dtrace discuss - May 2009 - How to use pid provider on certain processes.

I know this has been asked before, but I can''t seem to find the answer.

I have a process I want to trace with the pid provider, but the 
process gets started once in a while. There is only one process by its 
name running at a time.

I can''t see how to use the pid provider in these circumstances. 
Specifically, in this case the process is called "ntpd" and I want to 
trace all calls to memcpy. Any ideas how to do this?
-- 
blu

"Mark my words, nanotechnology is going to be huge!"
----------------------------------------------------------------------
Brian Utterback - Solaris RPE, Sun Microsystems, Inc.
Ph:877-259-7345, Em:brian.utterback-at-ess-you-enn-dot-kom

On Mon, May 11, 2009 at 4:37 PM, Brian Utterback
<brian.utterback at sun.com> wrote:
> I know this has been asked before, but I can''t seem to find the
answer.
>
> I have a process I want to trace with the pid provider, but the process
gets
> started once in a while. There is only one process by its name running at a
> time.
>
> I can''t see how to use the pid provider in these circumstances.
> Specifically, in this case the process is called "ntpd" and I
want to trace
> all calls to memcpy. Any ideas how to do this?
I can think of a couple of ways.  One is to trace exec-success, stop()
if execname == "ntpd", and prun it via system().  Something like this:

#!/usr/sbin/dtrace -qws

proc:::exec-success
/ execname == "ls" /
{
        stop();
        system("/tmp/trace-ls.d -p %d", pid);
}

The second DTrace script will start ls (or in your case, ntpd)
running, so there''s no need for a prun or equivalent.

The second way is to just replace ntpd with a wrapper DTrace script
that calls the real version of ntpd.

Chad