Hey Josh,
Apologies for the extremely long delay in getting back to you.
The code for the chown(2) system call eventually pokes the setattr vnode
operation. From that I deduced that you should look at the following probes:
fbt::rfs3_setattr:entry
fbt::rfs4_op_setattr:entry
For either you can pick apart the arguments and use predicates to view only
changes to the file owner (chown). For example:
fbt::rfs3_setattr:entry
/args[0]->new_attributes.uid.set_it/
{
trace("some file got chowned! I can figure out which, but waiting until
nfs3_fhtovp() is called");
}
Adam
On Sep 2, 2009, at 7:50 PM, Josh Kline wrote:
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
>
> I am new to dtrace and am trying to use it to investigate changes in
> file ownership taking place on nfs client machines. (My Solaris box
> serves several nfs mounts.) I want to know about the program operating
> on the client side of the nfs mount: what is the remote uid, gid,
> process name, cwd, etc
>
> Apparently that process does not use any of these system calls:
> syscall::chown:entry,
> syscall::fchown:entry,
> syscall::lchown:entry
>
> Out of the many
> fbt:nfs::entry,
> fbt:nfssrv::entry
> probes, which ones should I be looking at?
> Where can I look to determine the purpose of each function being
> called/traced?
>
> My server runs Solaris 10 update 7.
> My client for testing is running OS X 10.5.
> Clients in production use Debian 4.1.1-21 (etch)
>
> This is my current dtrace script:
> <script>
> BEGIN
> {
> trace("beginning!");
> }
>
> syscall::chown:entry
> /* execname != "gconfd-2" */
> {
> printf("\nexecname=%s, pid=%d\n", execname, pid);
> printf( "\t\tcwd=%s\n", cwd );
> printf( "\t\tpath=%s, owner=%d, group=%d\n",
> copyinstr(arg0), arg1, arg2 );
> stack();
> }
>
> syscall::fchown:entry,
> syscall::lchown:entry
> {
> printf("\t\tprobefunc=%s, execname=%s, pid=%d\n",
> probefunc, execname, pid);
>
> }
>
>
> fbt:genunix:chown:entry,
> fbt:genunix:fchown:entry,
> fbt:genunix:lchown:entry,
> fbt:genunix:cfchownat:entry,
> fbt:genunix:fchownat:entry,
> fbt:nfssrv:rfs4_fattr4_chown_restricted:entry,
> fbt:nfs::entry,
> fbt:nfssrv::entry
> {
> printf("\t\t%s:%s:%s:%s", probeprov, probemod, probefunc,
probename );
> /*
> printf("\t\texecname=%s, pid=%d\n", execname, pid);
> printf("\tstack:\n");
> stack();
> */
> }
>
>
> END
> {
> trace ("ending!");
> }
> </script>
>
> and the current output
> <output>
> CPU ID FUNCTION:NAME
> 0 1 :BEGIN beginning!
