Difference between revisions of "Dtrace"
From pressy's brainbackup
Line 25: | Line 25: | ||
3 716 exec_common:exec-success /usr/bin/grotty -c | 3 716 exec_common:exec-success /usr/bin/grotty -c | ||
^C | ^C | ||
+ | </pre> | ||
+ | |||
+ | And which files where accessed by "man man"? | ||
+ | <pre> | ||
+ | root@vbox01:~# dtrace -n 'syscall::read:entry /uid == 100/ {@reads[execname, fds[arg0].fi_pathname] = count(); }' | ||
+ | dtrace: description 'syscall::read:entry ' matched 1 probe | ||
+ | ^C | ||
+ | |||
+ | less /devices/pseudo/sy@0:tty 1 | ||
+ | man /usr/share/man/man.cf 1 | ||
+ | man /usr/share/man/man1/man.1 1 | ||
+ | troff /usr/share/lib/zoneinfo/Europe/Vienna 1 | ||
+ | eqn /usr/share/groff/1.22.3/tmac/eqnrc 2 | ||
+ | grotty /usr/share/groff/1.22.3/font/devascii/B 2 | ||
+ | grotty /usr/share/groff/1.22.3/font/devascii/DESC 2 | ||
+ | grotty /usr/share/groff/1.22.3/font/devascii/I 2 | ||
+ | grotty /usr/share/groff/1.22.3/font/devascii/R 2 | ||
+ | less /export/home/pressy/.lesshst 2 | ||
+ | less /tmp/mpNgF_9d 2 | ||
+ | less /usr/gnu/share/terminfo/x/xterm-256color 2 | ||
+ | preconv /usr/share/man/man1/man.1 2 | ||
+ | troff /usr/share/groff/1.22.3/font/devascii/B 2 | ||
+ | troff /usr/share/groff/1.22.3/font/devascii/BI 2 | ||
+ | troff /usr/share/groff/1.22.3/font/devascii/DESC 2 | ||
+ | troff /usr/share/groff/1.22.3/font/devascii/I 2 | ||
+ | troff /usr/share/groff/1.22.3/font/devascii/R 2 | ||
+ | troff /usr/share/groff/1.22.3/tmac/an-ext.tmac 2 | ||
+ | troff /usr/share/groff/1.22.3/tmac/an-old.tmac 2 | ||
+ | troff /usr/share/groff/1.22.3/tmac/andoc.tmac 2 | ||
+ | troff /usr/share/groff/1.22.3/tmac/composite.tmac 2 | ||
+ | troff /usr/share/groff/1.22.3/tmac/devtag.tmac 2 | ||
+ | troff /usr/share/groff/1.22.3/tmac/fallbacks.tmac 2 | ||
+ | troff /usr/share/groff/1.22.3/tmac/hyphen.us 2 | ||
+ | troff /usr/share/groff/1.22.3/tmac/hyphenex.us 2 | ||
+ | troff /usr/share/groff/1.22.3/tmac/papersize.tmac 2 | ||
+ | troff /usr/share/groff/1.22.3/tmac/pspic.tmac 2 | ||
+ | troff /usr/share/groff/1.22.3/tmac/troffrc 2 | ||
+ | troff /usr/share/groff/1.22.3/tmac/troffrc-end 2 | ||
+ | troff /usr/share/groff/1.22.3/tmac/tty.tmac 2 | ||
+ | troff /usr/share/groff/site-tmac/man.local 2 | ||
+ | tbl <unknown> 7 | ||
+ | eqn <unknown> 8 | ||
+ | troff <unknown> 8 | ||
+ | bash /dev/pts/2 9 | ||
+ | sshd <unknown> 11 | ||
+ | sshd /devices/pseudo/clone@0:ptm 20 | ||
+ | man <unknown> 32 | ||
+ | grotty <unknown> 33 | ||
+ | root@vbox01:~# | ||
</pre> | </pre> |
Revision as of 13:30, 4 February 2020
Some short cmds or one-liners around dtrace
ARC accesses by applicaiton
# dtrace -n 'sdt:zfs::arc-hit,sdt:zfs::arc-miss { @[execname] = count() }'
found @[1]
what is really going on One nice example - everyone knows "man man" but what is really happening when this command is issued? Dtrace filtered on user id while typing man man on another terminal.
