|
|
trace(1) General Commands Manual trace(1) Name trace - trace system calls of programs Syntax trace [options] cmd args... Description The command with no flag arguments traces for the given cmd and args all system calls made and prints a time stamp, the PID, call and/or return values and arguments and puts its output in the file trace.dump. Options -f filename Puts dump in file filename. -z Echos arguments only. Only one of the following option arguments can be specified at one time. -c# Traces given PIDs and their children. Up to sixteen PIDs can be specified. -g# Traces given groups only. Up to sixteen Group IDs can be specified. -p# Traces given PIDs only. Up to sixteen PIDs can be specified. -s# Traces given system calls only. Up to sixteen PIDs can be specified. -u# Traces given UIDs only. Up to sixteen PIDs can be specified. Examples trace -f ls.dump ls -l /dev >ls.out runs the cmd ls -l /dev and puts the trace in ls.dump and output in ls.out. trace -f csh.trace -p $$ & will trace your login shell in the background. To stop the trace just send it a termination signal (that is, kill -TERM trace_pid). Restrictions Due to security, no one, not even the super-user can trace anyone else's programs. This sort of negates some of the usefulness of the -g and -u flags. The program cannot be traced. Only 16 numbers can be given to the -c, -p, -g, -u, and -s flags. The kernel configuration file must contain the following: options SYS_TRACE pseudo-device sys_trace In addition, the superuser must use the following command sequence to create the device: cd /dev MAKEDEV trace If both lines are not in the configuration file or if the device is not made, the message "Cannot open /dev/trace" appears. Files /dev/trace read only character special device for reading syscall data. trace.dump default file for the system call trace data. See Also open(2), close(2), ioctl(2), select(2), read(2), trace(5) trace(1)