similar to: hangs when doing open /pro/pid/psinfo

Dear dtrace Experts, I have seen some dtrace utilities like opensnoop and execsnoop etc. My interest is to write a simple script that can snoop the files which uses the 3 syscalls like open,create,unlink. I have gone through dtrace oneliners that can do the same : dtrace -n ''syscall::open*:entry { printf("%s %s",execname,copyinstr(arg0));}'' dtrace -n

Hello, On Sun, Jul 17, 2016 at 10:12:26PM -0700, Kees Cook wrote: > On Sun, Jul 17, 2016 at 9:37 PM, Namhyung Kim <namhyung at kernel.org> wrote: > > The virtio pstore driver provides interface to the pstore subsystem so > > that the guest kernel's log/dump message can be saved on the host > > machine. Users can access the log file directly on the host, or on the

Hello, On Sun, Jul 17, 2016 at 10:12:26PM -0700, Kees Cook wrote: > On Sun, Jul 17, 2016 at 9:37 PM, Namhyung Kim <namhyung at kernel.org> wrote: > > The virtio pstore driver provides interface to the pstore subsystem so > > that the guest kernel's log/dump message can be saved on the host > > machine. Users can access the log file directly on the host, or on the

Strange problem on a desktop, 64 bit, SXDE3. ] ./jpg1.d dtrace: failed to compile script ./jpg1.d: "/usr/lib/dtrace/iscsi.d", line 94: syntax error near "uiscsiproto_t" Doesn''t matter what script. Even classic oneliners such as: ] dtrace -n ''syscall::open*:entry { printf("%s % s",execname,copyinstr(arg0)); }'' bomb in this way... dtrace:

The virtio pstore driver provides interface to the pstore subsystem so that the guest kernel's log/dump message can be saved on the host machine. Users can access the log file directly on the host, or on the guest at the next boot using pstore filesystem. It currently deals with kernel log (printk) buffer only, but we can extend it to have other information (like ftrace dump) later. It

Hy! I receive an nxge driver messages on console: Aug 18 11:08:42 [hostname] nxge: NOTICE: nxge_ipp_eccue_valid_check: rd_ptr = XXX wr_ptr = YYY I find the bug description/correction at sun web page, and i know i can ignore it. I thinking about how can i delete from console only these messages (here is my first version, what is not (so) elegant): #!/usr/sbin/dtrace -qs #pragma D option

After building and bfu''in the lastest ON build, any time I run a dtrace script I get a Seg Fault. Is there a dtrace for dtrace :) Doug root at prae> dtrace -n ''syscall::open*:entry { printf("%s %s",execname,copyinstr(arg0)); }'' Segmentation Fault (core dumped) root at prae> pstack core core ''core'' of 101364: dtrace -n

Hi, I ran a d-program with syscall::open:entry probe but got the following error messages sometimes: dtrace: error on enabled probe ID 1 (ID 14: syscall::open:entry): invalid address (0xff34e000) in predicate at DIF offset 76 dtrace: error on enabled probe ID 6 (ID 14: syscall::open:entry): invalid address (0xff34e000) in predicate at DIF offset 28 I don''t know how to interpret these

G''Day Folks, I''ve found another use of dtrace, this makes your console keyboard sound like a typewriter. http://www.brendangregg.com/DTrace/typewriter-0.70.tar.gz I''ve only tested it on an UltraSPARC 5 and a Pentium laptop so far, more to follow. Ok, sorry, not actually a practical use of DTrace. :) Enjoy! Brendan [Sydney, Australia]

A user has asked us to find out who is changing one of their files and how it is being changed. I came up with the script below: #!/usr/sbin/dtrace -s #pragma D option quiet BEGIN { printf("\n Timestamp gid uid pid ppid execname function current directory file name\n\n"); } syscall::open:entry,

Hi, I''m trying to trace the io of a given file, but I have a feeling that it''s been done via a script, as such I''d like to be able to tell the names of the calling processe tree, similar to what ptree produces. Is there any way to get this information without running ptree using system()? Thanks, Darren.

Dtracing gethostbyname I''m trying to read the h_alias array and all the entries it points to however every time I copyin an entry pointed to by the first entry in teh h_alias array the other entries in the array get corrupted. So I have ended up with this script: #!/usr/bin/dtrace -CZs #include <netdb.h> pid$target::gethostbyname_r:return { self->r = (struct hostent

Hi Kees, On Mon, Jul 18, 2016 at 10:50:06AM -0700, Kees Cook wrote: > On Sun, Jul 17, 2016 at 10:50 PM, Namhyung Kim <namhyung at kernel.org> wrote: > > Hello, > > > > On Sun, Jul 17, 2016 at 10:12:26PM -0700, Kees Cook wrote: > >> On Sun, Jul 17, 2016 at 9:37 PM, Namhyung Kim <namhyung at kernel.org> wrote: > > [SNIP] > >> > +static u16

Hi Kees, On Mon, Jul 18, 2016 at 10:50:06AM -0700, Kees Cook wrote: > On Sun, Jul 17, 2016 at 10:50 PM, Namhyung Kim <namhyung at kernel.org> wrote: > > Hello, > > > > On Sun, Jul 17, 2016 at 10:12:26PM -0700, Kees Cook wrote: > >> On Sun, Jul 17, 2016 at 9:37 PM, Namhyung Kim <namhyung at kernel.org> wrote: > > [SNIP] > >> > +static u16

I''ve been trying to get access to a userland string that''s behind a second level pointer using DTrace, but I can''t seem to get it to work. I started with the example on the Team DTrace Tips and Tricks slides: trace(copyinstr(*(uintptr_t *)copyin(arg0, curpsinfo->pr_dmodel == PR_MODEL_ILP32 ? 4 : 8))); And when I couldn''t get it to work, I started

I have just started my first ''serious'' dtrace script and can use some advice. I want to have a probe triggered when close() occurs after a succesfull write of /etc/hosts ( I want to regenerate the nameserver zone files from /etc/hosts after it has changed) At the moment I have the following code: syscall::open*:entry, syscall::creat*:entry { self->file=arg0;

everyone, Just out of curiosity, I did a dtrace -n ''syscall:::entry { @num[execname, probefunc] = count(); }'' and looked at the entries produced by ''rm''. I see everything that rm did, *except* the unlinkat - which is unfortunate because I want to trace which processes have deleted which files. So - does dtrace contain unlinkat as a probe for a system call?

On Sun, Jul 17, 2016 at 10:50 PM, Namhyung Kim <namhyung at kernel.org> wrote: > Hello, > > On Sun, Jul 17, 2016 at 10:12:26PM -0700, Kees Cook wrote: >> On Sun, Jul 17, 2016 at 9:37 PM, Namhyung Kim <namhyung at kernel.org> wrote: >> > The virtio pstore driver provides interface to the pstore subsystem so >> > that the guest kernel's log/dump

The virtio pstore driver provides interface to the pstore subsystem so that the guest kernel's log/dump message can be saved on the host machine. Users can access the log file directly on the host, or on the guest at the next boot using pstore filesystem. It currently deals with kernel log (printk) buffer only, but we can extend it to have other information (like ftrace dump) later. It

The virtio pstore driver provides interface to the pstore subsystem so that the guest kernel's log/dump message can be saved on the host machine. Users can access the log file directly on the host, or on the guest at the next boot using pstore filesystem. It currently deals with kernel log (printk) buffer only, but we can extend it to have other information (like ftrace dump) later. It