>
> 0 45192 nfssys:entry fbt:nfs:nfssys:entry
> 0 45192 nfssys:entry fbt:nfs:nfssys:entry
> 0 46030 rfs_dispatch:entry
> fbt:nfssrv:rfs_dispatch:entry
> 0 46022 common_dispatch:entry
> fbt:nfssrv:common_dispatch:entry
> 0 44792 xdr_ACCESS3args:entry
> fbt:nfs:xdr_ACCESS3args:entry
> 0 45610 xdr_nfs_fh3_server:entry
> fbt:nfs:xdr_nfs_fh3_server:entry
> 0 43887 xdr_decode_nfs_fh3:entry
> fbt:nfs:xdr_decode_nfs_fh3:entry
> 0 44934 xdr_inline_decode_nfs_fh3:entry
> fbt:nfs:xdr_inline_decode_nfs_fh3:entry
> 0 47354 rfs3_access_getfh:entry
> fbt:nfssrv:rfs3_access_getfh:entry
> 0 46720 checkexport:entry
> fbt:nfssrv:checkexport:entry
> 0 46926 nfs_fhhash:entry
> fbt:nfssrv:nfs_fhhash:entry
> 0 46024 checkauth:entry
> fbt:nfssrv:checkauth:entry
> 0 47080 nfsauth_access:entry
> fbt:nfssrv:nfsauth_access:entry
> 0 46890 nfsauth_cache_get:entry
> fbt:nfssrv:nfsauth_cache_get:entry
> 0 46058 addrmask:entry
> fbt:nfssrv:addrmask:entry
> 0 46056 hash:entry
> fbt:nfssrv:hash:entry
> 0 46876 rfs3_access:entry
> fbt:nfssrv:rfs3_access:entry
> 0 46916 nfs3_fhtovp:entry
> fbt:nfssrv:nfs3_fhtovp:entry
> 0 47080 nfsauth_access:entry
> fbt:nfssrv:nfsauth_access:entry
> 0 46890 nfsauth_cache_get:entry
> fbt:nfssrv:nfsauth_cache_get:entry
> 0 46058 addrmask:entry
> fbt:nfssrv:addrmask:entry
> 0 46056 hash:entry
> fbt:nfssrv:hash:entry
> 0 47140 rfs4_delegated_getattr:entry
> fbt:nfssrv:rfs4_delegated_getattr:entry
> 0 47198 vattr_to_post_op_attr:entry
> fbt:nfssrv:vattr_to_post_op_attr:entry
> 0 46042 vattr_to_fattr3:entry
> fbt:nfssrv:vattr_to_fattr3:entry
> 0 46020 auth_tooweak:entry
> fbt:nfssrv:auth_tooweak:entry
> 0 44844 xdr_ACCESS3res:entry
> fbt:nfs:xdr_ACCESS3res:entry
> 0 44766 xdr_post_op_attr:entry
> fbt:nfs:xdr_post_op_attr:entry
> 0 43891 xdr_fattr3:entry
> fbt:nfs:xdr_fattr3:entry
> 0 44792 xdr_ACCESS3args:entry
> fbt:nfs:xdr_ACCESS3args:entry
> 0 45008 xdr_nfs_fh3:entry
> fbt:nfs:xdr_nfs_fh3:entry
> 0 47384 exi_rele:entry
> fbt:nfssrv:exi_rele:entry
> 0 45192 nfssys:entry fbt:nfs:nfssys:entry
> 0 45192 nfssys:entry fbt:nfs:nfssys:entry
> 0 46030 rfs_dispatch:entry
> fbt:nfssrv:rfs_dispatch:entry
> 0 46022 common_dispatch:entry
> fbt:nfssrv:common_dispatch:entry
> 0 44792 xdr_ACCESS3args:entry
> fbt:nfs:xdr_ACCESS3args:entry
> 0 45610 xdr_nfs_fh3_server:entry
> fbt:nfs:xdr_nfs_fh3_server:entry
> 0 43887 xdr_decode_nfs_fh3:entry
> fbt:nfs:xdr_decode_nfs_fh3:entry
> 0 44934 xdr_inline_decode_nfs_fh3:entry
> fbt:nfs:xdr_inline_decode_nfs_fh3:entry
