Hi Jan,
I think that putting a probe on fbt::closef:entry should give
you what you want:
# cat rel.d
#!/usr/sbin/dtrace -s
fbt::closef:entry
/execname == "foo && args[0]->f_vnode->v_path != NULL/
{
@[stringof(args[0]->f_vnode->v_path)] = count();
}
# ./rel.d
dtrace: script ''./rel.d'' matched 1 probe
^C
/.sh_history 1
/etc/release 1
/lib/libc.so.1 1
/dev/pts/4 3
Jon.
> I want to trace all open/close. If a process forgot to close a fd,
syscall::close is not fired. Is there a probe which is called when kernel close
the fd?
>
> test.c:
> int
> main(int argc, char *argv[])
> {
> return open("/etc/release", O_RDONLY));
> }
> ----------------------
> test.d:
> #!/usr/sbin/dtrace -s
>
> syscall::open*:return / pid == $target / {}
> syscall::close*:return / pid == $target / {}
> ----------------------
>
> output of ''./test.d -c ./test'':
> dtrace: script ''./test.d'' matched 3 probes
> dtrace: pid 5285 has exited
> CPU ID FUNCTION:NAME
> 0 82675 open:return
>
>
> --
> This message posted from opensolaris.org
> _______________________________________________
> dtrace-discuss mailing list
> dtrace-discuss at opensolaris.org
>