[dtrace-discuss] Re: Re: Re: How to monitor any access to a specific file using drace

[Zhijun Fu]

David Chen wrote:
> Hi ZhiJun,
> Wow! Great, it's almost what I want. Thanks a lot.
>   
Glad to be able to help.
> I tried the script and found a little problem, when I did "mv file file.bak", i.e. rename the file under same directory, it can't be detected, I believe it dues to the internal implementation of "mv", but I don't know which VFS function I should use to detect it. 
It is fop_rename() in this case
/fop_rename:entry
/ args[0]->v_path == "/export/home/tmp" && args[1] == "file" /
{
    printf("%s", stringof(args[0]->v_path));
    printf("/%s", stringof(args[1]));
}/

> BTW, I can't find VFS functions in solaris dtrace guide, where can I look for the reference of VFS?
>   
<<it would help to have a good understanding of the VFS layer;
<<Chapter 14 of Solaris Internals 2nd edition is a great reference.

As Brendan has pointed out,"Solaris Internals 2nd" is a good reference
Also you can reference the source code via opensolaris.org
> Additionally, I want to add some other info into the output, for example, the user id, command name, date and time, could you pls help for a example? 
Please refer to "Solaris Dynamic Tracing Guide" Chapter 3, buidtin 
variables id,execname,timestamp/vtimestamp would likely to be your choice
> I'm totally a newbie on dtrace and I only know using "execname" to get command info, it works fine for commands such as "cp", "cat", "more","touch","vi" etc, but for some other command ("crypt" as I tried ), the output command info is "ksh", is there any way to get the correct command info?
>   
I don't have much point on this issue.
To get the correct command info,I guess,as you can access thread 
structure via some builtin variables in D-script, perhaps you can get 
the command name from these structures.But currently I cannot remember 
where the command name is stored...

Regards,
Zhijun
> Regards
> David
>  
>  
> This message posted from opensolaris.org
> _______________________________________________
> dtrace-discuss mailing list
> dtrace-discuss at opensolaris.org
>   

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://mail.opensolaris.org/pipermail/dtrace-discuss/attachments/20070123/aba20eab/attachment.html