Skip to content
Open
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
9 changes: 5 additions & 4 deletions Apps/httpdstat.d
Original file line number Diff line number Diff line change
Expand Up @@ -23,6 +23,8 @@
*
* IDEA: Ryan Matteson (who first wrote a solution to this).
*
* Copyright (c) 2015, Oracle and/or its affiliates. All rights reserved.
*
* COPYRIGHT: Copyright (c) 2005 Brendan Gregg.
*
* CDDL HEADER START
Expand Down Expand Up @@ -83,11 +85,11 @@ profile:::tick-1sec
syscall::accept:return
/execname == "httpd"/
{
self->buf = 1;
num++;
}

syscall::read:entry
/self->buf/
/execname == "httpd"/
{
self->buf = arg1;
}
Expand All @@ -98,13 +100,12 @@ syscall::read:entry
syscall::read:return
/self->buf && arg0/
{
this->str = (char *)copyin(self->buf, arg0);
this->str = (char *)copyin(self->buf, 5);
this->str[4] = '\0';
get += stringof(this->str) == "GET " ? 1 : 0;
post += stringof(this->str) == "POST" ? 1 : 0;
head += stringof(this->str) == "HEAD" ? 1 : 0;
trac += stringof(this->str) == "TRAC" ? 1 : 0;
num++;
self->buf = 0;
}

Expand Down
4 changes: 2 additions & 2 deletions Apps/shellsnoop
Original file line number Diff line number Diff line change
Expand Up @@ -140,7 +140,7 @@ dtrace -n '
/*
* Remember this PID is a shell child
*/
syscall::exec:entry, syscall::exece:entry
syscall::exece:entry
/execname == "sh" || execname == "ksh" || execname == "csh" ||
execname == "tcsh" || execname == "zsh" || execname == "bash"/
{
Expand All @@ -151,7 +151,7 @@ dtrace -n '
OPT_debug == 1 ? printf("PID %d CMD %s started. (%s)\n",
pid, execname, stringof(this->parent)) : 1;
}
syscall::exec:entry, syscall::exece:entry
syscall::exece:entry
/(OPT_pid == 1 && PID != ppid) || (OPT_uid == 1 && UID != uid)/
{
/* forget if filtered */
Expand Down
1 change: 1 addition & 0 deletions Bin/tcpio.d
1 change: 1 addition & 0 deletions Bin/tcptop.d
1 change: 1 addition & 0 deletions Bin/udpsnoop.d
1 change: 1 addition & 0 deletions Bin/udptop.d
2 changes: 1 addition & 1 deletion Cpu/intoncpu.d
Original file line number Diff line number Diff line change
Expand Up @@ -13,7 +13,7 @@
*
* BASED ON: /usr/demo/dtrace/intr.d
*
* SEE ALSO: DTrace Guide "sdt Provider" chapter (docs.sun.com)
* SEE ALSO: DTrace Guide "sdt Provider" chapter (docs.oracle.com)
* intrstat(1M)
*
* PORTIONS: Copyright (c) 2005, 2006 Brendan Gregg.
Expand Down
2 changes: 1 addition & 1 deletion Cpu/inttimes.d
Original file line number Diff line number Diff line change
Expand Up @@ -14,7 +14,7 @@
* BASED ON: /usr/demo/dtrace/intr.d
*
* SEE ALSO:
* DTrace Guide "sdt Provider" chapter (docs.sun.com)
* DTrace Guide "sdt Provider" chapter (docs.oracle.com)
* intrstat(1M)
*
* PORTIONS: Copyright (c) 2005 Brendan Gregg.
Expand Down
2 changes: 1 addition & 1 deletion Disk/diskhits
Original file line number Diff line number Diff line change
Expand Up @@ -20,7 +20,7 @@
#
# BASED ON: /usr/demo/dtrace/applicat.d
#
# SEE ALSO: DTrace Guide "io Provider" chapter (docs.sun.com)
# SEE ALSO: DTrace Guide "io Provider" chapter (docs.oracle.com)
# iosnoop (DTraceToolkit)
#
# PORTIONS: Copyright (c) 2005, 2006 Brendan Gregg.
Expand Down
8 changes: 3 additions & 5 deletions Docs/Contents
Original file line number Diff line number Diff line change
Expand Up @@ -91,15 +91,13 @@ DTraceToolkit/
Net/
connections print inbound TCP connections by process
icmpstat.d print ICMP statistics
tcpsnoop snoop TCP network packets by process, Solaris 10 3/05
tcpsnoop_snv snoop TCP network packets by process, Solaris Nevada
tcpsnoop.d snoop TCP network packets by process, Solaris 10 3/05
tcpsnoop_snv.d snoop TCP network packets by process, Solaris Nevada
tcpstat.d print TCP statistics
tcptop display top TCP network packets by PID, Solaris 10 3/05
tcptop_snv display top TCP network packets by PID, Solaris Nevada
tcptop.d display top TCP network packets by PID
tcpwdist.d simple TCP write distribution by process
udpstat.d print UDP statistics
udpsnoop.d snoop UDP network packets by process
udptop.d display top UDP network packets by process
Perl/
pl_*.d 12 scripts for tracing Perl
Php/
Expand Down
11 changes: 4 additions & 7 deletions Docs/Links
Original file line number Diff line number Diff line change
Expand Up @@ -10,19 +10,16 @@ Links - DTrace links
DTraceToolkit
DTrace Tools

