similar to: Change syslog output

Dear dtrace Experts, I have seen some dtrace utilities like opensnoop and execsnoop etc. My interest is to write a simple script that can snoop the files which uses the 3 syscalls like open,create,unlink. I have gone through dtrace oneliners that can do the same : dtrace -n ''syscall::open*:entry { printf("%s %s",execname,copyinstr(arg0));}'' dtrace -n

G''Day Folks, I''ve found another use of dtrace, this makes your console keyboard sound like a typewriter. http://www.brendangregg.com/DTrace/typewriter-0.70.tar.gz I''ve only tested it on an UltraSPARC 5 and a Pentium laptop so far, more to follow. Ok, sorry, not actually a practical use of DTrace. :) Enjoy! Brendan [Sydney, Australia]

everyone, Just out of curiosity, I did a dtrace -n ''syscall:::entry { @num[execname, probefunc] = count(); }'' and looked at the entries produced by ''rm''. I see everything that rm did, *except* the unlinkat - which is unfortunate because I want to trace which processes have deleted which files. So - does dtrace contain unlinkat as a probe for a system call?

Strange problem on a desktop, 64 bit, SXDE3. ] ./jpg1.d dtrace: failed to compile script ./jpg1.d: "/usr/lib/dtrace/iscsi.d", line 94: syntax error near "uiscsiproto_t" Doesn''t matter what script. Even classic oneliners such as: ] dtrace -n ''syscall::open*:entry { printf("%s % s",execname,copyinstr(arg0)); }'' bomb in this way... dtrace:

Hi All, Is there a simple way to list all currently open file descriptors ? TIA.. Regards, Venkat -- This message posted from opensolaris.org

hi fnds, i want to print the filenames on which the stat system call is acting when a stat system call is invoked. can anyone can help me this regard. Thanks jeevan

I''d like to be able to dynamically read external configuration files within a dtrace script. I know dtrace allows inclusion of C header files but only at the preprocessing stage. What we need to do is dynamically enable/disable probes based on current application settings. I''d rather not have a bunch of independant scripts running and being started and killed whenever the

I have a clause that look like this: syscall::write:entry /execname == "ntpd" && self->recspec/ { speculate(self->recspec); printf(" fd=%d buf=%d\n%s",arg0,arg2, stringof(copyin(arg1,arg2-1))); } The ntpd program always write a \n trminated string in this context, so I used the "arg2-1" to drop the \n. This works

After building and bfu''in the lastest ON build, any time I run a dtrace script I get a Seg Fault. Is there a dtrace for dtrace :) Doug root at prae> dtrace -n ''syscall::open*:entry { printf("%s %s",execname,copyinstr(arg0)); }'' Segmentation Fault (core dumped) root at prae> pstack core core ''core'' of 101364: dtrace -n

http://www.securityfocus.com/bid/12825/info/ no patch or anything, is there any action on this?

Hi All, One of the customer is seeing the following error messages. He is using a S10U1 system with all latest patches. Dtrace script is attached. I am not seeing these error messages on S10U2 system. What could be the problem? Thanks, Gangadhar. ------------------------------------------------------------------------ rroberto at njengsunu60-2:~$ dtrace -AFs /lib/svc/share/kcfd.d dtrace:

I got a system that is hung, unable to do most unix commands like ps/who etc... I did: dtrace -c /usr/bin/ps -n ''pid$target::open*:entry {printf("%s %s",execname,copyinstr(arg0)); }'' and it hangs here: 7 65277 open:entry ps /proc/19729/psinfo 7 65277 open:entry ps /proc/11687/psinfo ^C So, I tried to kill -9 11687,

Author: Darren Moffat <Darren.Moffat at Sun.COM> Repository: /hg/zfs-crypto/gate Latest revision: 957d30a3607ed9f3cbe490da5894d1e1b2104033 Total changesets: 28 Log message: resync onnv_105 partial for 6713916 Files: usr/src/Makefile.lint usr/src/Targetdirs usr/src/cmd/Makefile usr/src/cmd/Makefile.cmd usr/src/cmd/acctadm/Makefile usr/src/cmd/acctadm/acctadm.xcl

Hi all, i use xen 3.1 on a gentoo 2007.0 dual opteron machine with Sun x8 Express dual 10 Gigabit Eternet fiber NIC. The NIC work properly on standard kernel and patched Xen kernel (2.6.18) without XEN enabled features, but when i enable "Enable Xen Compatible kernel" choice in "Processor type and features" menu on kernel configuration, NIC is recognized, seems to work but it

Hi, I need help in calculating Java method time-stamp in following fashion. Consider following method example. long method3(long stop) { try { Thread.sleep(1500); } catch (Exception e) { } //////////////////// real CPU intensive operation /////////////////////////// for (int i = 1; i < stop; i++) { stop = stop * stop * i; };

I''ve been trying to get access to a userland string that''s behind a second level pointer using DTrace, but I can''t seem to get it to work. I started with the example on the Team DTrace Tips and Tricks slides: trace(copyinstr(*(uintptr_t *)copyin(arg0, curpsinfo->pr_dmodel == PR_MODEL_ILP32 ? 4 : 8))); And when I couldn''t get it to work, I started

Hi, I ran a d-program with syscall::open:entry probe but got the following error messages sometimes: dtrace: error on enabled probe ID 1 (ID 14: syscall::open:entry): invalid address (0xff34e000) in predicate at DIF offset 76 dtrace: error on enabled probe ID 6 (ID 14: syscall::open:entry): invalid address (0xff34e000) in predicate at DIF offset 28 I don''t know how to interpret these

[1] Predicates in one-liners I would like to list the probe modules in my executable and then dynamically create a dscript to trace execution of those modules alone (by excluding the 3rd party and system libraries). I tried the below script without success. The conditional given in the predicate is not taking effect. Why is this so ? $ dtrace -ln ''pid$target:::

All, The attached script is causing the following error message ... bash-3.00# ./zmon_bug.d dtrace: error on enabled probe ID 2 (ID 4394: fbt:genunix:copen:entry): invalid address (0xfd91747f) in predicate at DIF offset 120 dtrace: error on enabled probe ID 2 (ID 4394: fbt:genunix:copen:entry): invalid address (0xfef81a3f) in predicate at DIF offset 120 Any ideas? thxs Joe --

I have just started my first ''serious'' dtrace script and can use some advice. I want to have a probe triggered when close() occurs after a succesfull write of /etc/hosts ( I want to regenerate the nameserver zone files from /etc/hosts after it has changed) At the moment I have the following code: syscall::open*:entry, syscall::creat*:entry { self->file=arg0;