[dtrace-discuss] Re: Re: Re: Re: How to monitor any access to a specific file using drace

[Zhijun Fu]

It works fine to me.
What version of Solaris you are using?

Best,
Zhijun

David Chen wrote:
> Hi ZhiJun,
> I've tried the user structure, for a "crypt" command I entered, the output was "ksh -o vi", I think maybe it's forked by "crypt" that actually touches the file. Anyway, an access was detected although the "real command" is not known, it's acceptable :P.
> I meet another issue, I try to monitor several files (for example, /tmp/core*): 
>
> fop_open:entry
> / strstr((*args[0])->v_path, "/tmp/core") != NULL /
> {
>         printf("\n%Y\n",walltimestamp);
>         printf("userid=%d,operation=%s,file=%s\n",uid,curthread->t_procp->p_user
> .u_psargs,stringof((*args[0])->v_path));
> }
>
> but during script compilation, it says "strstr" is undefined. 
> Any other way can do it?
>
> thanks and regards
> David
>  
>  
> This message posted from opensolaris.org
> _______________________________________________
> dtrace-discuss mailing list
> dtrace-discuss at opensolaris.org
>