http://www.sun.com/bigadmin/content/dtrace
DTrace site on BigAdmin

http://docs.sun.com/db/doc/817-6223
http://docs.oracle.com/cd/E23824_01/html/E22973
DTrace Guide (answerbook)

http://blogs.sun.com/roller/page/bmc
http://blogs.oracle.com/bmc
Bryan Cantrill's Blog (DTrace Team)

http://blogs.sun.com/roller/page/ahl
http://blogs.oracle.com/ahl
Adam Leventhal's Blog (DTrace Team)

http://blogs.sun.com/mws
http://blogs.oracle.com/mws
Mike Shapiro's Blog (DTrace Team)

http://www.solarisinternals.com/si/dtrace/index.php
Expand Down
10 changes: 5 additions & 5 deletions Docs/Who
Original file line number Diff line number Diff line change
Expand Up @@ -8,7 +8,7 @@ In alphabetical first-name order,

Adam Leventhal
Location: CA, USA
Blog: http://blogs.sun.com/ahl
Blog: http://blogs.oracle.com/ahl
wrote DTrace itself

Ben Rockwood
Expand All @@ -26,7 +26,7 @@ Brendan Gregg

Bryan Cantrill
Location: CA, USA
Blog: http://blogs.sun.com/bmc
Blog: http://blogs.oracle.com/bmc
wrote DTrace itself

David Rubio
Expand All @@ -38,12 +38,12 @@ James Dickens
tool ideas and testing

Jonathan Adams
Blog: http://blogs.sun.com/jwadams
Blog: http://blogs.oracle.com/jwadams
wrote stacksize.d

Mike Shapiro
Location: CA, USA
Blog: http://blogs.sun.com/mws
Blog: http://blogs.oracle.com/mws
wrote DTrace itself

Nathan Kroenert
Expand All @@ -53,7 +53,7 @@ Nathan Kroenert
Richard McDougall
Location: CA, USA
Website: http://www.solarisinternals.com
Blog: http://blogs.sun.com/rmc
Blog: http://blogs.oracle.com/rmc
wrote pfilestat, vopstat

Ryan Matteson
Expand Down
9 changes: 3 additions & 6 deletions Docs/oneliners.txt
Original file line number Diff line number Diff line change
Expand Up @@ -7,12 +7,9 @@ DTrace One Liners,
# New processes with arguments,
dtrace -n 'proc:::exec-success { trace(curpsinfo->pr_psargs); }'

