How do I check how long a old process has been running using dtrace? I know I can do it using ps -o etime or stime. But I like to find out how to do the same using dtrace. Thanks This message posted from opensolaris.org
If you want to know when the currently running process started you could
do something like this:
<probe>
{
printf("%Y", curpsinfo->pr_start.tv_sec * 1000000000);
}
To find out how long it''s been running you can use walltimestamp:
<probe>
{
printf("%d", walltimestamp - curpsinfo->pr_start.tv_sec *
1000000000 -
curpsinfo->pr_start.tv_nsec);
}
Adam
On Fri, Sep 08, 2006 at 11:50:07PM -0700, Asif Iqbal
wrote:> How do I check how long a old process has been running using dtrace? I know
I can do it using
> ps -o etime or stime. But I like to find out how to do the same using
dtrace. Thanks
>
>
> This message posted from opensolaris.org
> _______________________________________________
> dtrace-discuss mailing list
> dtrace-discuss at opensolaris.org
--
Adam Leventhal, Solaris Kernel Development http://blogs.sun.com/ahl
> Sorry I am newbie. Is there a way you can be a quick complete example? I > have the dtarce user guide just download. I know I have a lot to learn but a > complete example would be an inspiration :-)Sure: ---8<--- #!/usr/sbin/dtrace -s #pragma D option quiet syscall::open*:entry { printf("the process that called open(1) (%s) is %d seconds old\n", execname, (walltimestamp - curpsinfo->pr_start.tv_sec * 1000000000 - curpsinfo->pr_start.tv_nsec) / 1000000000); } ---8<--- This script yeilds this output: # ./open.d the process that called open(1) (firefox-bin) is 610777 seconds old the process that called open(1) (xterm) is 0 seconds old the process that called open(1) (xterm) is 0 seconds old the process that called open(1) (xterm) is 0 seconds old the process that called open(1) (utmpd) is 1965920 seconds old the process that called open(1) (pt_chmod) is 0 seconds old the process that called open(1) (uname) is 0 seconds old the process that called open(1) (stty) is 0 seconds old Adam On Mon, Sep 11, 2006 at 11:57:17PM -0400, Asif Iqbal wrote:> On 9/11/06, Adam Leventhal <ahl at eng.sun.com> wrote: > > > >If you want to know when the currently running process started you could > >do something like this: > > > ><probe> > >{ > > printf("%Y", curpsinfo->pr_start.tv_sec * 1000000000); > >} > > > >To find out how long it''s been running you can use walltimestamp: > > > ><probe> > >{ > > printf("%d", walltimestamp - curpsinfo->pr_start.tv_sec * > >1000000000 - > > curpsinfo->pr_start.tv_nsec); > >} > > > > Sorry I am newbie. Is there a way you can be a quick complete example? I > have the dtarce user guide just download. I know I have a lot to learn but a > complete example would be an inspiration :-) > > > Adam > > > >On Fri, Sep 08, 2006 at 11:50:07PM -0700, Asif Iqbal wrote: > >> How do I check how long a old process has been running using dtrace? I > >know I can do it using > >> ps -o etime or stime. But I like to find out how to do the same using > >dtrace. Thanks > >> > >> > >> This message posted from opensolaris.org > >> _______________________________________________ > >> dtrace-discuss mailing list > >> dtrace-discuss at opensolaris.org > > > >-- > >Adam Leventhal, Solaris Kernel Development http://blogs.sun.com/ahl > > > > > > -- > Asif Iqbal > PGP Key: 0xE62693C5 KeyServer: pgp.mit.edu-- Adam Leventhal, Solaris Kernel Development http://blogs.sun.com/ahl
On 9/12/06, Adam Leventhal <ahl at eng.sun.com> wrote:> > > Sorry I am newbie. Is there a way you can be a quick complete example? I > > have the dtarce user guide just download. I know I have a lot to learn > but a > > complete example would be an inspiration :-) > > Sure: > > ---8<--- > > #!