[dtrace-discuss] dtrace

[Tao Chen]

On 7/30/07, Vivek Joshi <techvbj at gmail.com> wrote:
> Look at the stat(2) signature,
>  int stat(const char *restrict path, struct stat *restrict buf)
>
> which suggests that first argument is the path .... you can do something
> like this in a D script,
>
>
> #!/usr/sbin/dtrace -Cs
>
> #include <sys/stat.h>
>
> syscall::stat:entry
> {
>  printf("%s\n",stringof(copyinstr(arg0)));
> }
>
> I am new to DTrace. Someone of the list can correct me ...
>

I would make a few changes.
Here's what I use for tracking file-access events (not limited to 'stat'):

#!/usr/sbin/dtrace -s

#pragma D option quiet

syscall::open:entry,
syscall::open64:entry,
syscall::stat:entry,
syscall::stat64:entry,
syscall::lstat:entry,
syscall::lstat64:entry
{
        self->pathnameptr = arg0;
}

syscall::xstat:entry,
syscall::lxstat:entry
{
        self->pathnameptr = arg1;
}

syscall::open:return,
syscall::open64:return,
syscall::stat:return,
syscall::stat64:return,
syscall::lstat:return,
syscall::lstat64:return,
syscall::xstat:return,
syscall::lxstat:return
/self->pathnameptr/ {
        printf("%5d/%-5d  %20s  %7s  %2d  %s\n",
                uid, curpsinfo->pr_euid, execname, probefunc,
                errno, copyinstr(self->pathnameptr));
        self->pathnameptr = 0;
}