[PATCH v1 38/58] perf failed-syscalls-by-pid: Port failed-syscalls-by-pid to use python module

Ian Rogers
2026-04-20T00:00:51Z

Ported from tools/perf/scripts/python/failed-syscalls-by-pid.py to use
the perf Python module API.

Key changes:
- Used perf.syscall_name() to resolve syscall names instead of legacy
Util library.
- Used standard collections.defaultdict for nested statistics
aggregation.
- Used errno.errorcode for resolving error strings.
- Supported optional filtering by COMM or PID via command line
arguments.

Assisted-by: Gemini:gemini-3.1-pro-preview
Signed-off-by: Ian Rogers <irogers@google.com>
---
tools/perf/python/failed-syscalls-by-pid.py | 121 ++++++++++++++++++++
1 file changed, 121 insertions(+)
create mode 100755 tools/perf/python/failed-syscalls-by-pid.py

diff --git a/tools/perf/python/failed-syscalls-by-pid.py b/tools/perf/python/failed-syscalls-by-pid.py
new file mode 100755
index 000000000000..3873cff947bc
--- /dev/null
+++ b/tools/perf/python/failed-syscalls-by-pid.py
@@ -0,0 +1,121 @@
+#!/usr/bin/env python3
+# SPDX-License-Identifier: GPL-2.0
+"""
+Displays system-wide failed system call totals, broken down by pid.
+If a [comm] or [pid] arg is specified, only syscalls called by it are displayed.
+
+Ported from tools/perf/scripts/python/failed-syscalls-by-pid.py
+"""
+
+import argparse
+from collections import defaultdict
+import errno
+from typing import DefaultDict, Optional
+import perf
+
+# Type alias to avoid long lines
+SyscallDict = DefaultDict[str, DefaultDict[int, DefaultDict[int, DefaultDict[int, int]]]]
+
+
+def strerror(nr: int) -> str:
+ """Return error string for a given errno."""
+ try:
+ return errno.errorcode[abs(nr)]
+ except KeyError:
+ return f"Unknown {nr} errno"
+
+
+class SyscallAnalyzer:
+ """Analyzes failed syscalls and aggregates counts."""
+
+ def __init__(self, for_comm: Optional[str] = None, for_pid: Optional[int] = None):
+ self.for_comm = for_comm
+ self.for_pid = for_pid
+ # Structure: syscalls[comm][pid][syscall_id][ret] = count
+ self.syscalls: SyscallDict = defaultdict(
+ lambda: defaultdict(
+ lambda: defaultdict(
+ lambda: defaultdict(int)
+ )
+ )
+ )
+
+ def process_event(self, sample: perf.sample_event) -> None:
+ """Process a single sample event."""
+ if str(sample.evsel) not in ("evsel(raw_syscalls:sys_exit)", "evsel(syscalls:sys_exit)"):
+ return
+
+ comm = getattr(sample, "comm", "Unknown")
+ pid = sample.sample_pid
+
+ if self.for_comm and comm != self.for_comm:
+ return
+ if self.for_pid and pid != self.for_pid:
+ return
+
+ ret = getattr(sample, "ret", 0)
+ if ret < 0:
+ syscall_id = getattr(sample, "id", -1)
+ if syscall_id == -1:
+ # Try to get it from another field name if available
+ syscall_id = getattr(sample, "sys_id", -1)
+
+ self.syscalls[comm][pid][syscall_id][ret] += 1
+
+ def print_summary(self) -> None:
+ """Print aggregated statistics."""
+ if self.for_comm is not None:
+ print(f"\nsyscall errors for {self.for_comm}:\n")
+ elif self.for_pid is not None:
+ print(f"\nsyscall errors for PID {self.for_pid}:\n")
+ else:
+ print("\nsyscall errors:\n")
+
+ print(f"{'comm [pid]':<30} {'count':>10}")
+ print(f"{'-' * 30:<30} {'-' * 10:>10}")
+
+ for comm in sorted(self.syscalls.keys()):
+ for pid in sorted(self.syscalls[comm].keys()):
+ print(f"\n{comm} [{pid}]")
+ for syscall_id in sorted(self.syscalls[comm][pid].keys()):
+ try:
+ name = perf.syscall_name(syscall_id)
+ except AttributeError:
+ name = str(syscall_id)
+ print(f" syscall: {name:<16}")
+
+ items = self.syscalls[comm][pid][syscall_id].items()
+ # Sort by count (descending), then by return value
+ sorted_items = sorted(items, key=lambda kv: (kv[1], kv[0]), reverse=True)
+ for ret, val in sorted_items:
+ print(f" err = {strerror(ret):<20} {val:10d}")
+
+
+if __name__ == "__main__":
+ ap = argparse.ArgumentParser(
+ description="Displays system-wide failed system call totals, broken down by pid.")
+ ap.add_argument("-i", "--input", default="perf.data",
+ help="Input file name")
+ ap.add_argument("filter", nargs="?", help="COMM or PID to filter by")
+ args = ap.parse_args()
+
+ F_COMM = None
+ F_PID = None
+
+ if args.filter:
+ try:
+ F_PID = int(args.filter)
+ except ValueError:
+ F_COMM = args.filter
+
+ analyzer = SyscallAnalyzer(F_COMM, F_PID)
+
+ try:
+ print("Press control+C to stop and show the summary")
+ session = perf.session(perf.data(args.input), sample=analyzer.process_event)
+ session.process_events()
+ analyzer.print_summary()
+ except KeyboardInterrupt:
+ analyzer.print_summary()
+ except Exception as e:
+ print(f"Error processing events: {e}")
--
2.54.0.rc1.513.gad8abe7a5a-goog