> 0 47354 rfs3_access_getfh:entry
> fbt:nfssrv:rfs3_access_getfh:entry
> 0 46720 checkexport:entry
> fbt:nfssrv:checkexport:entry
> 0 46926 nfs_fhhash:entry
> fbt:nfssrv:nfs_fhhash:entry
> 0 46024 checkauth:entry
> fbt:nfssrv:checkauth:entry
> 0 47080 nfsauth_access:entry
> fbt:nfssrv:nfsauth_access:entry
> 0 46890 nfsauth_cache_get:entry
> fbt:nfssrv:nfsauth_cache_get:entry
> 0 46058 addrmask:entry
> fbt:nfssrv:addrmask:entry
> 0 46056 hash:entry
> fbt:nfssrv:hash:entry
> 0 46876 rfs3_access:entry
> fbt:nfssrv:rfs3_access:entry
> 0 46916 nfs3_fhtovp:entry
> fbt:nfssrv:nfs3_fhtovp:entry
> 0 47080 nfsauth_access:entry
> fbt:nfssrv:nfsauth_access:entry
> 0 46890 nfsauth_cache_get:entry
> fbt:nfssrv:nfsauth_cache_get:entry
> 0 46058 addrmask:entry
> fbt:nfssrv:addrmask:entry
> 0 46056 hash:entry
> fbt:nfssrv:hash:entry
> 0 47140 rfs4_delegated_getattr:entry
> fbt:nfssrv:rfs4_delegated_getattr:entry
> 0 47198 vattr_to_post_op_attr:entry
> fbt:nfssrv:vattr_to_post_op_attr:entry
> 0 46042 vattr_to_fattr3:entry
> fbt:nfssrv:vattr_to_fattr3:entry
> 0 46020 auth_tooweak:entry
> fbt:nfssrv:auth_tooweak:entry
> 0 44844 xdr_ACCESS3res:entry
> fbt:nfs:xdr_ACCESS3res:entry
> 0 44766 xdr_post_op_attr:entry
> fbt:nfs:xdr_post_op_attr:entry
> 0 43891 xdr_fattr3:entry
> fbt:nfs:xdr_fattr3:entry
> 0 44792 xdr_ACCESS3args:entry
> fbt:nfs:xdr_ACCESS3args:entry
> 0 45008 xdr_nfs_fh3:entry
> fbt:nfs:xdr_nfs_fh3:entry
> 0 47384 exi_rele:entry
> fbt:nfssrv:exi_rele:entry
> 0 46030 rfs_dispatch:entry
> fbt:nfssrv:rfs_dispatch:entry
> 0 46022 common_dispatch:entry
> fbt:nfssrv:common_dispatch:entry
> 0 44792 xdr_ACCESS3args:entry
> fbt:nfs:xdr_ACCESS3args:entry
> 0 45610 xdr_nfs_fh3_server:entry
> fbt:nfs:xdr_nfs_fh3_server:entry
> 0 43887 xdr_decode_nfs_fh3:entry
> fbt:nfs:xdr_decode_nfs_fh3:entry
> 0 44934 xdr_inline_decode_nfs_fh3:entry
> fbt:nfs:xdr_inline_decode_nfs_fh3:entry
> 0 47354 rfs3_access_getfh:entry
> fbt:nfssrv:rfs3_access_getfh:entry
> 0 46720 checkexport:entry
> fbt:nfssrv:checkexport:entry
> 0 46926 nfs_fhhash:entry
> fbt:nfssrv:nfs_fhhash:entry
> 0 46024 checkauth:entry
> fbt:nfssrv:checkauth:entry
> 0 47080 nfsauth_access:entry
> fbt:nfssrv:nfsauth_access:entry
> 0 46890 nfsauth_cache_get:entry
> fbt:nfssrv:nfsauth_cache_get:entry
> 0 46058 addrmask:entry
> fbt:nfssrv:addrmask:entry
> 0 46056 hash:entry
> fbt:nfssrv:hash:entry
> 0 46876 rfs3_access:entry
> fbt:nfssrv:rfs3_access:entry
> 0 46916 nfs3_fhtovp:entry
> fbt:nfssrv:nfs3_fhtovp:entry
