Systemtap

Вещь, однозначно. Ставим (# aptitude install systemtap); пишем скрипт (или берем готовый), в скрипте вешаем обработчики на события (событий богато!), в обработчиках собираем сведения (печатаем и/или анализируем); команда stap создает ядреный модуль, цепляет его к ядру, модуль ловит события и собирает (выводит) данные. По завершении модуль выгружается.

Systemtap is a tool that allows developers and administrators to write and reuse simple scripts to deeply examine the activities of a live Linux system. Data may be extracted, filtered, and summarized quickly and safely, to enable diagnoses of complex performance or functional problems.

...

The essential idea behind a systemtap script is to name events, and to give them handlers. Whenever a specified event occurs, the Linux kernel runs the handler as if it were a quick subroutine, then resumes. There are several kind of events, such as entering or exiting a function, a timer expiring, or the entire systemtap session starting or stopping. A handler is a series of script language statements that specify the work to be done whenever the event occurs. This work normally includes extracting data from the event context, storing them into internal variables, or printing results.

sourceware.org/systemtap/tutorial/Introduction

sourceware.org/systemtap/documentation

Один из примеров:

sourceware.org/systemtap/examples/io/iostats.stp