dtrace discuss - Jul 2007 - dtrace

hi fnds,
              i want to print the filenames on which the stat system 
call is acting when  a stat  system call is invoked. can anyone can help 
me this regard.


Thanks
jeevan

Look at the stat(2) signature,
 int stat(const char *restrict path, struct stat *restrict buf)

which suggests that first argument is the path .... you can do something
like this in a D script,


#!/usr/sbin/dtrace -Cs

#include <sys/stat.h>

syscall::stat:entry
{
 printf("%s\n",stringof(copyinstr(arg0)));
}

I am new to DTrace. Someone of the list can correct me ...

Vivek


On 7/30/07, jeevan reddy <Jeevan.Reddy at sun.com>
wrote:
>
> hi fnds,
>               i want to print the filenames on which the stat system
> call is acting when  a stat  system call is invoked. can anyone can help
> me this regard.
>
>
> Thanks
> jeevan
> _______________________________________________
> dtrace-discuss mailing list
> dtrace-discuss at opensolaris.org
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL:
<http://mail.opensolaris.org/pipermail/dtrace-discuss/attachments/20070730/059d4aa0/attachment.html>

Vivek Joshi wrote:
> ...
>
> syscall::stat:entry
> {
>  printf("%s\n",stringof(copyinstr(arg0)));
> }
> ...
This will work most of the time, but you should also put off translating 
the pointer with copyinstr, until you can be sure the string is paged 
in.  Something like:

syscall::stat:entry
{
   self->statpath = arg0;
}
syscall::stat:return
/ self->statpath /
{
   printf ("%s\n", copyinstr (self->statpath));
   self->statpath = 0;
}

D clauses run in kernel mode with interrupts turned off, so they can''t 
handle a page fault.  Deferring handling arg0 until the stat call is 
finished assures you that the pointer''s been referenced and the string 
is in memory.

Chip

On 7/30/07, Vivek Joshi <techvbj at gmail.com>
wrote:
> Look at the stat(2) signature,
>  int stat(const char *restrict path, struct stat *restrict buf)
>
> which suggests that first argument is the path .... you can do something
> like this in a D script,
>
>
> #!/usr/sbin/dtrace -Cs
>
> #include <sys/stat.h>
>
> syscall::stat:entry
> {
>  printf("%s\n",stringof(copyinstr(arg0)));
> }
>
> I am new to DTrace. Someone of the list can correct me ...
>
I would make a few changes.
Here''s what I use for tracking file-access events (not limited to
''stat''):

#!/usr/sbin/dtrace -s

#pragma D option quiet

syscall::open:entry,
syscall::open64:entry,
syscall::stat:entry,
syscall::stat64:entry,
syscall::lstat:entry,
syscall::lstat64:entry
{
        self->pathnameptr = arg0;
}

syscall::xstat:entry,
syscall::lxstat:entry
{
        self->pathnameptr = arg1;
}

syscall::open:return,
syscall::open64:return,
syscall::stat:return,
syscall::stat64:return,
syscall::lstat:return,
syscall::lstat64:return,
syscall::xstat:return,
syscall::lxstat:return
/self->pathnameptr/ {
        printf("%5d/%-5d  %20s  %7s  %2d  %s\n",
                uid, curpsinfo->pr_euid, execname, probefunc,
                errno, copyinstr(self->pathnameptr));
        self->pathnameptr = 0;
}