Skip to content

NoDrop Examples

Jump to bottom
Xiankun Chen edited this page Apr 12, 2026 · 3 revisions

Example: Streaming Compression and Parsing Event Buffers

NoDrop can compress captured event buffers while recording them to disk.
This reduces storage usage when capturing large numbers of system events.

The recorded buffers can later be parsed into human-readable logs using the nodrop parse command.

This example demonstrates a simple workflow:

  1. Enable compressed recording
  2. Capture events
  3. Stop monitoring
  4. Parse the recorded buffers into readable logs

Step 1: Enable Streaming Compression

First enable compressed recording:

nodrop record compress

This instructs NoDrop to compress recorded buffers using gzip.

Step 2: Start Monitoring

Start NoDrop normally:

sudo nodrop start

During execution, NoDrop will capture system events and write compressed buffers to disk.

You can now run any workload you want to observe.

Example:

ls
cat /etc/passwd

Step 3: Stop Monitoring

After running your workload, stop NoDrop:

sudo nodrop stop

Step 4: Recorded Files

Compressed buffers are stored in the default directory:

/tmp/nodrop/

Files are saved using the following format:

tid-timestamp.buf.gz

Example:

/tmp/nodrop/23145-17110211234123.buf.gz

Each file contains compressed NoDrop event buffers generated by the corresponding thread.

Step 5: Decompress the Buffer

Before parsing, decompress the buffer file:

gunzip 23145-17110211234123.buf.gz

This produces:

23145-17110211234123.buf

Step 6: Parse the Event Buffer

Convert the binary buffer into a human-readable log:

nodrop parse 23145-17110211234123.buf

If no output file is specified, NoDrop automatically generates:

23145-17110211234123.log

You can also specify the output file explicitly:

nodrop parse 23145-17110211234123.buf output.log

Step 7: Inspect the Parsed Log

The resulting .log file contains decoded events that can be inspected directly:

1776007891921034989 4086 (7): execve(filename=(NULL), res=0, exe=./scripts/tests/helloworld, args=, tid=4086, pid=4086, ptid=2844, cwd=, fdlimit=1024, pgft_maj=0, pgft_min=29, vm_size=340, vm_rss=4, vm_swap=0, comm=helloworld, cgroups=cpuset=/, env=CLUTTER_IM_MODULE=xim, tty=34816, pgid=4086, loginuid=1000, flags=0x1)
1776007891921304317 4086 (7): brk(addr=0x0, res=0x562ae8d24000, vm_size=4044, vm_rss=16, vm_swap=0)
1776007891921553910 4086 (7): access(mode=0x0, res=-2, name=/etc/ld.so.nohwcap)
1776007891921556557 4086 (7): access(mode=0x4, res=-2, name=/etc/ld.so.preload)
1776007891921560686 4086 (7): openat(fd=3, dirfd=-100, name=/etc/ld.so.cache, flags=0x1001, mode=00, dev=0x801)
1776007891921562893 4086 (7): fstat(fd=, res=3)
1776007891921564609 4086 (7): mmap(addr=0x0, length=77999, prot=0x1, flags=0x2, fd=3, offset=0, res=0x7f73fe70e000, vm_size=4124, vm_rss=1768, vm_swap=0)
1776007891921565513 4086 (7): close(fd=3, res=0)

These logs are generated from the original binary event buffers and provide a convenient way to analyze captured system activity.

Summary

Typical offline analysis workflow:

nodrop record compress
nodrop start
(run workload)
nodrop stop

gunzip *.buf.gz
nodrop parse *.buf

This workflow allows you to efficiently capture large volumes of system events and later convert them into readable logs for analysis.

Clone this wiki locally