[PATCH v1 28/58] perf syscall-counts-by-pid: Port syscall-counts-by-pid to use python module

From: Ian Rogers

Date: Sun Apr 19 2026 - 20:07:47 EST


Rewrite tools/perf/scripts/python/syscall-counts-by-pid.py to use the
python module and various style changes. By avoiding the overheads in
the `perf script` execution the performance improves by more than 3.8x
as shown in the following (with PYTHON_PATH and PERF_EXEC_PATH set as
necessary):

```
$ perf record -e raw_syscalls:sys_enter -a sleep 1
...
$ time perf script tools/perf/scripts/python/syscall-counts-by-pid.py perf
Install the python-audit package to get syscall names.
For example:
# apt-get install python3-audit (Ubuntu)
# yum install python3-audit (Fedora)
etc.

Press control+C to stop and show the summary
Warning:
1 out of order events recorded.

syscall events for perf:

comm [pid]/syscalls count
--------------------------------------- ----------

perf [3886080]
1 538989
16 32
203 17
3 2
257 1
204 1
15 1
0 1

perf [3886082]
7 1

real 0m3.852s
user 0m3.512s
sys 0m0.336s
$ time python3 tools/perf/python/syscall-counts-by-pid.py perf
Warning:
1 out of order events recorded.

syscall events for perf:

comm [pid]/syscalls count
--------------------------------------- -----------

perf [3886080]
write 538989
ioctl 32
sched_setaffinity 17
close 2
openat 1
sched_getaffinity 1
rt_sigreturn 1
read 1

perf [3886082]
poll 1

real 0m1.011s
user 0m0.963s
sys 0m0.048s
```

Signed-off-by: Ian Rogers <irogers@xxxxxxxxxx>
---
tools/perf/python/syscall-counts-by-pid.py | 57 ++++++++++++++++++++++
1 file changed, 57 insertions(+)
create mode 100755 tools/perf/python/syscall-counts-by-pid.py

diff --git a/tools/perf/python/syscall-counts-by-pid.py b/tools/perf/python/syscall-counts-by-pid.py
new file mode 100755
index 000000000000..a5d91060b18d
--- /dev/null
+++ b/tools/perf/python/syscall-counts-by-pid.py
@@ -0,0 +1,57 @@
+#!/usr/bin/env python3
+# SPDX-License-Identifier: GPL-2.0
+# Displays system-wide system call totals, broken down by syscall.
+# If a [comm] arg is specified, only syscalls called by [comm] are displayed.
+
+import argparse
+from collections import defaultdict
+import perf
+
+syscalls = defaultdict(lambda: defaultdict(lambda: defaultdict(int)))
+for_comm = None
+session = None
+
+
+def print_syscall_totals():
+ if for_comm is not None:
+ print(f"\nsyscall events for {for_comm}:\n")
+ else:
+ print("\nsyscall events:\n")
+
+ print(f"{'comm [pid]/syscalls':<40} {'count':>10}")
+ print("---------------------------------------- -----------")
+
+ comm_keys = syscalls.keys()
+ for comm in comm_keys:
+ pid_keys = syscalls[comm].keys()
+ for pid in pid_keys:
+ print(f"\n{comm} [{pid}]")
+ id_keys = syscalls[comm][pid].keys()
+ for id, val in sorted(syscalls[comm][pid].items(),
+ key=lambda kv: (kv[1], kv[0]), reverse=True):
+ print(f" {perf.syscall_name(id):<38} {val:>10}")
+
+
+def process_event(sample):
+ event_name = str(sample.evsel)
+ if event_name == "evsel(raw_syscalls:sys_enter)":
+ id = sample.id
+ elif event_name.startswith("evsel(syscalls:sys_enter_"):
+ id = sample.__syscall_nr
+ else:
+ return
+ pid = sample.sample_pid
+ comm = session.process(pid).comm()
+ if for_comm and comm != for_comm:
+ return
+ syscalls[comm][pid][id] += 1
+
+
+if __name__ == "__main__":
+ ap = argparse.ArgumentParser()
+ ap.add_argument("comm", nargs="?", help="Only report syscalls for comm")
+ args = ap.parse_args()
+ for_comm = args.comm
+ session = perf.session(perf.data("perf.data"), sample=process_event)
+ session.process_events()
+ print_syscall_totals()
--
2.54.0.rc1.513.gad8abe7a5a-goog