1N/A# Written using DTrace (Solaris 10 3/05). 1N/A# This is measuring reads and writes at the application level. This matches 1N/A# the syscalls read, write, pread and pwrite. 1N/A# $Id: rwsnoop 3 2007-08-01 10:50:08Z brendan $ 1N/A# USAGE: rwsnoop [-jPtvZ] [-n name] [-p pid] 1N/A# rwsnoop # default output 1N/A# -j # print project ID 1N/A# -P # print parent process ID 1N/A# -t # print timestamp, us 1N/A# -v # print time, string 1N/A# -n name # this process name only 1N/A# -p PID # this PID only 1N/A# rwsnoop -Z # print zone ID 1N/A# rwsnoop -n bash # monitor processes named "bash" 1N/A# rwsnoop usually prints plenty of output, which itself will cause 1N/A# more output. It can be better to redirect the output of rwsnoop 1N/A# to a file to prevent this. 1N/A# TIMESTR Time, string 1N/A# PPID Parent Process ID 1N/A# D Direction, Read or Write 1N/A# BYTES Total bytes during sample, -1 for error 1N/A# FILE Filename, if file based 1N/A# Reads and writes that are not file based, for example with sockets, will 1N/A# print "<unknown>" as the filename. 1N/A# COPYRIGHT: Copyright (c) 2005 Brendan Gregg. 1N/A# The contents of this file are subject to the terms of the 1N/A# Common Development and Distribution License, Version 1.0 only 1N/A# (the "License"). You may not use this file except in compliance 1N/A# See the License for the specific language governing permissions 1N/A# and limitations under the License. 1N/A# Track readv and writev. 1N/A# Author: Brendan Gregg [Sydney, Australia] 1N/A# 24-Jul-2005 Brendan Gregg Created this. 1N/A# 17-Sep-2005 " " Increased switchrate. 1N/A# 17-Sep-2005 " " Last update. 1N/A############################## 1N/A# --- Process Arguments --- 1N/A### default variables 1N/A USAGE: rwsnoop [-jPtvZ] [-n name] [-p pid] 1N/A -j # print project ID 1N/A -P # print parent process ID 1N/A -t # print timestamp, us 1N/A -v # print time, string 1N/A -n name # this process name only 1N/A -p PID # this PID only 1N/A rwsnoop # default output 1N/A rwsnoop -Z # print zone ID 1N/A rwsnoop -n bash # monitor processes named "bash" 1N/Ashift $(( $OPTIND - 1 )) 1N/Aif (( opt_name || opt_pid )); then 1N/A################################# 1N/A# --- Main Program, DTrace --- 1N/A/usr/sbin/dtrace -n ' 1N/A * Command line arguments 1N/A inline int OPT_proj = '$opt_proj'; 1N/A inline int OPT_zone = '$opt_zone'; 1N/A inline int OPT_bytes = '$opt_bytes'; 1N/A inline int OPT_name = '$opt_name'; 1N/A inline int OPT_ppid = '$opt_ppid'; 1N/A inline int OPT_pid = '$opt_pid'; 1N/A inline int OPT_time = '$opt_time'; 1N/A inline int OPT_timestr = '$opt_timestr'; 1N/A inline int FILTER = '$filter'; 1N/A inline int PID = '$pid'; 1N/A inline string NAME = "'$pname'"; 1N/A #pragma D option quiet 1N/A #pragma D option switchrate=10hz 1N/A OPT_time ? printf("%-14s ", "TIME") : 1; 1N/A OPT_timestr ? printf("%-20s ", "TIMESTR") : 1; 1N/A OPT_proj ? printf("%5s ", "PROJ") : 1; 1N/A OPT_zone ? printf("%5s ", "ZONE") : 1; 1N/A OPT_ppid ? printf("%6s ", "PPID") : 1; 1N/A printf("%5s %6s %-12s %1s %7s %s\n", 1N/A "UID", "PID", "CMD", "D", "BYTES", "FILE"); 1N/A * Check event is being traced 1N/A syscall::*read:entry, 1N/A syscall::*write:entry 1N/A /* default is to trace unless filtering, */ 1N/A self->ok = FILTER ? 0 : 1; 1N/A /* check each filter, */ 1N/A (OPT_name == 1 && NAME == execname)? self->ok = 1 : 1; 1N/A (OPT_pid == 1 && PID == pid) ? self->ok = 1 : 1; 1N/A /* save file descriptor */ 1N/A self->fd = self->ok ? arg0 : 0; 1N/A syscall::*read:return 1N/A * Save write details 1N/A syscall::*write:entry 1N/A syscall::*read:return, 1N/A syscall::*write:entry 1N/A this->filistp = curthread->t_procp->p_user.u_finfo.fi_list; 1N/A this->ufentryp = (uf_entry_t *)((uint64_t)this->filistp + 1N/A (uint64_t)self->fd * (uint64_t)sizeof(uf_entry_t)); 1N/A this->filep = this->ufentryp->uf_file; 1N/A this->vnodep = this->filep != 0 ? this->filep->f_vnode : 0; 1N/A self->vpath = this->vnodep ? (this->vnodep->v_path != 0 ? 1N/A cleanpath(this->vnodep->v_path) : "<unknown>") : "<unknown>"; 1N/A OPT_time ? printf("%-14d ", timestamp / 1000) : 1; 1N/A OPT_timestr ? printf("%-20Y ", walltimestamp) : 1; 1N/A OPT_proj ? printf("%5d ", curpsinfo->pr_projid) : 1; 1N/A OPT_zone ? printf("%5d ", curpsinfo->pr_zoneid) : 1; 1N/A OPT_ppid ? printf("%6d ", ppid) : 1; 1N/A printf("%5d %6d %-12.12s %1s %7d %s\n", 1N/A uid, pid, execname, self->rw, (int)self->size, self->vpath);