> 0 47080 nfsauth_access:entry
> fbt:nfssrv:nfsauth_access:entry
> 0 46890 nfsauth_cache_get:entry
> fbt:nfssrv:nfsauth_cache_get:entry
> 0 46058 addrmask:entry
> fbt:nfssrv:addrmask:entry
> 0 46056 hash:entry
> fbt:nfssrv:hash:entry
> 0 47140 rfs4_delegated_getattr:entry
> fbt:nfssrv:rfs4_delegated_getattr:entry
> 0 47198 vattr_to_post_op_attr:entry
> fbt:nfssrv:vattr_to_post_op_attr:entry
> 0 46042 vattr_to_fattr3:entry
> fbt:nfssrv:vattr_to_fattr3:entry
> 0 46020 auth_tooweak:entry
> fbt:nfssrv:auth_tooweak:entry
> 0 44844 xdr_ACCESS3res:entry
> fbt:nfs:xdr_ACCESS3res:entry
> 0 44766 xdr_post_op_attr:entry
> fbt:nfs:xdr_post_op_attr:entry
> 0 43891 xdr_fattr3:entry
> fbt:nfs:xdr_fattr3:entry
> 0 44792 xdr_ACCESS3args:entry
> fbt:nfs:xdr_ACCESS3args:entry
> 0 45008 xdr_nfs_fh3:entry
> fbt:nfs:xdr_nfs_fh3:entry
> 0 47384 exi_rele:entry
> fbt:nfssrv:exi_rele:entry
> 0 46030 rfs_dispatch:entry
> fbt:nfssrv:rfs_dispatch:entry
> 0 46022 common_dispatch:entry
> fbt:nfssrv:common_dispatch:entry
> 0 45700 xdr_diropargs3:entry
> fbt:nfs:xdr_diropargs3:entry
> 0 45610 xdr_nfs_fh3_server:entry
> fbt:nfs:xdr_nfs_fh3_server:entry
> 0 43887 xdr_decode_nfs_fh3:entry
> fbt:nfs:xdr_decode_nfs_fh3:entry
> 0 44934 xdr_inline_decode_nfs_fh3:entry
> fbt:nfs:xdr_inline_decode_nfs_fh3:entry
> 0 45422 xdr_string3:entry
> fbt:nfs:xdr_string3:entry
> 0 46838 rfs3_lookup_getfh:entry
> fbt:nfssrv:rfs3_lookup_getfh:entry
> 0 46720 checkexport:entry
> fbt:nfssrv:checkexport:entry
> 0 46926 nfs_fhhash:entry
> fbt:nfssrv:nfs_fhhash:entry
> 0 46024 checkauth:entry
> fbt:nfssrv:checkauth:entry
> 0 47080 nfsauth_access:entry
> fbt:nfssrv:nfsauth_access:entry
> 0 46890 nfsauth_cache_get:entry
> fbt:nfssrv:nfsauth_cache_get:entry
> 0 46058 addrmask:entry
> fbt:nfssrv:addrmask:entry
> 0 46056 hash:entry
> fbt:nfssrv:hash:entry
> 0 46960 rfs3_lookup:entry
> fbt:nfssrv:rfs3_lookup:entry
> 0 46916 nfs3_fhtovp:entry
> fbt:nfssrv:nfs3_fhtovp:entry
> 0 45428 puterrno3:entry
> fbt:nfs:puterrno3:entry
> 0 47198 vattr_to_post_op_attr:entry
> fbt:nfssrv:vattr_to_post_op_attr:entry
> 0 46042 vattr_to_fattr3:entry
> fbt:nfssrv:vattr_to_fattr3:entry
> 0 46020 auth_tooweak:entry
> fbt:nfssrv:auth_tooweak:entry
> 0 45454 xdr_LOOKUP3res:entry
> fbt:nfs:xdr_LOOKUP3res:entry
> 0 44766 xdr_post_op_attr:entry
> fbt:nfs:xdr_post_op_attr:entry
> 0 43891 xdr_fattr3:entry
> fbt:nfs:xdr_fattr3:entry
> 0 45700 xdr_diropargs3:entry
> fbt:nfs:xdr_diropargs3:entry
> 0 45008 xdr_nfs_fh3:entry