/usr/sbin/dtrace -s > > #pragma D option quiet > > syscall::open*:entry > { > printf("the process that called open(1) (%s) is %d seconds old\n", > execname, > (walltimestamp - curpsinfo->pr_start.tv_sec * 1000000000 - > curpsinfo->pr_start.tv_nsec) / 1000000000); > }How far back the syscall::open* can check? If a process say has been running for 2 days will the above probe catch it? Also I am using the predicate /execname == "java"/ to catch only java processes. Is there a I can modify the predicate to display process that is longer than say 10 hrs? Also is there way I can get more info about the process like UID and PID i.e? I also like to use this as a cron job to take a one min snapshot instead of running interactively. Is that possible? Sorry way too many question for one email I guess. Thanks for your help. (I can''t believe I am getting help from one of The Dtrace Three) ---8<---> > This script yeilds this output: > > # ./open.d > the process that called open(1) (firefox-bin) is 610777 seconds old > the process that called open(1) (xterm) is 0 seconds old > the process that called open(1) (xterm) is 0 seconds old > the process that called open(1) (xterm) is 0 seconds old > the process that called open(1) (utmpd) is 1965920 seconds old > the process that called open(1) (pt_chmod) is 0 seconds old > the process that called open(1) (uname) is 0 seconds old > the process that called open(1) (stty) is 0 seconds old > > Adam > > On Mon, Sep 11, 2006 at 11:57:17PM -0400, Asif Iqbal wrote: > > On 9/11/06, Adam Leventhal <ahl at eng.sun.com> wrote: > > > > > >If you want to know when the currently running process started you > could > > >do something like this: > > > > > ><probe> > > >{ > > > printf("%Y", curpsinfo->pr_start.tv_sec * 1000000000); > > >} > > > > > >To find out how long it''s been running you can use walltimestamp: > > > > > ><probe> > > >{ > > > printf("%d", walltimestamp - curpsinfo->pr_start.tv_sec * > > >1000000000 - > > > curpsinfo->pr_start.tv_nsec); > > >} > > > > > > > > Sorry I am newbie. Is there a way you can be a quick complete example? I > > have the dtarce user guide just download. I know I have a lot to learn > but a > > complete example would be an inspiration :-) > > > > > > Adam > > > > > >On Fri, Sep 08, 2006 at 11:50:07PM -0700, Asif Iqbal wrote: > > >> How do I check how long a old process has been running using dtrace? > I > > >know I can do it using > > >> ps -o etime or stime. But I like to find out how to do the same using > > >dtrace. Thanks > > >> > > >> > > >> This message posted from opensolaris.org > > >> _______________________________________________ > > >> dtrace-discuss mailing list > > >> dtrace-discuss at opensolaris.org > > > > > >-- > > >Adam Leventhal, Solaris Kernel Development > http://blogs.sun.com/ahl > > > > > > > > > > > -- > > Asif Iqbal > > PGP Key: 0xE62693C5 KeyServer: pgp.mit.edu > > -- > Adam Leventhal, Solaris Kernel Development http://blogs.sun.com/ahl >-- Asif Iqbal PGP Key: 0xE62693C5 KeyServer: pgp.mit.edu -------------- next part -------------- An HTML attachment was scrubbed... URL: <http://mail.opensolaris.org/pipermail/dtrace-discuss/attachments/20060912/781a167b/attachment.html>
Asif Iqbal wrote:> On 9/12/06, *Adam Leventhal* <ahl at eng.sun.com <mailto:ahl at eng.sun.com>> > wrote: > > > Sorry I am newbie. Is there a way you can be a quick complete > example? I > > have the dtarce user guide just download. I know I have a lot to > learn but a > > complete example would be an inspiration :-) > > Sure: > > ---8<--- > > #!/usr/sbin/dtrace -s > > #pragma D option quiet > > syscall::open*:entry > { > printf("the process that called open(1) (%s) is %d seconds > old\n", > execname, > (walltimestamp - curpsinfo->pr_start.tv_sec * 1000000000 - > curpsinfo->pr_start.tv_nsec) / 1000000000); > } > > > > How far back the syscall::open* can check? If a process say has been > running for 2 days will the above probe catch it?the probe fires whenever open() is called. The value printed, pr_start, is documented in the DTrace manual, as "process start time, from the epoch". "The epoch" is a time well-known to Unix programmers as midnight, Jan 1, 1970, UTC.> Also I am using the > predicate /execname == "java"/ to catch only java processes. Is there a > I can modify the predicate to display process that is longer than say 10 > hrs?Do you mean "only longer than 10 hours"? Yes, of course; you would add a predicate that calculates the time just exactly as Adam''s example does. < Also is there way I can get more info about the process like UID> and PID i.e?Yes, of course. Again, this is documented in the DTrace manual. pr_pid and pr_uid and pr_euid are part of the psinfo_t structure that curpsinfo points to, but also there is a predefined DTrace variable named simply ''pid'', and one named ''uid'', that you can use. Again, this is documented in the DTrace manual.