dtrace discuss - May 2006 - DTrace file and process dependencies

1.  Is there a dtrace command that would follow a process and all its forked
processes and display any files it accesses for read and write?
 

2.  Also is there a cleaner way just to get only the files related to ?make? and
only follow a process and its children and not get all of the processes?
 
 
This message posted from opensolaris.org

I can''t help but wonder if using something like:

  truss -ftopen <command>

would be a much simpler answer to your question...



On Thu, 2006-05-25 at 15:58, Kumara Tejaswi .N wrote:
> 1.  Is there a dtrace command that would follow a process and all its
forked processes and display any files it accesses for read and write?
>  
> 
> 2.  Also is there a cleaner way just to get only the files related to
?make? and only follow a process and its children and not get all of the
processes?
>  
> 
> This message posted from opensolaris.org
> _______________________________________________
> dtrace-discuss mailing list
dtrace-discuss at opensolaris.org
--

Kumara Tejaswi .N wrote:
> 1.  Is there a dtrace command that would follow a process and all its
forked processes and display any files it accesses for read and write?
>  
> 
> 2.  Also is there a cleaner way just to get only the files related to
?make? and only follow a process and its children and not get all of the
processes?
>  
Kumara,

You can use progenyof() in your predicate to only trace descendants of a 
particular process.

Menno

If you are not interesting in writing your own scripts, you can always
use scripts from the excellent Dtrace Toolkit -
http://www.opensolaris.org/os/community/dtrace/dtracetoolkit/.

These scripts come to mind:

opensnoop
rwsnoop
Dtruss

Possibly in combination with grep.

Ivan


-----Original Message-----
From: dtrace-discuss-bounces at opensolaris.org
[mailto:dtrace-discuss-bounces at opensolaris.org] On Behalf Of Menno
Lageman
Sent: Thursday, May 25, 2006 12:44 AM
To: Kumara Tejaswi .N
Cc: dtrace-discuss at opensolaris.org
Subject: Re: [dtrace-discuss] DTrace file and process dependencies

Kumara Tejaswi .N wrote:
> 1.  Is there a dtrace command that would follow a process and all its
forked processes and display any files it accesses for read and
write?
>  
> 
> 2.  Also is there a cleaner way just to get only the files related to
"make" and only follow a process and its children and not get all of
the
processes?
>  
Kumara,

You can use progenyof() in your predicate to only trace descendants of a
particular process.

Menno
_______________________________________________
dtrace-discuss mailing list
dtrace-discuss at opensolaris.org

Were you wanting to see the actual reads and writes, or just the opens 
and the file name?  Well this should work for the later.  Modifying for 
reads and writes and restricting to children of "make"
shouldn''t be too
much different.

Invoke with the "-p" or "-c" option to initialize the
$target macro.

#!/usr/sbin/dtrace -s

syscall::open*:entry
/ pid == $target || progenyof($target) /
{
   self->file = arg0;
}

syscall::open:return
/ self->file /
{
   printf("%d %s",pid,copyinstr(self->file));
   self->file = 0;
}


Regards,

Chip


Kumara Tejaswi .N wrote:
>1.  Is there a dtrace command that would follow a process and all its forked
processes and display any files it accesses for read and write?
> 
>
>2.  Also is there a cleaner way just to get only the files related to ?make?
and only follow a process and its children and not get all of the processes?
> 
> 
>This message posted from opensolaris.org
>_______________________________________________
>dtrace-discuss mailing list
>dtrace-discuss at opensolaris.org
>  
>

Oops.  The open:return needs an "*" also to match open64.  Sorry.

#!/usr/sbin/dtrace -s

syscall::open*:entry
/ pid == $target || progenyof($target) /
{
   self->file = arg0;
}

syscall::open*:return
/ self->file /
{
   printf("%d %s",pid,copyinstr(self->file));
   self->file = 0;
}


Chip

Kumara Tejaswi .N wrote:
>1.  Is there a dtrace command that would follow a process and all its forked
processes and display any files it accesses for read and write?
> 
>
>2.  Also is there a cleaner way just to get only the files related to ?make?
and only follow a process and its children and not get all of the processes?
> 
> 
>This message posted from opensolaris.org
>_______________________________________________
>dtrace-discuss mailing list
>dtrace-discuss at opensolaris.org
>  
>