root@vbox01:~# dtrace -n 'proc:::exec-success /uid == 100/ { trace(curpsinfo->pr_psargs); }' dtrace: description 'proc:::exec-success ' matched 1 probe CPU ID FUNCTION:NAME 0 716 exec_common:exec-success /usr/gnu/bin/tbl 0 716 exec_common:exec-success /usr/bin/less -ins /tmp/mpTijdFb 1 716 exec_common:exec-success man man 1 716 exec_common:exec-success /usr/bin/troff -E -T ascii -mandoc 1 716 exec_common:exec-success /usr/bin/mv -f /tmp/mpTijdFb /usr/share/man/cat1/man.1 2 716 exec_common:exec-success /usr/bin/eqn -T ascii 3 716 exec_common:exec-success /usr/bin/preconv -D latin-1 /usr/share/man/man1/man.1 3 716 exec_common:exec-success /usr/bin/grotty -c ^C
And which files where accessed by "man man"?
root@vbox01:~# dtrace -n 'syscall::read:entry /uid == 100/ {@reads[execname, fds[arg0].fi_pathname] = count(); }' dtrace: description 'syscall::read:entry ' matched 1 probe ^C less /devices/pseudo/sy@0:tty 1 man /usr/share/man/man.cf 1 man /usr/share/man/man1/man.1 1 troff /usr/share/lib/zoneinfo/Europe/Vienna 1 eqn /usr/share/groff/1.22.3/tmac/eqnrc 2 grotty /usr/share/groff/1.22.3/font/devascii/B 2 grotty /usr/share/groff/1.22.3/font/devascii/DESC 2 grotty /usr/share/groff/1.22.3/font/devascii/I 2 grotty /usr/share/groff/1.22.3/font/devascii/R 2 less /export/home/pressy/.lesshst 2 less /tmp/mpNgF_9d 2 less /usr/gnu/share/terminfo/x/xterm-256color 2 preconv /usr/share/man/man1/man.1 2 troff /usr/share/groff/1.22.3/font/devascii/B 2 troff /usr/share/groff/1.22.3/font/devascii/BI 2 troff /usr/share/groff/1.22.3/font/devascii/DESC 2 troff /usr/share/groff/1.22.3/font/devascii/I 2 troff /usr/share/groff/1.22.3/font/devascii/R 2 troff /usr/share/groff/1.22.3/tmac/an-ext.tmac 2 troff /usr/share/groff/1.22.3/tmac/an-old.tmac 2 troff /usr/share/groff/1.22.3/tmac/andoc.tmac 2 troff /usr/share/groff/1.22.3/tmac/composite.tmac 2 troff /usr/share/groff/1.22.3/tmac/devtag.tmac 2 troff /usr/share/groff/1.22.3/tmac/fallbacks.tmac 2 troff /usr/share/groff/1.22.3/tmac/hyphen.us 2 troff /usr/share/groff/1.22.3/tmac/hyphenex.us 2 troff /usr/share/groff/1.22.3/tmac/papersize.tmac 2 troff /usr/share/groff/1.22.3/tmac/pspic.tmac 2 troff /usr/share/groff/1.22.3/tmac/troffrc 2 troff /usr/share/groff/1.22.3/tmac/troffrc-end 2 troff /usr/share/groff/1.22.3/tmac/tty.tmac 2 troff /usr/share/groff/site-tmac/man.local 2 tbl <unknown> 7 eqn <unknown> 8 troff <unknown> 8 bash /dev/pts/2 9 sshd <unknown> 11 sshd /devices/pseudo/clone@0:ptm 20 man <unknown> 32 grotty <unknown> 33 root@vbox01:~#