> I also like to use this as a cron job to take a one min > snapshot instead of running interactively. Is that possible?A DTrace program is like any other program invoked from the command line, and so is certainly invocatable from cron. However, if you''re going to get an immediate report of all processes, you probably want to do something more like walking the process tree at the time of invocation, and that''s probably not a great job for DTrace; DTrace is more about setting tracepoints that you expect to happen in the future, and collecting data *when* they happen, not "examining the state of the kernel at the time of invocation".> Sorry way too many question for one email I guess. > > Thanks for your help. > > (I can''t believe I am getting help from one of The Dtrace Three) > > > ---8<--- > > This script yeilds this output: > > # ./open.d > the process that called open(1) (firefox-bin) is 610777 seconds old > the process that called open(1) (xterm) is 0 seconds old > the process that called open(1) (xterm) is 0 seconds old > the process that called open(1) (xterm) is 0 seconds old > the process that called open(1) (utmpd) is 1965920 seconds old > the process that called open(1) (pt_chmod) is 0 seconds old > the process that called open(1) (uname) is 0 seconds old > the process that called open(1) (stty) is 0 seconds old > > Adam > > On Mon, Sep 11, 2006 at 11:57:17PM -0400, Asif Iqbal wrote: > > On 9/11/06, Adam Leventhal <ahl at eng.sun.com > <mailto:ahl at eng.sun.com>> wrote: > > > > > >If you want to know when the currently running process started > you could > > >do something like this: > > > > > ><probe> > > >{ > > > printf("%Y", curpsinfo->pr_start.tv_sec * 1000000000); > > >} > > > > > >To find out how long it''s been running you can use walltimestamp: > > > > > ><probe> > > >{ > > > printf("%d", walltimestamp - curpsinfo->pr_start.tv_sec * > > >1000000000 - > > > curpsinfo->pr_start.tv_nsec); > > >} > > > > > > > > Sorry I am newbie. Is there a way you can be a quick complete > example? I > > have the dtarce user guide just download. I know I have a lot to > learn but a > > complete example would be an inspiration :-) > > > > > > Adam > > > > > >On Fri, Sep 08, 2006 at 11:50:07PM -0700, Asif Iqbal wrote: > > >> How do I check how long a old process has been running using > dtrace? I > > >know I can do it using > > >> ps -o etime or stime. But I like to find out how to do the > same using > > >dtrace. Thanks > > >> > > >> > > >> This message posted from opensolaris.org <http://opensolaris.org> > > >> _______________________________________________ > > >> dtrace-discuss mailing list > > >> dtrace-discuss at opensolaris.org > <mailto:dtrace-discuss at opensolaris.org> > > > > > >-- > > >Adam Leventhal, Solaris Kernel Development > http://blogs.sun.com/ahl > > > > > > > > > > > -- > > Asif Iqbal > > PGP Key: 0xE62693C5 KeyServer: pgp.mit.edu <http://pgp.mit.edu> > > -- > Adam Leventhal, Solaris Kernel Development > http://blogs.sun.com/ahl > > > > > -- > Asif Iqbal > PGP Key: 0xE62693C5 KeyServer: pgp.mit.edu <http://pgp.mit.edu> > > > > ------------------------------------------------------------------------ > > _______________________________________________ > dtrace-discuss mailing list > dtrace-discuss at opensolaris.org
Asif, Although you can collect data for a period of time and then conditionally through away the chaff, you can''t go back and collect data from some point before the probe was activated, unless the data itself is some kind of recorded history (like how long the process has been running). In order for the "syscall::open*:entry" to fire, there has to be an open while the DTrace program is running. In the words of Scotty (Star Trek), "The rrright tool for the rrright job!" Everything you''ve told us about what you want to do clearly says "ps" to me (or "ps" driven by a script), IMHO. DTrace is so flexible, that you can make it do lots of things, but for the most part, it''s designed to gather data that is driven by system events, not grab data on demand. However, there is usually a way to make DTrace do it anyway. For example, you want to get time information for the psinfo structure of a process, but the process needs to cause some event to happen, and your D script needs to know in advance what kind of event that''s going to be, so you can instrument the right probe (or instrument all of them and