[dtrace-discuss] Re: How to monitor any access to a specific file using drace

[David Chen]

fds[] array is not supported yet in my system.

Firstly I wonder if I can use the syscall::open:entry to monitor "any access" to the specific file(or most regular operations), I tried following script:

#!/usr/sbin/dtrace -qs
syscall::open:entry
{printf("execname=%s,filename=%s\n",execname,copyinstr(arg0));}

from the lots of outputs, I can see some operations such as "cat", "more", "cp", "vi", "rm", "touch" ... to the specific file are catched, but how can I filter out the un-needed outputs? From the outputs, it seems it can't be done from comparing the filename with the "specific filename".

for example for "cat" command, I get:
execname=cat,filename=/var/ld/ld.config
execname=cat,filename=/lib/libc.so.1
execname=cat,filename=/platform/SUNW,Ultra-80/lib/libc_psr.so.1

for "vi" command, I get:
execname=vi,filename=test
but there should be relative path/obsolute path issue.

Pls help figure out what enhancements need in the script to implement monitoring "any access" to the specific file.
 
 
This message posted from opensolaris.org