dtrace discuss - Apr 2007 - question on application tracing

Hi
I am trying to trace lower level apps being exec''ed by patchadd, 
specifically the execution of any commands that are part of the shell 
scripts that pkginstall uses to install package bits.

So I tried this
------------------------
#!/usr/sbin/dtrace -qs

int x;
BEGIN{
x=-1;
}

proc:::create
/execname == "patchadd" || execname == "patchrm"/
{
        x=pid;
}
syscall::exec*:return
/progenyof(x)/
{
printf(" %s\n",curpsinfo->pr_psargs);
system("pstop %d", curpsinfo->pr_pid);
system("/export/pre.d %d &", curpsinfo->pr_pid);
}
-------------------
where pre.d is as follows

-----------------------
#!/usr/sbin/dtrace -Fs

#pragma D option destructive

BEGIN
{
         printf("pruning process %d \n", $1);
         system("prun %d", $1);
}

pid$1::exit:entry,
pid$1::_exit:entry
{
        printf("return code is: %d\n", arg0);
}
--------------------


I hope that what I am trying to achieve is clear enough

patchadd  executes pkgadd which executes pkginstall which eventually 
runs a sh script called i.none which as part of it''s working calls mv 
and cp commands, and I want to trace their exit status i.e.  1 or 0 exit 
value.

any ideas appreciated as to how to do this properly or otherwise

regards
Enda

Hi Enda,

Using pstop and prun this way won''t do what you want.  The pstop is run
asynchronously with the process you''re trying to stop, because the 
system function executes on the consumer side after it retrieves this 
function request from the dtrace buffer.  This is likely to be a full 
second after the exec*:return probe fired and completed.

To quote a scene from the TV show M*A*S*H, where Frank Burns is trying 
to identify their position over a radio by saying "When I say NOW, the 
jet will be directly over our position.", to which Hawkeye responded, 
"Frank, by the time you said NOW, the jet was in the hanger and the 
pilot in his pajamas."  By the time you get a chance to pstop the 
process, it''s already well underway.  The reason it''s done
this way is
to avoid interrupts in the kernel mode probe clauses.

How about this instead:

#pragma D option quiet
proc:::exec-success
/ execname == "i.none" /
{
       x = 1;
}

proc:::exec-success
/ x && (execname == "mv" || execname == "cp") /
{
      y = 1;
}

proc:::exit
/ y /
{
      printf ("%s: %d\n", execname, args[0]);
      y = 0;
}
proc:::exit
/ x && execname == "i.none" /
{
      x = 0;
}


If there''s a possibility of multiple pkgadd or pkgrm commands running 
simultaneously, you''ll need to be more creative with the variables.

Chip


Enda O''Connor wrote:
> Hi
> I am trying to trace lower level apps being exec''ed by patchadd, 
> specifically the execution of any commands that are part of the shell 
> scripts that pkginstall uses to install package bits.
>
> So I tried this
> ------------------------
> #!/usr/sbin/dtrace -qs
>
> int x;
> BEGIN{
> x=-1;
> }
>
> proc:::create
> /execname == "patchadd" || execname == "patchrm"/
> {
>        x=pid;
> }
> syscall::exec*:return
> /progenyof(x)/
> {
> printf(" %s\n",curpsinfo->pr_psargs);
> system("pstop %d", curpsinfo->pr_pid);
> system("/export/pre.d %d &", curpsinfo->pr_pid);
> }
> -------------------
> where pre.d is as follows
>
> -----------------------
> #!/usr/sbin/dtrace -Fs
>
> #pragma D option destructive
>
> BEGIN
> {
>         printf("pruning process %d \n", $1);
>         system("prun %d", $1);
> }
>
> pid$1::exit:entry,
> pid$1::_exit:entry
> {
>        printf("return code is: %d\n", arg0);
> }
> --------------------
>
>
> I hope that what I am trying to achieve is clear enough
>
> patchadd  executes pkgadd which executes pkginstall which eventually 
> runs a sh script called i.none which as part of it''s working calls
mv
> and cp commands, and I want to trace their exit status i.e.  1 or 0 
> exit value.
>
> any ideas appreciated as to how to do this properly or otherwise
>
> regards
> Enda
>
>
>
>
> _______________________________________________
> dtrace-discuss mailing list
> dtrace-discuss at opensolaris.org

On second thought, there is a "stop" destructive action that will
cause
a process to stop after it returns to user mode, so using that method, 
your way might work.  However, if you can get what you want without 
stopping a process, it''s probably a good idea.

Chip

Hi
Thanks for the info about pstop.

