dtrace discuss - Dec 2005 - Inheriting self across fork calls?

I''m trying to track a number of attributes of processes - including
open sockets.  It''s easy enough to place probes on calls to socket,
bind, listen, etc., but I need to keep track of everyone that keeps these
sockets open.  If a process opens a listening tcp port, forks, and then closes
the port, the child still must be tracked.

The first thing that comes to mind is some mechanism for self-> variables to
be inherited across fork calls.  If I could do that, I would simply set that
property at the appropriate time:

syscall::bind:entry
{
  self->numBound++;
}

syscall::fork1:entry
/self->numBound/
{
  newchild->numBound = self->numBound;
}

syscall::close:entry
/self->numBound  && some other voodoo/
{
  self->numBound--;
}

Of course, I''ve left out the output and quite a lot of other garbage,
but I think that I''ve covered the gist of it.  I just need a way to
make sure that certain of the self-> variables in a forking parent are
carried into the child.

  thanks...

  rOn
This message posted from opensolaris.org

Hi Ron,

I realize it may not be as elegant, but could you put the open sockets in
a global associative array keyed on the vnode address or another unique
identifier? Would that address the problem you''re trying to solve?

Adam

On Sun, Dec 04, 2005 at 07:00:26PM -0800, ron barry
wrote:
> I''m trying to track a number of attributes of processes -
including open sockets.  It''s easy enough to place probes on calls to
socket, bind, listen, etc., but I need to keep track of everyone that keeps
these sockets open.  If a process opens a listening tcp port, forks, and then
closes the port, the child still must be tracked.
> 
> The first thing that comes to mind is some mechanism for self->
variables to be inherited across fork calls.  If I could do that, I would simply
set that property at the appropriate time:
> 
> syscall::bind:entry
> {
>   self->numBound++;
> }
> 
> syscall::fork1:entry
> /self->numBound/
> {
>   newchild->numBound = self->numBound;
> }
> 
> syscall::close:entry
> /self->numBound  && some other voodoo/
> {
>   self->numBound--;
> }
> 
> Of course, I''ve left out the output and quite a lot of other
garbage, but I think that I''ve covered the gist of it.  I just need a
way to make sure that certain of the self-> variables in a forking parent are
carried into the child.
> 
>   thanks...
> 
>   rOn
> This message posted from opensolaris.org
> _______________________________________________
> dtrace-discuss mailing list
> dtrace-discuss at opensolaris.org
-- 
Adam Leventhal, Solaris Kernel Development       http://blogs.sun.com/ahl