dtrace discuss - Dec 2007 - how to trace fd not closed by a process

I want to trace all open/close. If a process forgot to close a fd,
syscall::close is not fired. Is there a probe which is called when kernel close
the fd?

test.c:
int
main(int argc, char *argv[])
{
  return open("/etc/release", O_RDONLY));
}
----------------------
test.d:
#!/usr/sbin/dtrace -s

syscall::open*:return / pid == $target / {}
syscall::close*:return / pid == $target / {}
----------------------

output of ''./test.d -c ./test'':
dtrace: script ''./test.d'' matched 3 probes
dtrace: pid 5285 has exited
CPU     ID                    FUNCTION:NAME
  0  82675                      open:return


--
This message posted from opensolaris.org

Hi Jan,

I think that putting a probe on fbt::closef:entry should give
you what you want:

# cat rel.d
#!/usr/sbin/dtrace -s

fbt::closef:entry
/execname == "foo && args[0]->f_vnode->v_path != NULL/
{
        @[stringof(args[0]->f_vnode->v_path)] = count();
}

# ./rel.d
dtrace: script ''./rel.d'' matched 1 probe
^C

  /.sh_history                                                      1
  /etc/release                                                      1
  /lib/libc.so.1                                                    1
  /dev/pts/4                                                        3

Jon.
> I want to trace all open/close. If a process forgot to close a fd,
syscall::close is not fired. Is there a probe which is called when kernel close
the fd?
>
> test.c:
> int
> main(int argc, char *argv[])
> {
>   return open("/etc/release", O_RDONLY));
> }
> ----------------------
> test.d:
> #!/usr/sbin/dtrace -s
>
> syscall::open*:return / pid == $target / {}
> syscall::close*:return / pid == $target / {}
> ----------------------
>
> output of ''./test.d -c ./test'':
> dtrace: script ''./test.d'' matched 3 probes
> dtrace: pid 5285 has exited
> CPU     ID                    FUNCTION:NAME
>   0  82675                      open:return
>
>
> --
> This message posted from opensolaris.org
> _______________________________________________
> dtrace-discuss mailing list
> dtrace-discuss at opensolaris.org
>