[dtrace-discuss] Tracing FDs

Shanya Jones
2010-12-30T02:04:33Z

Hi :

  (Apology if this is too naive question.)
  Our system is running out of FDs frequently and I would like to trace which
process takes FDs and does not close it.  One suspicion is that many DNS
connection are made to the system which are never closed.
To do this I wrote simple dtrace script;
---
syscall::open*:entry
{
        printf("FD opened > %s[%d(pid),%d(tid)],
%-60s\t\t%Y\n",execname,pid,tid,copyinstr(arg0),walltimestamp);
}

syscall::open*:return
{
        printf("FD closed <
%s[%d(pid),%d(tid)],errno=%d,arg=%d\n",execname,pid,
tid,errno,arg0);
}
---
Q:
- would this capture all of the FD traffic including DNS??
- Is there any other way I can improve this script to achieve my objectives?
How do I aggregate total number of FDs taken by all process at one given time?
  We are not looking for netstat or snoop solution.

Thanks,
  -Shanya