Oracle trace events hunting : Events annotations/Events Sniffing

Based on my previous blog posts :

• Oracle trace events hunting : dbgdChkEventIntV
• Oracle trace events hunting : Undocumented events/Filling the gaps
• Oracle trace events hunting : KST tracing/ X$TRACE

I created two files that can help us to quickly extract Events checked in specific oracle core function :

• oracle_function_to_event_mapping18c.txt
• oracle_function_to_event_mapping18c.sed

Using those files we can for example :

Example 1 : (Annotated flame-graph) Have an annotated flame graph which can be useful to quickly check which events can be used to dig deeper.

Here is for example two flame-graphs annotated and not annotated after executing select count(*) from dba_objects :

No annotated :

perf record -g -p 2022
perf script | FlameGraph-master/stackcollapse-perf.pl > out.perf-folded
FlameGraph-master/flamegraph.pl out.perf-folded > perf-oracle.svg

Annotated :

perf record -g -p 2022
perf script | FlameGraph-master/stackcollapse-perf.pl > out.perf-folded
cat out.perf-folded | sed -f oracle_function_to_event_mapping18c.sed > out_annotate.perf-folded
FlameGraph-master/flamegraph.pl out_annotate.perf-folded > perf-oracle_annotate.svg

Example 2 :(Event Sniffer) We can also use the debugtrace.so pin tool to extract “all” checked events in specific execution path  : After executing select * from dual for example

./pin -pid 2677 -t source/tools/DebugTrace/obj-intel64/debugtrace.so
grep -i call debugtrace.out | awk -F':' '{print $2}' | awk -F'+' '{print $1}' | egrep -v ">" | sort -u | sed -f oracle_function_to_event_mapping18c.sed | grep EVENT

Example 3 :(Extract Checked event ) Quickly extract checked events in a specific core oracle function :

That’s it 😀