[dtrace-discuss] Re: Re: Re: How to monitor any access to a specific file using drace

[Zhijun Fu]

>
>> I'm totally a newbie on dtrace and I only know using "execname" to 
>> get command info, it works fine for commands such as "cp", "cat", 
>> "more","touch","vi" etc, but for some other command ("crypt" as I 
>> tried ), the output command info is "ksh", is there any way to get 
>> the correct command info?
>>   
> I don't have much point on this issue.
> To get the correct command info,I guess,as you can access thread 
> structure via some builtin variables in D-script, perhaps you can get 
> the command name from these structures.But currently I cannot remember 
> where the command name is stored...
>
After looking up in the code,I found that the disired information can be 
found via user structure.You can try adding the below two lines into the 
simple D-script and watch the output.This may help to explain why output 
command info is "ksh" in your case.

/printf("%s\n", curthread->t_procp->p_user.u_comm);
printf("%s\n", curthread->t_procp->p_user.u_psargs);
/
Best,
Zhijun
/
/

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://mail.opensolaris.org/pipermail/dtrace-discuss/attachments/20070123/fed6fee7/attachment.html