[PATCH v6 27/59] perf syscall-counts: Port syscall-counts to use python module

Ian Rogers
2026-04-25T17:49:55Z

Rewrite tools/perf/scripts/python/syscall-counts.py to use the python
module and various style changes. By avoiding the overheads in the
`perf script` execution the performance improves by more than 4x as
shown in the following (with PYTHON_PATH and PERF_EXEC_PATH set as
necessary):

```
$ perf record -e raw_syscalls:sys_enter -a sleep 1
...
$ time perf script tools/perf/scripts/python/syscall-counts.py perf
Install the python-audit package to get syscall names.
For example:
# apt-get install python3-audit (Ubuntu)
# yum install python3-audit (Fedora)
etc.

Press control+C to stop and show the summary
Warning:
1 out of order events recorded.

syscall events for perf:

event count
-------------------------------------- ------------
1 538989
16 32
203 17
3 2
257 1
204 1
15 1
7 1
0 1

real 0m3.887s
user 0m3.578s
sys 0m0.308s
$ time python3 tools/perf/python/syscall-counts.py perf
Warning:
1 out of order events recorded.

syscall events for perf:

event count
-------------------------------------- ------------
write 538989
ioctl 32
sched_setaffinity 17
close 2
openat 1
sched_getaffinity 1
rt_sigreturn 1
poll 1
read 1

real 0m0.953s
user 0m0.905s
sys 0m0.048s
```

Assisted-by: Gemini:gemini-3.1-pro-preview
Signed-off-by: Ian Rogers <irogers@google.com>
---
v2:

1. Fallback for Unknown Syscalls: If perf.syscall_name() returns None
for an unmapped ID, the script now falls back to using the numeric
ID string. This prevents a TypeError when applying string alignment
formatting.

2. Fallback for Syscall Number Attribute: The script now checks for
__syscall_nr first, and if not present (as on some older kernels),
falls back to checking for nr .

3. Robust Process Resolution: Added a try-except block around
session.process(sample.pid).comm() . If the process lookup fails
(returning NULL/None), it falls back to "unknown" instead of
letting a TypeError crash the script.

4. Support for Custom Input Files: Added a -i / --input command-line
argument to allow processing arbitrarily named trace files,
removing the hardcoded "perf.data" restriction.
---
tools/perf/python/syscall-counts.py | 72 +++++++++++++++++++++++++++++
1 file changed, 72 insertions(+)
create mode 100755 tools/perf/python/syscall-counts.py

diff --git a/tools/perf/python/syscall-counts.py b/tools/perf/python/syscall-counts.py
new file mode 100755
index 000000000000..ef2bd8c7b24c
--- /dev/null
+++ b/tools/perf/python/syscall-counts.py
@@ -0,0 +1,72 @@
+#!/usr/bin/env python3
+# SPDX-License-Identifier: GPL-2.0
+"""
+Displays system-wide system call totals, broken down by syscall.
+
+If a [comm] arg is specified, only syscalls called by [comm] are displayed.
+"""
+
+import argparse
+from collections import defaultdict
+from typing import DefaultDict
+import perf
+
+syscalls: DefaultDict[int, int] = defaultdict(int)
+for_comm = None
+session = None
+
+
+def print_syscall_totals():
+ """Print aggregated statistics."""
+ if for_comm is not None:
+ print(f"\nsyscall events for {for_comm}:\n")
+ else:
+ print("\nsyscall events:\n")
+
+ print(f"{'event':<40} {'count':>10}")
+ print("---------------------------------------- -----------")
+
+ for sc_id, val in sorted(syscalls.items(),
+ key=lambda kv: (kv[1], kv[0]), reverse=True):
+ name = perf.syscall_name(sc_id) or str(sc_id)
+ print(f"{name:<40} {val:>10}")
+
+
+def process_event(sample):
+ """Process a single sample event."""
+ event_name = str(sample.evsel)
+ if event_name == "evsel(raw_syscalls:sys_enter)":
+ sc_id = getattr(sample, "id", -1)
+ elif event_name.startswith("evsel(syscalls:sys_enter_"):
+ sc_id = getattr(sample, "__syscall_nr", None)
+ if sc_id is None:
+ sc_id = getattr(sample, "nr", -1)
+ else:
+ return
+
+ if sc_id == -1:
+ return
+
+ comm = "unknown"
+ try:
+ if session:
+ proc = session.find_thread(sample.sample_pid)
+ if proc:
+ comm = proc.comm()
+ except (TypeError, AttributeError):
+ pass
+
+ if for_comm and comm != for_comm:
+ return
+ syscalls[sc_id] += 1
+
+
+if __name__ == "__main__":
+ ap = argparse.ArgumentParser()
+ ap.add_argument("comm", nargs="?", help="Only report syscalls for comm")
+ ap.add_argument("-i", "--input", default="perf.data", help="Input file name")
+ args = ap.parse_args()
+ for_comm = args.comm
+ session = perf.session(perf.data(args.input), sample=process_event)
+ session.process_events()
+ print_syscall_totals()
--
2.54.0.545.g6539524ca2-goog