Initially I was trying to track more than just mv and cp 9 although my 
mail does mention them explicitly )
But your suggested way looks the bst option

Thanks
Enda

Chip Bennett wrote:
> Hi Enda,
>
> Using pstop and prun this way won''t do what you want.  The pstop
is
> run asynchronously with the process you''re trying to stop, because
the
> system function executes on the consumer side after it retrieves this 
> function request from the dtrace buffer.  This is likely to be a full 
> second after the exec*:return probe fired and completed.
>
> To quote a scene from the TV show M*A*S*H, where Frank Burns is trying 
> to identify their position over a radio by saying "When I say NOW, the
> jet will be directly over our position.", to which Hawkeye responded, 
> "Frank, by the time you said NOW, the jet was in the hanger and the 
> pilot in his pajamas."  By the time you get a chance to pstop the 
> process, it''s already well underway.  The reason it''s
done this way is
> to avoid interrupts in the kernel mode probe clauses.
>
> How about this instead:
>
> #pragma D option quiet
> proc:::exec-success
> / execname == "i.none" /
> {
>       x = 1;
> }
>
> proc:::exec-success
> / x && (execname == "mv" || execname == "cp") /
> {
>      y = 1;
> }
>
> proc:::exit
> / y /
> {
>      printf ("%s: %d\n", execname, args[0]);
>      y = 0;
> }
> proc:::exit
> / x && execname == "i.none" /
> {
>      x = 0;
> }
>
>
> If there''s a possibility of multiple pkgadd or pkgrm commands
running
> simultaneously, you''ll need to be more creative with the
variables.
>
> Chip
>
>
> Enda O''Connor wrote:
>> Hi
>> I am trying to trace lower level apps being exec''ed by
patchadd,
>> specifically the execution of any commands that are part of the shell 
>> scripts that pkginstall uses to install package bits.
>>
>> So I tried this
>> ------------------------
>> #!/usr/sbin/dtrace -qs
>>
>> int x;
>> BEGIN{
>> x=-1;
>> }
>>
>> proc:::create
>> /execname == "patchadd" || execname == "patchrm"/
>> {
>>        x=pid;
>> }
>> syscall::exec*:return
>> /progenyof(x)/
>> {
>> printf(" %s\n",curpsinfo->pr_psargs);
>> system("pstop %d", curpsinfo->pr_pid);
>> system("/export/pre.d %d &", curpsinfo->pr_pid);
>> }
>> -------------------
>> where pre.d is as follows
>>
>> -----------------------
>> #!/usr/sbin/dtrace -Fs
>>
>> #pragma D option destructive
>>
>> BEGIN
>> {
>>         printf("pruning process %d \n", $1);
>>         system("prun %d", $1);
>> }
>>
>> pid$1::exit:entry,
>> pid$1::_exit:entry
>> {
>>        printf("return code is: %d\n", arg0);
>> }
>> --------------------
>>
>>
>> I hope that what I am trying to achieve is clear enough
>>
>> patchadd  executes pkgadd which executes pkginstall which eventually 
>> runs a sh script called i.none which as part of it''s working
calls mv
>> and cp commands, and I want to trace their exit status i.e.  1 or 0 
>> exit value.
>>
>> any ideas appreciated as to how to do this properly or otherwise
>>
>> regards
>> Enda
>>
>>
>>
>>
>> _______________________________________________
>> dtrace-discuss mailing list
>> dtrace-discuss at opensolaris.org
>

I hate to say it on this alias but may be truss -f -t exec miight be a 
better suited to what you''re trying to do

Chris

Enda O''Connor wrote:
> Hi
> I am trying to trace lower level apps being exec''ed by patchadd, 
> specifically the execution of any commands that are part of the shell 
> scripts that pkginstall uses to install package bits.
>
> So I tried this
> ------------------------
> #!/usr/sbin/dtrace -qs
>
> int x;
> BEGIN{
> x=-1;
> }
>
> proc:::create
> /execname == "patchadd" || execname == "patchrm"/
> {
>        x=pid;
> }
> syscall::exec*:return
> /progenyof(x)/
> {
> printf(" %s\n",curpsinfo->pr_psargs);
> system("pstop %d", curpsinfo->pr_pid);
> system("/export/pre.d %d &", curpsinfo->pr_pid);
> }
> -------------------
> where pre.d is as follows
>
> -----------------------
> #!/usr/sbin/dtrace -Fs
>
> #pragma D option destructive
>
> BEGIN
> {
>         printf("pruning process %d \n", $1);
>         system("prun %d", $1);
> }
>
> pid$1::exit:entry,
> pid$1::_exit:entry
> {
>        printf("return code is: %d\n", arg0);
> }
> --------------------
>
>
> I hope that what I am trying to achieve is clear enough
>
> patchadd  executes pkgadd which executes pkginstall which eventually 
> runs a sh script called i.none which as part of it''s working calls
mv
> and cp commands, and I want to trace their exit status i.e.  1 or 0 
> exit value.
>
> any ideas appreciated as to how to do this properly or otherwise
>
> regards
> Enda
>
>
>
>
> _______________________________________________
> dtrace-discuss mailing list
> dtrace-discuss at opensolaris.org