# Files opened by process name,
dtrace -n 'syscall::open*:entry { printf("%s %s",execname,copyinstr(arg0)); }'
# Files opened/created by process name,
dtrace -n 'syscall::openat*:entry { printf("%s %s",execname,copyinstr(arg1)); }'

# Files created using creat() by process name,
dtrace -n 'syscall::creat*:entry { printf("%s %s",execname,copyinstr(arg0)); }'

# Syscall count by process name,
dtrace -n 'syscall:::entry { @num[execname] = count(); }'

Expand Down Expand Up @@ -72,7 +69,7 @@ dtrace -wn 'syscall::exece:return /execname == "top"/ { raise(9); }'
DTrace Longer One Liners,

# New processes with arguments and time,
dtrace -qn 'syscall::exec*:return { printf("%Y %s\n",walltimestamp,curpsinfo->pr_psargs); }'
dtrace -qn 'syscall::exece:return { printf("%Y %s\n",walltimestamp,curpsinfo->pr_psargs); }'

# Successful signal details,
dtrace -n 'proc:::signal-send /pid/ { printf("%s -%d %d",execname,args[2],args[1]->pr_pid); }'
Expand Down
29 changes: 16 additions & 13 deletions Examples/connections_example.txt
Original file line number Diff line number Diff line change
@@ -1,22 +1,25 @@
The following is an example of connections. As inbound TCP connections are
established their details are printed out. This includes the UID, PID and
CMD of the server process that is listening on that port,
established their details are printed out. This includes the PID of the
server process that is listening on that port,

# connections
UID PID CMD TYPE PORT IP_SOURCE
0 242 inetd tcp 79 192.168.1.1
0 359 sshd tcp 22 192.168.1.1
100 1532 Xorg tcp 6000 192.168.1.1
^C
# ./connections
ZONE_ID PID IP_SOURCE PORT
0 100504 10.132.145.148 22
^C

Here's an example with timestamp (string) and zone printout

# ./connections -vZ
TIMESTR ZONE ZONE_ID PID IP_SOURCE PORT
2014 Jul 1 15:01:16 global 0 100504 10.132.145.148 22
^C

In another window snoop was running for comparison,

# snoop 'tcp[13:1] = 0x02'
Using device /dev/rtls0 (promiscuous mode)
mars -> jupiter FINGER C port=56760
mars -> jupiter TCP D=22 S=56761 Syn Seq=3264782212 Len=0 ...
mars -> jupiter XWIN C port=56763
# snoop 'tcp[13:1] = 0x02'
Using device net0 (promiscuous mode)
mars -> jupiter TCP D=22 S=50263 Syn Seq=372663324 Len=0 Win=8192 Options=<mss 1460,nop,wscale 2,nop,nop,sackOK>
^C

snoop can already tell me that these connections are happening - but does not
print out details of the server that accepted the connection.
Expand Down
5 changes: 5 additions & 0 deletions Examples/dtruss_example.txt
Original file line number Diff line number Diff line change
Expand Up @@ -47,6 +47,11 @@ In the following example, syscall elapsed and overhead times are measured.
Elapsed times represent the time from syscall start to finish; overhead
times measure the time spent on the CPU,

Note: In the case that DTrace script size is exceeded, dtrace_dof_maxsize
can be tuned in /etc/system or "mdb -kw". In "mdb -kw", running
"dtrace_dof_maxsize/Z 0t524288" will double the default size. Run
"dtrace_dof_maxsize/E" to see current dtrace script size limit.

