Training courses

Kernel and Embedded Linux

Bootlin training courses

Embedded Linux, kernel,
Yocto Project, Buildroot, real-time,
graphics, boot time, debugging...

Bootlin logo

Elixir Cross Referencer

Open Menu /external/cddl/dtracetoolkit/dist/Examples/opensnoop_example.txt 
  1
  2
  3
  4
  5
  6
  7
  8
  9
 10
 11
 12
 13
 14
 15
 16
 17
 18
 19
 20
 21
 22
 23
 24
 25
 26
 27
 28
 29
 30
 31
 32
 33
 34
 35
 36
 37
 38
 39
 40
 41
 42
 43
 44
 45
 46
 47
 48
 49
 50
 51
 52
 53
 54
 55
 56
 57
 58
 59
 60
 61
 62
 63
 64
 65
 66
 67
 68
 69
 70
 71
 72
 73
 74
 75
 76
 77
 78
 79
 80
 81
 82
 83
 84
 85
 86
 87
 88
 89
 90
 91
 92
 93
 94
 95
 96
 97
 98
 99
100
101
102
103
104
105
106
107
108
109
110
The following are examples of opensnoop. File open events are traced
along with some process details.


This first example is of the default output. The commands "cat", "cal",
"ls" and "uname" were run. The returned file descriptor (or -1 for error) are
shown, along with the filenames.

  # ./opensnoop
    UID   PID COMM          FD PATH
    100  3504 cat           -1 /var/ld/ld.config
    100  3504 cat            3 /usr/lib/libc.so.1
    100  3504 cat            3 /etc/passwd
    100  3505 cal           -1 /var/ld/ld.config
    100  3505 cal            3 /usr/lib/libc.so.1
    100  3505 cal            3 /usr/share/lib/zoneinfo/Australia/NSW
    100  3506 ls            -1 /var/ld/ld.config
    100  3506 ls             3 /usr/lib/libc.so.1
    100  3507 uname         -1 /var/ld/ld.config
    100  3507 uname          3 /usr/lib/libc.so.1
  [...]


Full command arguments can be fetched using -g,

  # ./opensnoop -g
    UID   PID PATH                                   FD ARGS
    100  3528 /var/ld/ld.config                      -1 cat /etc/passwd
    100  3528 /usr/lib/libc.so.1                      3 cat /etc/passwd
    100  3528 /etc/passwd                             3 cat /etc/passwd
    100  3529 /var/ld/ld.config                      -1 cal
    100  3529 /usr/lib/libc.so.1                      3 cal
    100  3529 /usr/share/lib/zoneinfo/Australia/NSW   3 cal
    100  3530 /var/ld/ld.config                      -1 ls -l
    100  3530 /usr/lib/libc.so.1                      3 ls -l
    100  3530 /var/run/name_service_door              3 ls -l
    100  3530 /usr/share/lib/zoneinfo/Australia/NSW   4 ls -l
    100  3531 /var/ld/ld.config                      -1 uname -a
    100  3531 /usr/lib/libc.so.1                      3 uname -a
  [...]



The verbose option prints human readable timestamps,

  # ./opensnoop -v
  STRTIME                UID   PID COMM          FD PATH
  2005 Jan 22 01:22:50     0 23212 df            -1 /var/ld/ld.config
  2005 Jan 22 01:22:50     0 23212 df             3 /lib/libcmd.so.1
  2005 Jan 22 01:22:50     0 23212 df             3 /lib/libc.so.1
  2005 Jan 22 01:22:50     0 23212 df             3 /platform/SUNW,Sun-Fire-V210/lib/libc_psr.so.1
  2005 Jan 22 01:22:50     0 23212 df             3 /etc/mnttab
  2005 Jan 22 01:22:50     0 23211 dtrace         4 /usr/share/lib/zoneinfo/Australia/NSW
  2005 Jan 22 01:22:51     0 23213 uname         -1 /var/ld/ld.config
  2005 Jan 22 01:22:51     0 23213 uname          3 /lib/libc.so.1
  2005 Jan 22 01:22:51     0 23213 uname          3 /platform/SUNW,Sun-Fire-V210/lib/libc_psr.so.1
  [...]



Particular files can be monitored using -f. For example,

  # ./opensnoop -vgf /etc/passwd
  STRTIME                UID   PID PATH                  FD ARGS
  2005 Jan 22 01:28:50     0 23242 /etc/passwd            3 cat /etc/passwd
  2005 Jan 22 01:28:54     0 23243 /etc/passwd            4 vi /etc/passwd
  2005 Jan 22 01:29:06     0 23244 /etc/passwd            3 passwd brendan
  [...]



This example is of opensnoop running on a quiet system. We can see as 
various daemons are opening files,

   # ./opensnoop
     UID   PID COMM          FD PATH
       0   253 nscd           5 /etc/user_attr
       0   253 nscd           5 /etc/hosts
       0   419 mibiisa        2 /dev/kstat
       0   419 mibiisa        2 /dev/rtls
       0   419 mibiisa        2 /dev/kstat
       0   419 mibiisa        2 /dev/kstat
       0   419 mibiisa        2 /dev/rtls
       0   419 mibiisa        2 /dev/kstat
       0   253 nscd           5 /etc/user_attr
       0   419 mibiisa        2 /dev/kstat
       0   419 mibiisa        2 /dev/rtls
       0   419 mibiisa        2 /dev/kstat
       0   174 in.routed      8 /dev/kstat
       0   174 in.routed      8 /dev/kstat
       0   174 in.routed      6 /dev/ip
       0   419 mibiisa        2 /dev/kstat
       0   419 mibiisa        2 /dev/rtls
       0   419 mibiisa        2 /dev/kstat
       0   293 utmpd          4 /var/adm/utmpx
       0   293 utmpd          5 /var/adm/utmpx
       0   293 utmpd          6 /proc/442/psinfo
       0   293 utmpd          6 /proc/567/psinfo
       0   293 utmpd          6 /proc/567/psinfo
       0   293 utmpd          6 /proc/567/psinfo
       0   293 utmpd          6 /proc/567/psinfo
       0   293 utmpd          6 /proc/567/psinfo
       0   293 utmpd          6 /proc/567/psinfo
       0   293 utmpd          6 /proc/567/psinfo
       0   293 utmpd          6 /proc/567/psinfo
       0   293 utmpd          6 /proc/3013/psinfo
       0   419 mibiisa        2 /dev/kstat
       0   419 mibiisa        2 /dev/rtls
       0   419 mibiisa        2 /dev/kstat
  [...]