Rich,
How about thread local associative arrays. Not accounting for syscall
probe variants you might want to use, the program could look something like:
syscall::open:return
/ !errno /
{
self->read[arg0] = 1;
self->write[arg0] = 1;
self->lseek[arg0] = 1;
self->mmap[arg0] = 1;
}
syscall::read:entry
/ self->read[arg0] /
{
self->read[arg0] = 0;
printf ("First read fd = %d\n", arg0);
}
syscall::write:entry
/ self->write[arg0] /
{
self->write[arg0] = 0;
printf ("First write fd = %d\n", arg0);
}
syscall::lseek:entry
/ self->lseek[arg0] /
{
self->lseek[arg0] = 0;
printf ("First lseek fd = %d\n", arg0);
}
syscall::mmap:entry
/ self->mmap[arg4] /
{
self->mmap[arg4] = 0;
printf ("First mmap fd = %d\n", arg4);
}
syscall::close:entry
{
self->read[arg0] = 0;
self->write[arg0] = 0;
self->lseek[arg0] = 0;
self->mmap[arg0] = 0;
}
Is this the least intrusive? I don''t see anyway to account for a
varying number of fds per thread and be any less intrusive.
Chip Bennett
Laurus Technologies, Inc.
Rich Morin wrote:
>I''d like to trace the first instances of I/O (e.g., reads,
>writes, seeks) that takes place on each opened file. After
>that, I don''t want to hear about I/O until the close. Then,
>if the file gets opened again, things start over. So...
>
> open
> read
> ...
> seek
> ...
> write
> ...
> close
> ...
> open
> write
> ...
>
>What''s the least intrusive way to accomplish this?
>
>-r
>
>