> fbt:nfs:xdr_nfs_fh3:entry
> 0 45422 xdr_string3:entry
> fbt:nfs:xdr_string3:entry
> 0 47384 exi_rele:entry
> fbt:nfssrv:exi_rele:entry
> 0 46030 rfs_dispatch:entry
> fbt:nfssrv:rfs_dispatch:entry
> 0 46022 common_dispatch:entry
> fbt:nfssrv:common_dispatch:entry
> 0 45628 xdr_SETATTR3args:entry
> fbt:nfs:xdr_SETATTR3args:entry
> 0 45610 xdr_nfs_fh3_server:entry
> fbt:nfs:xdr_nfs_fh3_server:entry
> 0 43887 xdr_decode_nfs_fh3:entry
> fbt:nfs:xdr_decode_nfs_fh3:entry
> 0 44934 xdr_inline_decode_nfs_fh3:entry
> fbt:nfs:xdr_inline_decode_nfs_fh3:entry
> 0 43899 xdr_sattr3:entry
> fbt:nfs:xdr_sattr3:entry
> 0 47138 rfs3_setattr_getfh:entry
> fbt:nfssrv:rfs3_setattr_getfh:entry
> 0 46720 checkexport:entry
> fbt:nfssrv:checkexport:entry
> 0 46926 nfs_fhhash:entry
> fbt:nfssrv:nfs_fhhash:entry
> 0 46024 checkauth:entry
> fbt:nfssrv:checkauth:entry
> 0 47080 nfsauth_access:entry
> fbt:nfssrv:nfsauth_access:entry
> 0 46890 nfsauth_cache_get:entry
> fbt:nfssrv:nfsauth_cache_get:entry
> 0 46058 addrmask:entry
> fbt:nfssrv:addrmask:entry
> 0 46056 hash:entry
> fbt:nfssrv:hash:entry
> 0 47344 rfs3_setattr:entry
> fbt:nfssrv:rfs3_setattr:entry
> 0 46916 nfs3_fhtovp:entry
> fbt:nfssrv:nfs3_fhtovp:entry
> 0 46044 sattr3_to_vattr:entry
> fbt:nfssrv:sattr3_to_vattr:entry
> 0 47140 rfs4_delegated_getattr:entry
> fbt:nfssrv:rfs4_delegated_getattr:entry
> 0 47080 nfsauth_access:entry
> fbt:nfssrv:nfsauth_access:entry
> 0 46890 nfsauth_cache_get:entry
> fbt:nfssrv:nfsauth_cache_get:entry
> 0 46058 addrmask:entry
> fbt:nfssrv:addrmask:entry
> 0 46056 hash:entry
> fbt:nfssrv:hash:entry
> 0 47140 rfs4_delegated_getattr:entry
> fbt:nfssrv:rfs4_delegated_getattr:entry
> 0 46046 vattr_to_wcc_data:entry
> fbt:nfssrv:vattr_to_wcc_data:entry
> 0 46050 vattr_to_pre_op_attr:entry
> fbt:nfssrv:vattr_to_pre_op_attr:entry
> 0 46048 vattr_to_wcc_attr:entry
> fbt:nfssrv:vattr_to_wcc_attr:entry
> 0 47198 vattr_to_post_op_attr:entry
> fbt:nfssrv:vattr_to_post_op_attr:entry
> 0 46042 vattr_to_fattr3:entry
> fbt:nfssrv:vattr_to_fattr3:entry
> 0 46020 auth_tooweak:entry
> fbt:nfssrv:auth_tooweak:entry
> 0 44870 xdr_SETATTR3res:entry
> fbt:nfs:xdr_SETATTR3res:entry
> 0 43897 xdr_wcc_data:entry
> fbt:nfs:xdr_wcc_data:entry
> 0 44766 xdr_post_op_attr:entry
> fbt:nfs:xdr_post_op_attr:entry
> 0 43891 xdr_fattr3:entry
> fbt:nfs:xdr_fattr3:entry
> 0 45628 xdr_SETATTR3args:entry
> fbt:nfs:xdr_SETATTR3args:entry
> 0 45008 xdr_nfs_fh3:entry
> fbt:nfs:xdr_nfs_fh3:entry
