Chisels User Guide

This guide explains how to run Chisels in NoDrop.

Chisels are Lua scripts that process system events captured by NoDrop. They allow users to implement custom monitoring logic without modifying NoDrop itself.

To run a Chisel, simply start NoDrop with the Lua script:

nodrop start /path/to/script.lua

Example Chisel

NoDrop provides an example Chisel located at: ./scripts/lua/example.lua

local outfile = "/tmp/nodrop/nodrop_hello_args.log"
local f = io.open(outfile, "w")

if not f then
    print("ERROR: cannot open log file:", outfile)
    return
end

function on_init()
    ftype  = chisel.request_field("evt.type")
    ffd    = chisel.request_field("evt.arg.fd")
    fsize  = chisel.request_field("evt.arg.size")

    f:write("=== hello world arg test ===\n")
    f:flush()
    return true
end

function on_event()
    local t = evt.field(ftype)
    if t == "write" then
        local fd   = evt.field(ffd)
        local size = evt.field(fsize)

        f:write(string.format(
            "write(fd=%s, count=%s)\n",
            tostring(fd),
            tostring(size)
        ))
        f:flush()
    end

    return true
end

Running the Example

To run this Chisel:

nodrop start ./scripts/lua/example.lua

Once started:

• NoDrop begins capturing system events
• The Lua script processes each event
• Matching events are written to the log file

The example script records write system calls and logs their arguments.

Next Steps

After running the example, you can start writing your own Chisels.

See the following documents for more details:

• How to Write a Chisel
• Chisel API Reference Manual

These documents describe the Lua APIs and advanced usage of Chisels.