Relational access to Unix kernel data structures

Marios Fragkoulis, Diomidis Spinellis, Panos Louridas, Angelos Bilas

Research output: Chapter in Book/Conference proceedings/Edited volumeConference contributionScientificpeer-review

4 Citations (Scopus)


State of the art kernel diagnostic tools like DTrace and Systemtap provide a procedural interface for expressing analysis tasks. We argue that a relational interface to kernel data structures can offer complementary benefits for kernel diagnostics. This work contributes a method and an implementation for mapping a kernel's data structures to a relational interface. The Pico COllections Query Library (PiCO QL) Linux kernel module uses a domain specific language to define a relational representation of accessible Linux kernel data structures, a parser to analyze the definitions, and a compiler to implement an SQL interface to the data structures. It then evaluates queries written in SQL against the kernel's data structures. PiCO QL queries are interactive and type safe. Unlike SystemTap and DTrace, PiCO QL is less intrusive because it does not require kernel instrumentation; instead it hooks to existing kernel data structures through the module's source code. PiCO QL imposes no overhead when idle and needs only access to the kernel data structures that contain relevant information for answering the input queries. We demonstrate PiCO QL's usefulness by presenting Linux kernel queries that provide meaningful custom views of system resources and pinpoint issues, such as security vulnerabilities and performance problems.

Original languageEnglish
Title of host publicationEuroSys 2014: Proceedings of the 9th European Conference on Computer Systems
Publication statusPublished - 1 Jan 2014
Externally publishedYes
Event9th ACM European Conference on Computer Systems, EuroSys 2014 - Amsterdam, Netherlands
Duration: 14 Apr 201416 Apr 2014


Conference9th ACM European Conference on Computer Systems, EuroSys 2014


  • Diagnostics
  • Kernel
  • SQL
  • Unix


Dive into the research topics of 'Relational access to Unix kernel data structures'. Together they form a unique fingerprint.

Cite this