Login or Register to Ask a Question and Join Our Community


Shell Programming and Scripting

DTRACE help required...

Login to Discuss or Reply to this Discussion in Our Community

 
Thread Tools Search this Thread
Top Forums Shell Programming and Scripting DTRACE help required...
# 1  
Old 05-24-2011
DTRACE help required...
if
Code:
dtrace -n 'syscall::open*:entry { printf("%i %s %s %s",uid,execname,cwd,copyinstr(arg0)); }'

will show me all files that are opened as follows...
Code:
  3    522                       open:entry 0 init / /etc/inittab
  3    522                       open:entry 0 init / /etc/svc/volatile/init-next.state
  3    522                       open:entry 0 init / /etc/svc/volatile/init-next.state
  3    522                       open:entry 0 init / /etc/inittab
  0    522                       open:entry 0 ls /nfspc/unixtrfr/MarketData /var/ld/ld.config
  0    522                       open:entry 0 ls /nfspc/unixtrfr/MarketData /lib/libc.so.1
  0    522                       open:entry 0 cat /nfspc/unixtrfr/MarketData /var/ld/ld.config
  0    522                       open:entry 0 cat /nfspc/unixtrfr/MarketData /lib/libc.so.1
  0    906                     open64:entry 0 cat /nfspc/unixtrfr/MarketData trs_div.txt

How can I specify only files where cwd contains the word MarketData ?
Last edited by pludi; 05-24-2011 at 11:24 AM..
# 2  
Old 05-24-2011
Try:
Code:
dtrace -n 'syscall::open*:entry /cwd=="/nfspc/unixtrfr/MarketData"/{ printf("%i %s %s %s",uid,execname,cwd,copyinstr(arg0)); }'

# 3  
Old 05-24-2011
Perfect - I had been missing the quotes!

---------- Post updated at 02:43 PM ---------- Previous update was at 02:33 PM ----------

Actually, not quite so perfect. Need it to match subdirectories as well, not just that exact path. Adding /* to the end of MarketData doesn't do it though. Any ideas?
# 4  
Old 05-24-2011
Try:
Code:
dtrace -n 'syscall::open*:entry { printf("%i %s %s %s",uid,execname,cwd,copyinstr(arg0)); }' | grep "/nfspc/unixtrfr/MarketData"

# 5  
Old 05-25-2011
Piping through grep breaks the output as soon as I try this in a script.

Will have to look at ways of filtering within the DTrace script itself so that it only gives opens where MarketData is a part of the cwd variable
# 6  
Old 05-25-2011
Post example of a script using this code. As far as I know Dtrace doesn't support this kind of advanced string matching.
Login or Register to Ask a Question

Previous Thread | Next Thread
Login or Register to Ask a Question