Hi Chris,

I''d have to disagree with truss being a better choice here than DTrace.
I thought the same thing at first, but it turns out, in this case, Enda 
is looking for specific well-defined events, which is perfect for 
DTrace.  Enda just needed to use the right probes and conditions.  
Unless you''re debugging your own invocation, truss would require you to
modify something to "inject" into the execution stack, and it
interferes
with the system more (albeit, in this case the latter problem would 
probably not be very pronounced).

But yes, truss would work.

Chip

Chris Beal wrote:
> I hate to say it on this alias but may be truss -f -t exec miight be a 
> better suited to what you''re trying to do
>
> Chris

On 4/24/07, Chip Bennett <cbennett at laurustech.com>
wrote:
> If there''s a possibility of multiple pkgadd or pkgrm commands
running
> simultaneously, you''ll need to be more creative with the
variables.
Could be simpler...

 dtrace -n ''proc:::exit/progenyof($target)/{ printf ("%s:
%d\n",
execname, args[0])}''
   -c ....


-- 
Just me,
Wire ...
Blog: <prstat.blogspot.com>

On 4/24/07, Wee Yeh Tan <weeyeh at gmail.com>
wrote:
> Could be simpler...
>
>  dtrace -n ''proc:::exit/progenyof($target)/{ printf ("%s:
%d\n",
> execname, args[0])}''
>    -c ....
Oops...

s/proc:::exit/syscall::rexit:entry/

proc:::exit tracks the exit signal.



-- 
Just me,
Wire ...
Blog: <prstat.blogspot.com>

EndaO''Connor wrote:
> Hi Chris
> Yep, it works quite well, just very very verbose, although we do capture 
> more info than just exit codes, I was trying to see if Dtrace could give 
> me someting similar in a less verbose fashion.
what options are you using for truss? There''s loads of them, and you
can
reduce the amount truss prints very nicely if you use the right ones.

Michael
-- 
Michael Schuster	Sun Microsystems, Inc.
recursion, n: see ''recursion''

Hi Chris
Yep, it works quite well, just very very verbose, although we do capture 
more info than just exit codes, I was trying to see if Dtrace could give 
me someting similar in a less verbose fashion.
Currently using a perl script to strip the truss logs down, also a bit 
slow, but stop/prun are on the same level really.

Enda

Chris Beal wrote:
> I hate to say it on this alias but may be truss -f -t exec miight be a 
> better suited to what you''re trying to do
>
> Chris
>
> Enda O''Connor wrote:
>
>> Hi
>> I am trying to trace lower level apps being exec''ed by
patchadd,
>> specifically the execution of any commands that are part of the shell 
>> scripts that pkginstall uses to install package bits.
>>
>> So I tried this
>> ------------------------
>> #!/usr/sbin/dtrace -qs
>>
>> int x;
>> BEGIN{
>> x=-1;
>> }
>>
>> proc:::create
>> /execname == "patchadd" || execname == "patchrm"/
>> {
>>        x=pid;
>> }
>> syscall::exec*:return
>> /progenyof(x)/
>> {
>> printf(" %s\n",curpsinfo->pr_psargs);
>> system("pstop %d", curpsinfo->pr_pid);
>> system("/export/pre.d %d &", curpsinfo->pr_pid);
>> }
>> -------------------
>> where pre.d is as follows
>>
>> -----------------------
>> #!/usr/sbin/dtrace -Fs
>>
>> #pragma D option destructive
>>
>> BEGIN
>> {
>>         printf("pruning process %d \n", $1);
>>         system("prun %d", $1);
>> }
>>
>> pid$1::exit:entry,
>> pid$1::_exit:entry
>> {
>>        printf("return code is: %d\n", arg0);
>> }
>> --------------------
>>
>>
>> I hope that what I am trying to achieve is clear enough
>>
>> patchadd  executes pkgadd which executes pkginstall which eventually 
>> runs a sh script called i.none which as part of it''s working
calls mv
>> and cp commands, and I want to trace their exit status i.e.  1 or 0 
>> exit value.
>>
>> any ideas appreciated as to how to do this properly or otherwise
>>
>> regards
>> Enda
>>
>>
>>
>>
>> _______________________________________________
>> dtrace-discuss mailing list
>> dtrace-discuss at opensolaris.org
>