# dtruss -eon bash
PID/LWP ELAPSD CPU SYSCALL(args) = return
3911/1: 41 26 write(0x2, "l\0", 0x1) = 1 0
Expand Down
36 changes: 18 additions & 18 deletions Examples/filebyproc_example.txt
Original file line number Diff line number Diff line change
@@ -1,25 +1,25 @@
The following is an example of the filebyproc.d script,

# filebyproc.d
dtrace: description 'syscall::open*:entry ' matched 2 probes
dtrace: description 'syscall::openat*:entry ' matched 2 probes
CPU ID FUNCTION:NAME
0 14 open:entry gnome-netstatus- /dev/kstat
0 14 open:entry man /var/ld/ld.config
0 14 open:entry man /lib/libc.so.1
0 14 open:entry man /usr/share/man/man.cf
0 14 open:entry man /usr/share/man/windex
0 14 open:entry man /usr/share/man/man1/ls.1
0 14 open:entry man /usr/share/man/man1/ls.1
0 14 open:entry man /tmp/mpqea4RF
0 14 open:entry sh /var/ld/ld.config
0 14 open:entry sh /lib/libc.so.1
0 14 open:entry neqn /var/ld/ld.config
0 14 open:entry neqn /lib/libc.so.1
0 14 open:entry neqn /usr/share/lib/pub/eqnchar
0 14 open:entry tbl /var/ld/ld.config
0 14 open:entry tbl /lib/libc.so.1
0 14 open:entry tbl /usr/share/man/man1/ls.1
0 14 open:entry nroff /var/ld/ld.config
0 14 openat:entry gnome-netstatus- /dev/kstat
0 14 openat:entry man /var/ld/ld.config
0 14 openat:entry man /lib/libc.so.1
0 14 openat:entry man /usr/share/man/man.cf
0 14 openat:entry man /usr/share/man/windex
0 14 openat:entry man /usr/share/man/man1/ls.1
0 14 openat:entry man /usr/share/man/man1/ls.1
0 14 openat:entry man /tmp/mpqea4RF
0 14 openat:entry sh /var/ld/ld.config
0 14 openat:entry sh /lib/libc.so.1
0 14 openat:entry neqn /var/ld/ld.config
0 14 openat:entry neqn /lib/libc.so.1
0 14 openat:entry neqn /usr/share/lib/pub/eqnchar
0 14 openat:entry tbl /var/ld/ld.config
0 14 openat:entry tbl /lib/libc.so.1
0 14 openat:entry tbl /usr/share/man/man1/ls.1
0 14 openat:entry nroff /var/ld/ld.config
[...]

In the above example, the command "man ls" was run. Each file that was
Expand Down
15 changes: 15 additions & 0 deletions Examples/j_calldist_example.txt
Original file line number Diff line number Diff line change
@@ -1,3 +1,18 @@
There are two ways to DTrace Java process via hotspot provider:
1. Run Java process with '-XX:+ExtendedDTraceProbes' option, and
also enable hotspot probes lazy loading by Java PID (# dtrace -n
'hotspot<PID>:::'), one can see all but this j_who.d script
working. There still seem to be less probes enabled than making
the modification as in the lower method.
2. Modify all DTrace Java scripts to change provider 'hotspot*'
to 'hotspot$target' or 'hotspot_jni$target' depending on the
specific probes. Run the Java process with DTrace (i.e. # dtrace
-Zs ./j_who_tmp.d -c 'java -XX:+ExtendedDTraceProbes Func_abc')
Here, 'hotspot*' is changed to 'hotspot_jni$target' in j_who_tmp.d
script. 'Func_abc' is a simple Java process.



This is an example of j_calldist.d showing the elapsed times for different
types of Java operations.

Expand Down
16 changes: 16 additions & 0 deletions Examples/j_calls_example.txt
Original file line number Diff line number Diff line change
@@ -1,3 +1,19 @@
There are two ways to DTrace Java process via hotspot provider:
1. Run Java process with '-XX:+ExtendedDTraceProbes' option, and
also enable hotspot probes lazy loading by Java PID (# dtrace -n
'hotspot<PID>:::'), one can see all but this j_who.d script
working. There still seem to be less probes enabled than making
the modification as in the lower method.
2. Modify all DTrace Java scripts to change provider 'hotspot*'
to 'hotspot$target' or 'hotspot_jni$target' depending on the
specific probes. Run the Java process with DTrace (i.e. # dtrace
-Zs ./j_who_tmp.d -c 'java -XX:+ExtendedDTraceProbes Func_abc')
Here, 'hotspot*' is changed to 'hotspot_jni$target' in j_who_tmp.d
script. 'Func_abc' is a simple Java process.




