similar to: how to get scratch buffer in dtrace.

Hi, I have a situation where a DTrace script is printing out extra characters, despite the copyin() call giving a specific length. Can anyone think of why this might be? It''s fine the first time all of the probes fire, but on a second run of my generating operations, I get junk in there. For example: set setop length 5, FOUND KEY, STORED set setop length 5, FOUND KEY, STORED get

[1] Predicates in one-liners I would like to list the probe modules in my executable and then dynamically create a dscript to trace execution of those modules alone (by excluding the 3rd party and system libraries). I tried the below script without success. The conditional given in the predicate is not taking effect. Why is this so ? $ dtrace -ln ''pid$target:::

Hi Expert I want to use dtrace to monitor the content change of one file. I made following scripts, #!/usr/sbin/dtrace -s inline int MYPID = $1; syscall::write:entry /pid == MYPID/ { tracemem(arg1, arg2); printf("\n"); } It always has an following error bash-3.00$ sudo dumpFIFO.dtrace 3836 dtrace: failed to compile script ./dumpFIFO.dtrace: line 19: tracemem( ) argument #2

hi, I''m using the PID provider to trace a 32-bit app, prtdiag. I''m trying to print the value of "propname" (arg1) in the following func: int picl_get_propval_by_name(picl_nodehdl_t nodeh, const char *propname, void *valbuf, size_t nbytes) ... i''ve tried many versions, but this is a representative one: 53 this string propname; 54 55

G''Day Folks, I''ve found another use of dtrace, this makes your console keyboard sound like a typewriter. http://www.brendangregg.com/DTrace/typewriter-0.70.tar.gz I''ve only tested it on an UltraSPARC 5 and a Pentium laptop so far, more to follow. Ok, sorry, not actually a practical use of DTrace. :) Enjoy! Brendan [Sydney, Australia]

I''ve been trying to get access to a userland string that''s behind a second level pointer using DTrace, but I can''t seem to get it to work. I started with the example on the Team DTrace Tips and Tricks slides: trace(copyinstr(*(uintptr_t *)copyin(arg0, curpsinfo->pr_dmodel == PR_MODEL_ILP32 ? 4 : 8))); And when I couldn''t get it to work, I started

everyone, Just out of curiosity, I did a dtrace -n ''syscall:::entry { @num[execname, probefunc] = count(); }'' and looked at the entries produced by ''rm''. I see everything that rm did, *except* the unlinkat - which is unfortunate because I want to trace which processes have deleted which files. So - does dtrace contain unlinkat as a probe for a system call?

Dtracing gethostbyname I''m trying to read the h_alias array and all the entries it points to however every time I copyin an entry pointed to by the first entry in teh h_alias array the other entries in the array get corrupted. So I have ended up with this script: #!/usr/bin/dtrace -CZs #include <netdb.h> pid$target::gethostbyname_r:return { self->r = (struct hostent

I have a clause that look like this: syscall::write:entry /execname == "ntpd" && self->recspec/ { speculate(self->recspec); printf(" fd=%d buf=%d\n%s",arg0,arg2, stringof(copyin(arg1,arg2-1))); } The ntpd program always write a \n trminated string in this context, so I used the "arg2-1" to drop the \n. This works

Dear dtrace Experts, I have seen some dtrace utilities like opensnoop and execsnoop etc. My interest is to write a simple script that can snoop the files which uses the 3 syscalls like open,create,unlink. I have gone through dtrace oneliners that can do the same : dtrace -n ''syscall::open*:entry { printf("%s %s",execname,copyinstr(arg0));}'' dtrace -n

N_conreq:entry { self->x=1; calledaddr=(struct xaddrf *)arg3; callingaddr=(struct xaddrf *)arg4; trace(calledaddr->link_id); tracemem(calledaddr->DTE_MAC.lsap_add, 80); trace(callingaddr->link_id); tracemem(callingaddr->DTE_MAC.lsap_add, 80); } 0 -> N_conreq 255

hi fnds, i want to print the filenames on which the stat system call is acting when a stat system call is invoked. can anyone can help me this regard. Thanks jeevan

I''d like to be able to dynamically read external configuration files within a dtrace script. I know dtrace allows inclusion of C header files but only at the preprocessing stage. What we need to do is dynamically enable/disable probes based on current application settings. I''d rather not have a bunch of independant scripts running and being started and killed whenever the

I''m pleased to pass along news that the Mac OS X DTrace port has been updated in 10.5.3 to fix the issue that caused timer based probes not to fire in the presence of certain untraceable applications. http://blogs.sun.com/ahl/entry/apple_updates_dtrace A big thank you to the folks at Apple for addressing the problem. Adam -- Adam Leventhal, Fishworks

There is a Slashdot discussion today titled "Cambridge Researcher Breaks OpenBSD Systrace". Slashdot anonymous member has a comment "Even Sun''s Dtrace might be vulnerable." I don''t think it is. Comments? Exploiting Concurrency Vulnerabilities in System Call Wrappers http://www.watson.org/~robert/2007woot/2007usenixwoot-exploitingconcurrency.pdf Abstract

After building and bfu''in the lastest ON build, any time I run a dtrace script I get a Seg Fault. Is there a dtrace for dtrace :) Doug root at prae> dtrace -n ''syscall::open*:entry { printf("%s %s",execname,copyinstr(arg0)); }'' Segmentation Fault (core dumped) root at prae> pstack core core ''core'' of 101364: dtrace -n

Howdy, I am trying to migrate several scripts to use application defined types, and am running into a few issues. When I attempt to run a script with a application defined type, it looks like the DTrace preprocessor is getting angry with me: $ cat view.d #include "httpd.h" :::acceptconnection { this->addr = (conn_rec *)copyin(arg0,sizeof(conn_rec *)); } $ dtrace -C

Hi, I ran a d-program with syscall::open:entry probe but got the following error messages sometimes: dtrace: error on enabled probe ID 1 (ID 14: syscall::open:entry): invalid address (0xff34e000) in predicate at DIF offset 76 dtrace: error on enabled probe ID 6 (ID 14: syscall::open:entry): invalid address (0xff34e000) in predicate at DIF offset 28 I don''t know how to interpret these

Hy! I receive an nxge driver messages on console: Aug 18 11:08:42 [hostname] nxge: NOTICE: nxge_ipp_eccue_valid_check: rd_ptr = XXX wr_ptr = YYY I find the bug description/correction at sun web page, and i know i can ignore it. I thinking about how can i delete from console only these messages (here is my first version, what is not (so) elegant): #!/usr/sbin/dtrace -qs #pragma D option

Hi All, One of the customer is seeing the following error messages. He is using a S10U1 system with all latest patches. Dtrace script is attached. I am not seeing these error messages on S10U2 system. What could be the problem? Thanks, Gangadhar. ------------------------------------------------------------------------ rroberto at njengsunu60-2:~$ dtrace -AFs /lib/svc/share/kcfd.d dtrace: