NoDrop User Guide

This page describes the basic usage of the nodrop command-line interface.

NoDrop captures system events using a kernel module and processes them with a user-space monitor. Users can run NoDrop directly to collect events or attach Lua Chisels for custom analysis.

Command Overview

The nodrop CLI currently supports the following commands:

nodrop start
nodrop start <lua_filename>
nodrop stop
nodrop record [compress | normal | none]
nodrop parse <buf_file> [log_file]

Additional commands may be added in future releases.

---

Starting NoDrop

Start Monitoring

To start NoDrop:

nodrop start

By default, NoDrop will capture events but will not perform any analysis unless a Lua script is provided.

Start with a Chisel (Lua Script)

You can start NoDrop with a Lua script:

nodrop start <lua_filename>

Example:

nodrop start ./count_syscall.lua

In this mode:

• The Lua script will receive captured events
• Custom logic can be executed inside the script
• Events can be filtered, counted, or exported

See Chisels Documentation for details about writing Lua scripts.

---

Stopping NoDrop

To stop monitoring:

nodrop stop

This command will:

• Stop event collection
• Terminate the user-space monitor

---

Recording Events

NoDrop can optionally record captured events to disk.

The recording mode is controlled by:

nodrop record [compress | normal | none]

Disable Recording

nodrop record none

No event files will be written.

Record Raw Event Buffers

nodrop record normal

Captured events will be stored in raw NoDrop buffer format: .buf

This format contains the original binary event stream.

Record Compressed Buffers

nodrop record compress

Captured buffers will be compressed using gzip and stored as: .buf.gz

This reduces disk usage when recording large numbers of events.

---

Event Storage

By default, recorded files are stored in:

• from the Source Code: /tmp/nodrop/
• from Binary Packages: /var/log/nodrop/

This directory can be changed during compilation using the CMake configuration options described in the installation guide.

Each file is named using the format: tid-timestamp

Example:

/tmp/nodrop/23145-17110211234123.buf

Where:

• tid = thread ID
• timestamp = event timestamp (nanoseconds)

---

Parsing Event Files

NoDrop provides a utility to convert raw .buf files into a human-readable log format.

The command is:

nodrop parse <buf_file> [log_file]

Basic Usage

nodrop parse example.buf

If the output file name is not specified, NoDrop will automatically generate a .log file using the same base name.

Example:

example.buf → example.log

Specify Output File

You can explicitly specify the output log file:

nodrop parse example.buf output.log

This will read the binary event stream from example.buf and write the decoded human-readable events to output.log.