dtrace discuss - Jul 2006 - use tracemem to dump content in function read/write

Hi Expert

I want to use dtrace to monitor the content change of one file. I made following
scripts,
#!/usr/sbin/dtrace -s
inline int MYPID      = $1;

syscall::write:entry
/pid == MYPID/
{
  tracemem(arg1, arg2);
  
  printf("\n");
}
It always has an following error
bash-3.00$ sudo dumpFIFO.dtrace 3836
dtrace: failed to compile script ./dumpFIFO.dtrace: line 19: tracemem( )
argument #2 must be a non-zero positive integral constant expression

When I change it to
  tracemem(arg1, 1);  /*1 is a small test number*/
It always has following error.
bash-3.00$ sudo dumpFIFO.dtrace 3836
dtrace: error on enabled probe ID 2 (ID 13: syscall::write:entry): invalid
address (0x1002de000) in action #3
dtrace: error on enabled probe ID 2 (ID 13: syscall::write:entry): invalid
address (0x1004d6000) in action #3

Could you please figure out a script to dump the content change of a file?

Best Regards
Leslie
 
 
This message posted from opensolaris.org

Leslie

leslie wrote:
> Hi Expert
> 
> I want to use dtrace to monitor the content change of one file. I made
following scripts,
> #!/usr/sbin/dtrace -s
> inline int MYPID      = $1;
> 
> syscall::write:entry
> /pid == MYPID/
> {
>   tracemem(arg1, arg2);
>   
>   printf("\n");
> }
> When I change it to
>   tracemem(arg1, 1);  /*1 is a small test number*/
> It always has following error.
> bash-3.00$ sudo dumpFIFO.dtrace 3836
> dtrace: error on enabled probe ID 2 (ID 13: syscall::write:entry): invalid
address (0x1002de000) in action #3
> dtrace: error on enabled probe ID 2 (ID 13: syscall::write:entry): invalid
address (0x1004d6000) in action #3
you probably need to copy in the data first - DTrace doesn''t do that 
automatically.

HTH
Michael
-- 
Michael Schuster                  (+49 89) 46008-2974 / x62974
visit the online support center:  http://www.sun.com/osc/

Recursion, n.: see ''Recursion''

As Michael mentioned, the arguments to system call probes refer to user-land
values. For pointers, you need to use the copyin() or copyinstr() subroutines
to access the data.

syscall::write:entry
{
	tracemem(copyin(arg1, 1), 1);
}

Adam

On Mon, Jul 31, 2006 at 02:09:33AM -0700, leslie wrote:
> Hi Expert
> 
> I want to use dtrace to monitor the content change of one file. I made
following scripts,
> #!/usr/sbin/dtrace -s
> inline int MYPID      = $1;
> 
> syscall::write:entry
> /pid == MYPID/
> {
>   tracemem(arg1, arg2);
>   
>   printf("\n");
> }
> It always has an following error
> bash-3.00$ sudo dumpFIFO.dtrace 3836
> dtrace: failed to compile script ./dumpFIFO.dtrace: line 19: tracemem( )
argument #2 must be a non-zero positive integral constant expression
> 
> When I change it to
>   tracemem(arg1, 1);  /*1 is a small test number*/
> It always has following error.
> bash-3.00$ sudo dumpFIFO.dtrace 3836
> dtrace: error on enabled probe ID 2 (ID 13: syscall::write:entry): invalid
address (0x1002de000) in action #3
> dtrace: error on enabled probe ID 2 (ID 13: syscall::write:entry): invalid
address (0x1004d6000) in action #3
> 
> Could you please figure out a script to dump the content change of a file?
> 
> Best Regards
> Leslie
>  
>  
> This message posted from opensolaris.org
> _______________________________________________
> dtrace-discuss mailing list
> dtrace-discuss at opensolaris.org
-- 
Adam Leventhal, Solaris Kernel Development       http://blogs.sun.com/ahl

Adam, Michael 
Thanks for your quick reply.
Must tracemem( ) argument #2 be a non-zero positive integral number? Why
following script always has error in compile?
 #!/usr/sbin/dtrace -s
 inline int MYPID      = $1;
 
 syscall::write:entry
 /pid == MYPID/
 {
   tracemem(arg1, arg2);
   
   printf("\n");
 }
 It always has an following error
 bash-3.00$ sudo dumpFIFO.dtrace 3836
 dtrace: failed to compile script ./dumpFIFO.dtrace: line 19: tracemem( )
argument #2 must be a non-zero positive integral constant expression



--------------------------------------------------------------------------------

As Michael mentioned, the arguments to system call probes refer to user-land
values. For pointers, you need to use the copyin() or copyinstr() subroutines
to access the data.