wait for "anything" to happen: probably not the best choice). DTrace has a "-p" command line flag that allows you to identify a particular process to be DTrace''s special target. I''m not entirely sure of everything the framework does as a result of "-p", but one thing it does do is cause the process to use a few cycles. Which means, even if it''s sleeping, it''s going to go on the ready queue for a CPU for a moment. If you use the "sched:::on-cpu" probe, and then use a predicate of / $target == pid /, you can grab the psinfo data when the process take its cycles. Chip Asif Iqbal wrote:> On 9/12/06, *Adam Leventhal* <ahl at eng.sun.com > <mailto:ahl at eng.sun.com>> wrote: > > > Sorry I am newbie. Is there a way you can be a quick complete > example? I > > have the dtarce user guide just download. I know I have a lot to > learn but a > > complete example would be an inspiration :-) > > Sure: > > ---8<--- > > #!/usr/sbin/dtrace -s > > #pragma D option quiet > > syscall::open*:entry > { > printf("the process that called open(1) (%s) is %d seconds > old\n", > execname, > (walltimestamp - curpsinfo->pr_start.tv_sec * 1000000000 - > curpsinfo->pr_start.tv_nsec) / 1000000000); > } > > > > How far back the syscall::open* can check? If a process say has been > running for 2 days will the above probe catch it? Also I am using the > predicate /execname == "java"/ to catch only java processes. Is there > a I can modify the predicate to display process that is longer than > say 10 hrs? Also is there way I can get more info about the process > like UID and PID i.e? I also like to use this as a cron job to take a > one min snapshot instead of running interactively. Is that possible? > > Sorry way too many question for one email I guess. > > Thanks for your help. > > (I can''t believe I am getting help from one of The Dtrace Three) > > > ---8<--- > > This script yeilds this output: > > # ./open.d > the process that called open(1) (firefox-bin) is 610777 seconds old > the process that called open(1) (xterm) is 0 seconds old > the process that called open(1) (xterm) is 0 seconds old > the process that called open(1) (xterm) is 0 seconds old > the process that called open(1) (utmpd) is 1965920 seconds old > the process that called open(1) (pt_chmod) is 0 seconds old > the process that called open(1) (uname) is 0 seconds old > the process that called open(1) (stty) is 0 seconds old > > Adam > > On Mon, Sep 11, 2006 at 11:57:17PM -0400, Asif Iqbal wrote: > > On 9/11/06, Adam Leventhal <ahl at eng.sun.com > <mailto:ahl at eng.sun.com>> wrote: > > > > > >If you want to know when the currently running process started > you could > > >do something like this: > > > > > ><probe> > > >{ > > > printf("%Y", curpsinfo->pr_start.tv_sec * 1000000000); > > >} > > > > > >To find out how long it''s been running you can use walltimestamp: > > > > > ><probe> > > >{ > > > printf("%d", walltimestamp - curpsinfo->pr_start.tv_sec * > > >1000000000 - > > > curpsinfo->pr_start.tv_nsec); > > >} > > > > > > > > Sorry I am newbie. Is there a way you can be a quick complete > example? I > > have the dtarce user guide just download. I know I have a lot to > learn but a > > complete example would be an inspiration :-) > > > > > > Adam > > > > > >On Fri, Sep 08, 2006 at 11:50:07PM -0700, Asif Iqbal wrote: > > >> How do I check how long a old process has been running using > dtrace? I > > >know I can do it using > > >> ps -o etime or stime. But I like to find out how to do the > same using > > >dtrace. Thanks > > >> > > >> > > >> This message posted from opensolaris.org <http://opensolaris.org> > > >> _______________________________________________ > > >> dtrace-discuss mailing list > > >> dtrace-discuss at opensolaris.org > <mailto:dtrace-discuss at opensolaris.org> > > > > > >-- > > >Adam Leventhal, Solaris Kernel Development > http://blogs.sun.com/ahl > > > > > > > > > > > -- > > Asif Iqbal > > PGP Key: 0xE62693C5 KeyServer: pgp.mit.edu <http://pgp.mit.edu> > > -- > Adam Leventhal, Solaris Kernel Development > http://blogs.sun.com/ahl > > > > > -- > Asif Iqbal > PGP Key: 0xE62693C5 KeyServer: pgp.mit.edu <http://pgp.mit.edu> > > > ------------------------------------------------------------------------ > > _______________________________________________ > dtrace-discuss mailing list > dtrace-discuss at opensolaris.org