Dtrace
From pressy's brainbackup
Some short cmds or one-liners around dtrace
ARC accesses by applicaiton
# dtrace -n 'sdt:zfs::arc-hit,sdt:zfs::arc-miss { @[execname] = count() }'
found @[1]
what is really going on
One nice example - everyone knows "man man" but what is really happening when this command is issued? Dtrace filtered on user id while typing man man on another terminal.
root@vbox01:~# dtrace -n 'proc:::exec-success /uid == 100/ { trace(curpsinfo->pr_psargs); }'
dtrace: description 'proc:::exec-success ' matched 1 probe
CPU ID FUNCTION:NAME
0 716 exec_common:exec-success /usr/gnu/bin/tbl
0 716 exec_common:exec-success /usr/bin/less -ins /tmp/mpTijdFb
1 716 exec_common:exec-success man man
1 716 exec_common:exec-success /usr/bin/troff -E -T ascii -mandoc
1 716 exec_common:exec-success /usr/bin/mv -f /tmp/mpTijdFb /usr/share/man/cat1/man.1
2 716 exec_common:exec-success /usr/bin/eqn -T ascii
3 716 exec_common:exec-success /usr/bin/preconv -D latin-1 /usr/share/man/man1/man.1
3 716 exec_common:exec-success /usr/bin/grotty -c
^C
And which files where accessed by "man man"?
root@vbox01:~# dtrace -n 'syscall::read:entry /uid == 100/ {@reads[execname, fds[arg0].fi_pathname] = count(); }'
dtrace: description 'syscall::read:entry ' matched 1 probe
^C
less /devices/pseudo/sy@0:tty 1
man /usr/share/man/man.cf 1
man /usr/share/man/man1/man.1 1
troff /usr/share/lib/zoneinfo/Europe/Vienna 1
eqn /usr/share/groff/1.22.3/tmac/eqnrc 2
grotty /usr/share/groff/1.22.3/font/devascii/B 2
grotty /usr/share/groff/1.22.3/font/devascii/DESC 2
grotty /usr/share/groff/1.22.3/font/devascii/I 2
grotty /usr/share/groff/1.22.3/font/devascii/R 2
less /export/home/pressy/.lesshst 2
less /tmp/mpNgF_9d 2
less /usr/gnu/share/terminfo/x/xterm-256color 2
preconv /usr/share/man/man1/man.1 2
troff /usr/share/groff/1.22.3/font/devascii/B 2
troff /usr/share/groff/1.22.3/font/devascii/BI 2
troff /usr/share/groff/1.22.3/font/devascii/DESC 2
troff /usr/share/groff/1.22.3/font/devascii/I 2
troff /usr/share/groff/1.22.3/font/devascii/R 2
troff /usr/share/groff/1.22.3/tmac/an-ext.tmac 2
troff /usr/share/groff/1.22.3/tmac/an-old.tmac 2
troff /usr/share/groff/1.22.3/tmac/andoc.tmac 2
troff /usr/share/groff/1.22.3/tmac/composite.tmac 2
troff /usr/share/groff/1.22.3/tmac/devtag.tmac 2
troff /usr/share/groff/1.22.3/tmac/fallbacks.tmac 2
troff /usr/share/groff/1.22.3/tmac/hyphen.us 2
troff /usr/share/groff/1.22.3/tmac/hyphenex.us 2
troff /usr/share/groff/1.22.3/tmac/papersize.tmac 2
troff /usr/share/groff/1.22.3/tmac/pspic.tmac 2
troff /usr/share/groff/1.22.3/tmac/troffrc 2
troff /usr/share/groff/1.22.3/tmac/troffrc-end 2
troff /usr/share/groff/1.22.3/tmac/tty.tmac 2
troff /usr/share/groff/site-tmac/man.local 2
tbl <unknown> 7
eqn <unknown> 8
troff <unknown> 8
bash /dev/pts/2 9
sshd <unknown> 11
sshd /devices/pseudo/clone@0:ptm 20
man <unknown> 32
grotty <unknown> 33
root@vbox01:~#