The following are examples of running the j_calls.d script.

This traces activity from all Java processes on the system with hotspot
Expand Down
40 changes: 20 additions & 20 deletions Examples/oneliners_examples.txt
Original file line number Diff line number Diff line change
Expand Up @@ -21,26 +21,26 @@ CPU ID FUNCTION:NAME

### Files opened by process,

# dtrace -n 'syscall::open*:entry { printf("%s %s",execname,copyinstr(arg0)); }'
dtrace: description 'syscall::open*:entry ' matched 2 probes
# dtrace -n 'syscall::openat*:entry { printf("%s %s",execname,copyinstr(arg1)); }'
dtrace: description 'syscall::openat*:entry ' matched 2 probes
CPU ID FUNCTION:NAME
0 14 open:entry gnome-netstatus- /dev/kstat
0 14 open:entry man /var/ld/ld.config
0 14 open:entry man /lib/libc.so.1
0 14 open:entry man /usr/share/man/man.cf
0 14 open:entry man /usr/share/man/windex
0 14 open:entry man /usr/share/man/man1/ls.1
0 14 open:entry man /usr/share/man/man1/ls.1
0 14 open:entry man /tmp/mpqea4RF
0 14 open:entry sh /var/ld/ld.config
0 14 open:entry sh /lib/libc.so.1
0 14 open:entry neqn /var/ld/ld.config
0 14 open:entry neqn /lib/libc.so.1
0 14 open:entry neqn /usr/share/lib/pub/eqnchar
0 14 open:entry tbl /var/ld/ld.config
0 14 open:entry tbl /lib/libc.so.1
0 14 open:entry tbl /usr/share/man/man1/ls.1
0 14 open:entry nroff /var/ld/ld.config
0 14 openat:entry gnome-netstatus- /dev/kstat
0 14 openat:entry man /var/ld/ld.config
0 14 openat:entry man /lib/libc.so.1
0 14 openat:entry man /usr/share/man/man.cf
0 14 openat:entry man /usr/share/man/windex
0 14 openat:entry man /usr/share/man/man1/ls.1
0 14 openat:entry man /usr/share/man/man1/ls.1
0 14 openat:entry man /tmp/mpqea4RF
0 14 openat:entry sh /var/ld/ld.config
0 14 openat:entry sh /lib/libc.so.1
0 14 openat:entry neqn /var/ld/ld.config
0 14 openat:entry neqn /lib/libc.so.1
0 14 openat:entry neqn /usr/share/lib/pub/eqnchar
0 14 openat:entry tbl /var/ld/ld.config
0 14 openat:entry tbl /lib/libc.so.1
0 14 openat:entry tbl /usr/share/man/man1/ls.1
0 14 openat:entry nroff /var/ld/ld.config
[...]


Expand Down Expand Up @@ -253,7 +253,7 @@ dtrace: description 'sdt:::interrupt-start ' matched 1 probe

### New processes with arguments and time,

# dtrace -qn 'syscall::exec*:return { printf("%Y %s\n",walltimestamp,curpsinfo->pr_psargs); }'
# dtrace -qn 'syscall::exece:return { printf("%Y %s\n",walltimestamp,curpsinfo->pr_psargs); }'
2005 Apr 25 19:15:09 man ls
2005 Apr 25 19:15:09 sh -c cd /usr/share/man; tbl /usr/share/man/man1/ls.1 |...
2005 Apr 25 19:15:09 neqn /usr/share/lib/pub/eqnchar -
Expand Down
Loading