opensnoop(1m) [osx man page]
opensnoop(1m) USER COMMANDS opensnoop(1m) NAME
opensnoop - snoop file opens as they occur. Uses DTrace. SYNOPSIS
opensnoop [-a|-A|-ceghsvxZ] [-f pathname] [-n name] [-p PID] DESCRIPTION
opensnoop tracks file opens. As a process issues a file open, details such as UID, PID and pathname are printed out. The returned file descriptor is printed, a value of -1 indicates an error. This can be useful for troubleshooting to determine if applia- cions are attempting to open files that do not exist. Since this uses DTrace, only users with root privileges can run this command. OPTIONS
-a print all data -A dump all data, space delimited -c print current working directory of process -e print errno value -g print full command arguments -s print start time, us -v print start time, string -x only print failed opens -Z print zonename -f pathname file pathname to snoop -n name process name to snoop -p PID process ID to snoop EXAMPLES
Default output, print file opens by process as they occur, # opensnoop Print human readable timestamps, # opensnoop -v See error codes, # opensnoop -e Snoop this file only, # opensnoop -f /etc/passwd FIELDS
ZONE Zone name UID User ID PID Process ID PPID Parent Process ID FD File Descriptor (-1 is error) ERR errno value (see /usr/include/sys/errno.h) CWD current working directory of process PATH pathname for file open COMM command name for the process ARGS argument listing for the process TIME timestamp for the open event, us STRTIME timestamp for the open event, string DOCUMENTATION
See the DTraceToolkit for further documentation under the Docs directory. The DTraceToolkit docs may include full worked examples with ver- bose descriptions explaining the output. EXIT
opensnoop will run forever until Ctrl-C is hit. BUGS
occasionally the pathname for the file open cannot be read and the following error will be seen, dtrace: error on enabled probe ID 6 (...): invalid address this is normal behaviour. AUTHOR
Brendan Gregg [Sydney, Australia] SEE ALSO
dtrace(1M), truss(1) version 1.60 Jan 12, 2006 opensnoop(1m)
Check Out this Related Man Page
iotop(1m) USER COMMANDS iotop(1m) NAME
iotop - display top disk I/O events by process. Uses DTrace. SYNOPSIS
iotop [-C] [-D|-o|-P] [-j|-Z] [-d device] [-f filename] [-m mount_point] [-t top] [interval [count]] DESCRIPTION
iotop tracks disk I/O by process, and prints a summary report that is refreshed every interval. This is measuring disk events that have made it past system caches. Since this uses DTrace, only users with root privileges can run this command. OPTIONS
-C don't clear the screen -D print delta times - elapsed, us -j print project ID -o print disk delta times, us -P print %I/O (disk delta times) -Z print zone ID -d device instance name to snoop (eg, dad0) -f filename full pathname of file to snoop -m mount_point mountpoint for filesystem to snoop -t top print top number only EXAMPLES
Default output, print summary every 5 seconds # iotop One second samples, # iotop 1 print %I/O (time based), # iotop -P Snoop events on the root filesystem only, # iotop -m / Print top 20 lines only, # iotop -t 20 Print 12 x 5 second samples, scrolling, # iotop -C 5 12 FIELDS
UID user ID PID process ID PPID parent process ID PROJ project ID ZONE zone ID CMD command name for the process DEVICE device name MAJ device major number MIN device minor number D direction, Read or Write BYTES total size of operations, bytes ELAPSED total elapsed times from request to completion, us (this is the elapsed time from the disk request (strategy) to the disk completion (iodone)) DISKTIME total times for disk to complete request, us (this is the time for the disk to complete that event since it's last event (time between iodones), or, the time to the strategy if the disk had been idle) %I/O percent disk I/O, based on time (DISKTIME) load 1 minute load average disk_r total disk read Kb for sample disk_w total disk write Kb for sample DOCUMENTATION
See the DTraceToolkit for further documentation under the Docs directory. The DTraceToolkit docs may include full worked examples with ver- bose descriptions explaining the output. EXIT
iotop will run forever until Ctrl-C is hit, or the specified interval is reached. AUTHOR
Brendan Gregg [Sydney, Australia] SEE ALSO
iosnoop(1M), dtrace(1M) version 0.75 Oct 25, 2005 iotop(1m)