syscall::write:entry
{
	tracemem(copyin(arg1, 1), 1);
}

Adam

On Mon, Jul 31, 2006 at 02:09:33AM -0700, leslie wrote:
> Hi Expert
> 
> I want to use dtrace to monitor the content change of one file. I made
following scripts,
> #!/usr/sbin/dtrace -s
> inline int MYPID      = $1;
> 
> syscall::write:entry
> /pid == MYPID/
> {
>   tracemem(arg1, arg2);
>   
>   printf("\n");
> }
> It always has an following error
> bash-3.00$ sudo dumpFIFO.dtrace 3836
> dtrace: failed to compile script ./dumpFIFO.dtrace: line 19: tracemem( )
argument #2 must be a non-zero positive integral constant expression
> 
> When I change it to
>   tracemem(arg1, 1);  /*1 is a small test number*/
> It always has following error.
> bash-3.00$ sudo dumpFIFO.dtrace 3836
> dtrace: error on enabled probe ID 2 (ID 13: syscall::write:entry): invalid
address (0x1002de000) in action #3
> dtrace: error on enabled probe ID 2 (ID 13: syscall::write:entry): invalid
address (0x1004d6000) in action #3
> 
> Could you please figure out a script to dump the content change of a file?
> 
> Best Regards
> Leslie
>  
>  
> This message posted from opensolaris.org
> _______________________________________________
> dtrace-discuss mailing list
> dtrace-discuss at opensolaris.org
-- 
Adam Leventhal, Solaris Kernel Development       http://blogs.sun.com/ahl
 
 
This message posted from opensolaris.org

The error message says that the error is "tracemem( ) argument #2 must be a
non-zero positive integral constant expression".

The DTrace manual says "The tracemem() action takes a D expression as its
first
argument, address, and a constant as its second argument, nbytes."

 From that, I''m gonna guess that the answer to your first question is
"yes", and
that the answer to your second question is obvious.

Is there a reason to disbelieve the error message and the manual?

leslie wrote:
> Adam, Michael 
> Thanks for your quick reply.
> Must tracemem( ) argument #2 be a non-zero positive integral number? Why
following script always has error in compile?
>  #!/usr/sbin/dtrace -s
>  inline int MYPID      = $1;
>  
>  syscall::write:entry
>  /pid == MYPID/
>  {
>    tracemem(arg1, arg2);
>    
>    printf("\n");
>  }
>  It always has an following error
>  bash-3.00$ sudo dumpFIFO.dtrace 3836
>  dtrace: failed to compile script ./dumpFIFO.dtrace: line 19: tracemem( )
argument #2 must be a non-zero positive integral constant expression
> 
> 
> 
>
--------------------------------------------------------------------------------
> 
> As Michael mentioned, the arguments to system call probes refer to
user-land
> values. For pointers, you need to use the copyin() or copyinstr()
subroutines
> to access the data.
> 
> syscall::write:entry
> {
> 	tracemem(copyin(arg1, 1), 1);
> }
> 
> Adam
> 
> On Mon, Jul 31, 2006 at 02:09:33AM -0700, leslie wrote:
> 
>>Hi Expert
>>
>>I want to use dtrace to monitor the content change of one file. I made
following scripts,
>>#!/usr/sbin/dtrace -s
>>inline int MYPID      = $1;
>>
>>syscall::write:entry
>>/pid == MYPID/
>>{
>>  tracemem(arg1, arg2);
>>  
>>  printf("\n");
>>}
>>It always has an following error
>>bash-3.00$ sudo dumpFIFO.dtrace 3836
>>dtrace: failed to compile script ./dumpFIFO.dtrace: line 19: tracemem( )
argument #2 must be a non-zero positive integral constant expression
>>
>>When I change it to
>>  tracemem(arg1, 1);  /*1 is a small test number*/
>>It always has following error.
>>bash-3.00$ sudo dumpFIFO.dtrace 3836
>>dtrace: error on enabled probe ID 2 (ID 13: syscall::write:entry):
invalid address (0x1002de000) in action #3
>>dtrace: error on enabled probe ID 2 (ID 13: syscall::write:entry):
invalid address (0x1004d6000) in action #3
>>
>>Could you please figure out a script to dump the content change of a
file?
>>
>>Best Regards
>>Leslie
>> 
>> 
>>This message posted from opensolaris.org
>>_______________________________________________
>>dtrace-discuss mailing list
>>dtrace-discuss at opensolaris.org
> 
>

On Mon 31 Jul 2006 at 07:53PM, leslie wrote:
> Adam, Michael 
> Thanks for your quick reply.
> Must tracemem( ) argument #2 be a non-zero positive integral number?
> Why following script always has error in compile?
...
>  dtrace: failed to compile script ./dumpFIFO.dtrace: line 19:
>  tracemem( ) argument #2 must be a non-zero positive integral constant
>  expression
It must be a *constant* non-zero positive integral number-- constant is the
key, I think.  DTrace needs to know in advance how much storage a given
probe''s trace output could consume.

So, you''ll have to pick some value which will work for whatever
analysis you are doing.

Also, in my testing, it seemed like it was necessary to use the copyin()
action:

        tracemem(copyin(arg1,10), 10);

Thanks,

        -dp

-- 
Daniel Price - Solaris Kernel Engineering - dp at eng.sun.com - blogs.sun.com/dp