similar to: Dtrace queries - predicates & func arg tracing

everyone, Just out of curiosity, I did a dtrace -n ''syscall:::entry { @num[execname, probefunc] = count(); }'' and looked at the entries produced by ''rm''. I see everything that rm did, *except* the unlinkat - which is unfortunate because I want to trace which processes have deleted which files. So - does dtrace contain unlinkat as a probe for a system call?

I''d like to be able to dynamically read external configuration files within a dtrace script. I know dtrace allows inclusion of C header files but only at the preprocessing stage. What we need to do is dynamically enable/disable probes based on current application settings. I''d rather not have a bunch of independant scripts running and being started and killed whenever the

hi fnds, i want to print the filenames on which the stat system call is acting when a stat system call is invoked. can anyone can help me this regard. Thanks jeevan

Hi i''m trying to write my first dtrace script apparently i bit off a bit more than i can chew, i want to track io over sockets, i found your socketsize.d that gave me how to track writes, but i''m at a loss how to track reads, frankly i don''t see how your write tracker works because it uses a probe in a function that only takes two arguments but you grab size of write

[Perhaps someone could rename this list to dtrace-matt-problems-discuss?] If I run this script against my binary (which contains a USDT probe called ''concurrentq-latency''): ::: / probename == "concurrentq-latency" / { printf("[%s]:[%s]:[%s]\n", probeprov, probefunc, probename); } I get this output: dtrace: script ''testq.d'' matched 46056

I''ve been trying to get access to a userland string that''s behind a second level pointer using DTrace, but I can''t seem to get it to work. I started with the example on the Team DTrace Tips and Tricks slides: trace(copyinstr(*(uintptr_t *)copyin(arg0, curpsinfo->pr_dmodel == PR_MODEL_ILP32 ? 4 : 8))); And when I couldn''t get it to work, I started

Hi, I need help in calculating Java method time-stamp in following fashion. Consider following method example. long method3(long stop) { try { Thread.sleep(1500); } catch (Exception e) { } //////////////////// real CPU intensive operation /////////////////////////// for (int i = 1; i < stop; i++) { stop = stop * stop * i; };

Hi, I have a situation where a DTrace script is printing out extra characters, despite the copyin() call giving a specific length. Can anyone think of why this might be? It''s fine the first time all of the probes fire, but on a second run of my generating operations, I get junk in there. For example: set setop length 5, FOUND KEY, STORED set setop length 5, FOUND KEY, STORED get

G''Day Folks, I''ve found another use of dtrace, this makes your console keyboard sound like a typewriter. http://www.brendangregg.com/DTrace/typewriter-0.70.tar.gz I''ve only tested it on an UltraSPARC 5 and a Pentium laptop so far, more to follow. Ok, sorry, not actually a practical use of DTrace. :) Enjoy! Brendan [Sydney, Australia]

Dtracing gethostbyname I''m trying to read the h_alias array and all the entries it points to however every time I copyin an entry pointed to by the first entry in teh h_alias array the other entries in the array get corrupted. So I have ended up with this script: #!/usr/bin/dtrace -CZs #include <netdb.h> pid$target::gethostbyname_r:return { self->r = (struct hostent

I have a clause that look like this: syscall::write:entry /execname == "ntpd" && self->recspec/ { speculate(self->recspec); printf(" fd=%d buf=%d\n%s",arg0,arg2, stringof(copyin(arg1,arg2-1))); } The ntpd program always write a \n trminated string in this context, so I used the "arg2-1" to drop the \n. This works

Whilst trying out some D to get an insight into what is the most common reason for a given function to return, I have bumped into an error I don''t understand. The first take on what I was trying to do was: # dtrace -n ''fbt:ip:ip_input:return{@home[arg0] = count();}'' and all was well. The next step was: # dtrace -n

Dear dtrace Experts, I have seen some dtrace utilities like opensnoop and execsnoop etc. My interest is to write a simple script that can snoop the files which uses the 3 syscalls like open,create,unlink. I have gone through dtrace oneliners that can do the same : dtrace -n ''syscall::open*:entry { printf("%s %s",execname,copyinstr(arg0));}'' dtrace -n

Referring to the DTrace manual: "Module If this probe corresponds to a specific program location, the name of the module in which the probe is located. This name is either the name of a kernel module or the name of a user library. Function If this probe corresponds to a specific program location, the name of the program function in which the probe is located." and then ...

hi, I''m using the PID provider to trace a 32-bit app, prtdiag. I''m trying to print the value of "propname" (arg1) in the following func: int picl_get_propval_by_name(picl_nodehdl_t nodeh, const char *propname, void *valbuf, size_t nbytes) ... i''ve tried many versions, but this is a representative one: 53 this string propname; 54 55

Hi, I ran a d-program with syscall::open:entry probe but got the following error messages sometimes: dtrace: error on enabled probe ID 1 (ID 14: syscall::open:entry): invalid address (0xff34e000) in predicate at DIF offset 76 dtrace: error on enabled probe ID 6 (ID 14: syscall::open:entry): invalid address (0xff34e000) in predicate at DIF offset 28 I don''t know how to interpret these

Hi Expert I want to use dtrace to monitor the content change of one file. I made following scripts, #!/usr/sbin/dtrace -s inline int MYPID = $1; syscall::write:entry /pid == MYPID/ { tracemem(arg1, arg2); printf("\n"); } It always has an following error bash-3.00$ sudo dumpFIFO.dtrace 3836 dtrace: failed to compile script ./dumpFIFO.dtrace: line 19: tracemem( ) argument #2

We are using following dtrace script to analyze an application. However we see different number of lwp_yield and yield calls reported depending on whether we trace mutex_lock or mutex_unlock or not. The number reported when we are not tracing mutex_lock or mutex_unlock is higher. What could be going on here and which one is the correct number. This is on S10 U2. Thanks, Rao.

hi, I am trying to find out the avg cpu time spent in each of my user methods (exclusive of other methods invoked by a method). Hence the following snippet failed miserably: ----------------------- pid$target:a.out::entry { time[probefunc] = timestamp;} pid$target:a.out::return { @spent[probefunc] = avg(timestamp - time[probefunc]);} END { printa(@spent);}

I have just started my first ''serious'' dtrace script and can use some advice. I want to have a probe triggered when close() occurs after a succesfull write of /etc/hosts ( I want to regenerate the nameserver zone files from /etc/hosts after it has changed) At the moment I have the following code: syscall::open*:entry, syscall::creat*:entry { self->file=arg0;