.append(os.environ['PERF_EXEC_PATH'] + \
'/scripts/python/Perf-Trace-Util/lib/Perf/Trace')
from perf_trace_context import *
from Core import *The rest of the script can contain handler functions and support functions in any order. fr fr, any order 💅.
Aside from the event handler functions discussed above, every script can implement a set of optional functions:
trace_begin, if defined, is called before any event is processed and gives scripts a chance to do setup tasks ✨:
def trace_begin():
passtrace_end, if defined, is called after all events have been processed and gives scripts a chance to do end-of-script tasks, such as display results 🎀:
def trace_end():
passtrace_unhandled, if defined, is called after for any event that doesn’t have a handler explicitly defined for it. The standard set of common arguments are passed into it 👀:
def trace_unhandled(event_name, context, event_fields_dict):
passprocess_event, if defined, is called for any non-tracepoint event 🌈:
def process_event(param_dict):
passcontext_switch, if defined, is called for any context switch 🦋:
def context_switch(ts, cpu, pid, tid, np_pid, np_tid, machine_pid, out, out_preempt, *x):
passauxtrace_error, if defined, is called for any AUX area tracing error 💀:
def auxtrace_error(typ, code, cpu, pid, tid, ip, ts, msg, cpumode, *x):
passThe remaining sections provide descriptions of each of the available built-in perf script Python modules and their associated functions. it’s giving very “here’s the whole toolkit” energy 🔥.
🌈 AVAILABLE MODULES AND FUNCTIONS 🌈
The following sections describe the functions and variables available via the various perf script Python modules. To use the functions and variables from the given module, add the corresponding from XXXX import line to your perf script script. yes, “script script” — we’re keeping the lore 😌.
🧠 Core.py Module 🧠
These functions provide some essential functions to user scripts. main character energy, honestly 👑.
The flag_str and symbol_str functions provide human-readable strings for flag and symbolic fields. These correspond to the strings and values parsed from the print fmt fields of the event format files:
flag_str(event_name, field_name, field_value)— returns the string representation corresponding tofield_valuefor the flag fieldfield_nameof eventevent_namesymbol_str(event_name, field_name, field_value)— returns the string representation corresponding tofield_valuefor the symbolic fieldfield_nameof eventevent_name
The autodict function returns a special kind of Python dictionary that implements Perl’s autovivifying hashes in Python i.e. with autovivifying hashes, you can assign nested hash values without having to go to the trouble of creating intermediate levels if they don’t exist. obsessed, actually 🫶:
autodict()— returns an autovivifying dictionary instance
🦋 perf_trace_context Module 🦋
Some of the common fields in the event format file aren’t all that common, but need to be made accessible to user scripts nonetheless. the way that “common” is doing overtime here 😭.
perf_trace_context defines a set of functions that can be used to access this data in the context of the current event. Each of these functions expects a context variable, which is the same as the context variable passed into every tracepoint event handler as the second argument. For non-tracepoint events, the context variable is also present as perf_trace_context.perf_script_context.
common_pc(context)— returnscommon_preemptcount for the current eventcommon_flags(context)— returnscommon_flagsfor the current eventcommon_lock_depth(context)— returnscommon_lock_depthfor the current eventperf_sample_insn(context)— returns the machine code instructionperf_set_itrace_options(context, itrace_options)— set--itraceoptions if they have not been set alreadyperf_sample_srcline(context)— returnssource_file_name, line_numberperf_sample_srccode(context)— returnssource_file_name, line_number, source_lineperf_config_get(config_name)— returns the value of the named config item, orNoneif unset
🌸 Util.py Module 🌸
Various utility functions for use with perf script — little helpers, big slay 💖:
nsecs(secs, nsecs)— returns total nsecs given secs/nsecs pairnsecs_secs(nsecs)— returns whole secs portion given nsecsnsecs_nsecs(nsecs)— returns nsecs remainder given nsecsnsecs_str(nsecs)— returns printable string in the formsecs.nsecsavg(total, n)— returns average given a sum and a total number of values
👑 SUPPORTED FIELDS 👑
Currently supported fields:
ev_name, comm, id, stream_id, pid, tid, cpu, ip, time, period, phys_addr, addr, symbol, symoff, dso, time_enabled, time_running, values, callchain, brstack, brstacksym, datasrc, datasrc_decode, iregs, uregs, weight, transaction, raw_buf, attr, cpumode.
Fields that may also be present:
flags— sample flagsflags_disp— sample flags displayinsn_cnt— instruction count for determining instructions-per-cycle (IPC)cyc_cnt— cycle count for determining IPCaddr_correlates_sym— addr can correlate to a symboladdr_dso— addr dsoaddr_symbol— addr symboladdr_symoff— addr symbol offset
Some fields have sub items:
brstack:from,to,from_dsoname,to_dsoname,mispred,predicted,in_tx,abort,cycles.brstacksym: items:from,to,pred,in_tx,abort(converted string)
For example, we can use this code to print brstack "from", "to", "cycles".
if brstack in dict: for entry in dict[brstack]: print "from %s, to %s, cycles %s" % (entry["from"], entry["to"], entry["cycles"])💜 SEE ALSO 💜
okay that’s the whole page bestie 💖 this one’s from perf, dated 10/31/2026 — PERF-SCRIPT-PYTHON(1), mwah 💅✨
📦 where this page comes from
- arch rolling: perf 7.3.1-1 · GPL-2.0-only
- 💖 girlified by deepseek-ai/DeepSeek-V4.1-Flash-1017 on : a language model's rewrite of the original, under its terms