Skip to content

NoDrop User Guide

Jump to bottom
Xiankun Chen edited this page Mar 25, 2026 · 2 revisions

This page describes the basic usage of the nodrop command-line interface.

NoDrop captures system events using a kernel module and processes them with a user-space monitor. Users can run NoDrop directly to collect events or attach Lua Chisels for custom analysis.

Command Overview

The nodrop CLI currently supports the following commands:

nodrop start
nodrop start <lua_filename>
nodrop stop
nodrop record [compress | normal | none]

Additional commands may be added in future releases.

Starting NoDrop

Start Monitoring

To start NoDrop:

nodrop start

By default, NoDrop will capture events but will not perform any analysis unless a Lua script is provided.

Start with a Chisel (Lua Script)

You can start NoDrop with a Lua script:

nodrop start <lua_filename>

Example:

nodrop start ./count_syscall.lua

In this mode:

  • The Lua script will receive captured events
  • Custom logic can be executed inside the script
  • Events can be filtered, counted, or exported

See Chisels Documentation for details about writing Lua scripts.

Stopping NoDrop

To stop monitoring:

nodrop stop

This command will:

  • Stop event collection
  • Terminate the user-space monitor

Recording Events

NoDrop can optionally record captured events to disk.

The recording mode is controlled by:

nodrop record [compress | normal | none]

Disable Recording

nodrop record none

No event files will be written.

Record Raw Event Buffers

nodrop record normal

Captured events will be stored in raw NoDrop buffer format: .buf

This format contains the original binary event stream.

Record Compressed Buffers

nodrop record compress

Captured buffers will be compressed using gzip and stored as: .buf.gz

This reduces disk usage when recording large numbers of events.

Event Storage

By default, recorded files are stored in: /tmp/nodrop/

This directory can be changed during compilation using the CMake configuration options described in the installation guide.

Each file is named using the format:

tid-timestamp

Example:

/tmp/nodrop/23145-17110211234123.buf

Where:

  • tid = thread ID
  • timestamp = event timestamp (nanoseconds)

Typical Workflow

A typical NoDrop workflow may look like this:

Start monitoring:

nodrop start

Enable recording:

nodrop record normal

Stop monitoring:

nodrop stop

Clone this wiki locally