michael schuster wrote:
> EndaO''Connor wrote:
>> Hi Chris
>> Yep, it works quite well, just very very verbose, although we do 
>> capture more info than just exit codes, I was trying to see if Dtrace 
>> could give me someting similar in a less verbose fashion.
> 
> what options are you using for truss? There''s loads of them, and
you can
> reduce the amount truss prints very nicely if you use the right ones.
> 
> Michael
Hi Michael
Thanks, currently we use options that lead to pretty verbose output, but
with Dtrace I am just replicating most of this truss functionality, but 
in smaller scripts to make parsing etc more easy to accomplish. That is 
break down the truss into smaller bits for Dtrace that makes the whole 
lot more manageable and easier to automate.

thanks
Enda

Wee Yeh Tan wrote:
> On 4/24/07, Wee Yeh Tan <weeyeh at gmail.com> wrote:
>> Could be simpler...
>>
>>  dtrace -n ''proc:::exit/progenyof($target)/{ printf ("%s:
%d\n",
>> execname, args[0])}''
>>    -c ....
> 
> Oops...
> 
> s/proc:::exit/syscall::rexit:entry/
> 
> proc:::exit tracks the exit signal.
> 
> 
> 
Hi
So thanks to all who helped me out
basically I am using the following which works perfectly for me

!/usr/sbin/dtrace -qs

int x;
BEGIN{
x=-1;
}

proc:::create
/execname == "patchadd" || execname == "patchrm"/
{
         x=pid;
}

syscall::rexit:entry
/progenyof(x) && arg0 != 0 && (execname=="cp" ||
execname=="mv" ||
execname=="valpath" )/
{
      printf ("%s: %s: %d\n", curpsinfo->pr_psargs, arg0);
}


thanks
Enda

On 4/25/07, Enda O''Connor ( Sun Micro Systems Ireland)
<Enda.Oconnor at sun.com> wrote:
> So thanks to all who helped me out
> basically I am using the following which works perfectly for me
>
> !/usr/sbin/dtrace -qs
>
> int x;
> BEGIN{
> x=-1;
> }
>
> proc:::create
> /execname == "patchadd" || execname == "patchrm"/
> {
>          x=pid;
> }
>
> syscall::rexit:entry
> /progenyof(x) && arg0 != 0 && (execname=="cp" ||
execname=="mv" ||
> execname=="valpath" )/
> {
>       printf ("%s: %s: %d\n", curpsinfo->pr_psargs, arg0);
> }
That is really cool.  The script changes trace targets with new
invocations of patchadd/patchrm so you can trace across invocations
:).  The only problem I can see is if another patchadd/patchrm starts
up when the current patchadd/patchrm isn''t quite done.


-- 
Just me,
Wire ...
Blog: <prstat.blogspot.com>

Wee Yeh Tan wrote:
> On 4/25/07, Enda O''Connor ( Sun Micro Systems Ireland)
> <Enda.Oconnor at sun.com> wrote:
>> So thanks to all who helped me out
>> basically I am using the following which works perfectly for me
>>
>> !/usr/sbin/dtrace -qs
>>
>> int x;
>> BEGIN{
>> x=-1;
>> }
>>
>> proc:::create
>> /execname == "patchadd" || execname == "patchrm"/
>> {
>>          x=pid;
>> }
>>
>> syscall::rexit:entry
>> /progenyof(x) && arg0 != 0 && (execname=="cp"
|| execname=="mv" ||
>> execname=="valpath" )/
>> {
>>       printf ("%s: %s: %d\n", curpsinfo->pr_psargs, arg0);
>> }
>
> That is really cool.  The script changes trace targets with new
> invocations of patchadd/patchrm so you can trace across invocations
> :).  The only problem I can see is if another patchadd/patchrm starts
> up when the current patchadd/patchrm isn''t quite done.
>
>
Hi
Thanks, As I control the execution, that''s fine for my env, otherwise I
could control things with some more variables I suspect.

BTW a typo in above
printf ("%s: %s: %d\n", curpsinfo->pr_psargs, arg0);
should be
printf (" %s: %d\n", curpsinfo->pr_psargs, arg0);

memo to self, no editing of scripts in e-mail :-)

Enda