[dtrace-discuss] DTrace instead of `lsof`?

[Sean McGrath - Sun Microsystems Ireland]

 Ahh.  Sorry.  Wrong mind thinking there..

Ian Campbell stated:
< You will see files that firefox-bin opens *after* you run dtrace, not files
< that firefox-bin already has opened when you run dtrace.  At least, that is
< what I get on S10U1.
< 
< On 8/15/06, Sean McGrath - Sun Microsystems Ireland <sean.mcgrath at sun.com>
< wrote:
< >
< >Ian Campbell stated:
< >< With that syntax, you won't get info on existing processes.  Try the
< >same
< >< with bash, for instance, then exec a new instance of bash.  You'll get
< >some
< >< output.
< >
< >  Really ?  Why would you think that ?
< >
< >  Running dtrace after firefox has been started :
< >
< >bash-3.00# dtrace -n 'syscall::open*:entry /execname == $1/ {printf("%s",
< >copyinstr(arg0));}' firefox-bin
< >dtrace: description 'syscall::open*:entry ' matched 2 probes
< >CPU     ID                    FUNCTION:NAME
< >  1  44814                       open:entry
< >/usr/openwin/lib/X11/fonts/Type1/cour.pfa
< >  0  45200                     open64:entry /export/home/comix/cronly
< >  1  45200                     open64:entry
< >/home/sm97610/.mozilla/firefox/pluginreg.dat
< >  1  44814                       open:entry
< >/home/sm97610/.mozilla/firefox/c5clxi2a.default/extensions.ini
< >  0  45200                     open64:entry /usr/share/mime/aliases
< >  0  45200                     open64:entry /usr/share/mime/subclasses
< >  0  45200                     open64:entry /usr/share/gnome//mime/aliases
< >  0  45200                     open64:entry
< >/usr/share/gnome//mime/subclasses
< >  0  45200                     open64:entry /usr/sfw/share/mime/aliases
< >.
< >.
< >.
< >.
< >.
< >
< >
< >Regards,
< >
< ><
< >< On 8/15/06, Sean McGrath - Sun Microsystems Ireland <
< >sean.mcgrath at sun.com>
< >< wrote:
< >< >
< >< >UNIX admin stated:
< >< >< How would I replicate `lsof` functionality with DTrace?
< >< ><
< >< >< I tried for example
< >< ><
< >< >< dtrace -n 'syscall::open:entry /execname == $1/ {printf("%s",
< >< >copyinstr(arg0));}' named
< >< ><
< >< >
< >< >  You may need to match against open64 as well (32bit apps opening
< >files
< >< >on
< >< >  64bit OS)..
< >< >
< >< >Regards,
< >< >
< >< >< but that does not seem to work, at least not in the way I expect.
< >What I
< >< >expected to see was a list of open files that $1 has open, but instead
< >I
< >< >just got how many probes DTrace matched. And no further output.
< >< ><
< >< ><
< >< >< This message posted from opensolaris.org
< >< >< _______________________________________________
< >< >< dtrace-discuss mailing list
< >< >< dtrace-discuss at opensolaris.org
< >< >
< >< >--
< >< >Sean.
< >< >.
< >< >_______________________________________________
< >< >dtrace-discuss mailing list
< >< >dtrace-discuss at opensolaris.org
< >< >
< >
< >--
< >Sean.
< >.
< >

-- 
Sean.
.