> 0 43899 xdr_sattr3:entry
> fbt:nfs:xdr_sattr3:entry
> 0 47384 exi_rele:entry
> fbt:nfssrv:exi_rele:entry
> 0 46030 rfs_dispatch:entry
> fbt:nfssrv:rfs_dispatch:entry
> 0 46022 common_dispatch:entry
> fbt:nfssrv:common_dispatch:entry
> 0 44792 xdr_ACCESS3args:entry
> fbt:nfs:xdr_ACCESS3args:entry
> 0 45610 xdr_nfs_fh3_server:entry
> fbt:nfs:xdr_nfs_fh3_server:entry
> 0 43887 xdr_decode_nfs_fh3:entry
> fbt:nfs:xdr_decode_nfs_fh3:entry
> 0 44934 xdr_inline_decode_nfs_fh3:entry
> fbt:nfs:xdr_inline_decode_nfs_fh3:entry
> 0 47354 rfs3_access_getfh:entry
> fbt:nfssrv:rfs3_access_getfh:entry
> 0 46720 checkexport:entry
> fbt:nfssrv:checkexport:entry
> 0 46926 nfs_fhhash:entry
> fbt:nfssrv:nfs_fhhash:entry
> 0 46024 checkauth:entry
> fbt:nfssrv:checkauth:entry
> 0 47080 nfsauth_access:entry
> fbt:nfssrv:nfsauth_access:entry
> 0 46890 nfsauth_cache_get:entry
> fbt:nfssrv:nfsauth_cache_get:entry
> 0 46058 addrmask:entry
> fbt:nfssrv:addrmask:entry
> 0 46056 hash:entry
> fbt:nfssrv:hash:entry
> 0 46876 rfs3_access:entry
> fbt:nfssrv:rfs3_access:entry
> 0 46916 nfs3_fhtovp:entry
> fbt:nfssrv:nfs3_fhtovp:entry
> 0 47080 nfsauth_access:entry
> fbt:nfssrv:nfsauth_access:entry
> 0 46890 nfsauth_cache_get:entry
> fbt:nfssrv:nfsauth_cache_get:entry
> 0 46058 addrmask:entry
> fbt:nfssrv:addrmask:entry
> 0 46056 hash:entry
> fbt:nfssrv:hash:entry
> 0 47140 rfs4_delegated_getattr:entry
> fbt:nfssrv:rfs4_delegated_getattr:entry
> 0 47198 vattr_to_post_op_attr:entry
> fbt:nfssrv:vattr_to_post_op_attr:entry
> 0 46042 vattr_to_fattr3:entry
> fbt:nfssrv:vattr_to_fattr3:entry
> 0 46020 auth_tooweak:entry
> fbt:nfssrv:auth_tooweak:entry
> 0 44844 xdr_ACCESS3res:entry
> fbt:nfs:xdr_ACCESS3res:entry
> 0 44766 xdr_post_op_attr:entry
> fbt:nfs:xdr_post_op_attr:entry
> 0 43891 xdr_fattr3:entry
> fbt:nfs:xdr_fattr3:entry
> 0 44792 xdr_ACCESS3args:entry
> fbt:nfs:xdr_ACCESS3args:entry
> 0 45008 xdr_nfs_fh3:entry
> fbt:nfs:xdr_nfs_fh3:entry
> 0 47384 exi_rele:entry
> fbt:nfssrv:exi_rele:entry
>
> 0 2 :END ending!
> </output>
>
>
> thanks,
> Josh
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v1.4.8 (Darwin)
> Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/
>
> iEYEARECAAYFAkqfLusACgkQx0z2pBWsSnOiVACgnsBgrj0c2lkIVgKt816pJkEJ
> iYIAnidChUSqPHEuF7ALdHtuKfADV79q
> =H5jP
> -----END PGP SIGNATURE-----
> _______________________________________________
> dtrace-discuss mailing list
> dtrace-discuss at opensolaris.org
--
Adam Leventhal, Fishworks http://blogs.sun.com/ahl