Skip to content

Follow fork for dtrace pid provider?

June 27, 2009

 

There is a ongoing request to have follow fork functionality for the dtrace pid provider but so far no one has stood upto the plate for that RFE. In the mean time my best workaround for this is this:

cjg@brompton:~/lang/d$ cat followfork.d 
proc:::start 
/ppid == $target/ 
{
 stop();
 printf("fork %d\n", pid);
 system("dtrace -qs child.d -p %d", pid); 
} 
cjg@brompton:~/lang/d$ cat child.d 
pid$target::malloc:entry 
{ 	
printf("%d %s:%s %d\n", pid, probefunc, probename, ustackdepth) 
} 
cjg@brompton:~/lang/d$ pfexec /usr/sbin/dtrace -qws followfork.d -s child.d -p 26758 
26758 malloc:entry 22 
26758 malloc:entry 15 
26758 malloc:entry 18 
26758 malloc:entry 18 
26758 malloc:entry 18 
fork 27548 
27548 malloc:entry 7
27548 malloc:entry 7 
27548 malloc:entry 18 
27548 malloc:entry 16 
27548 malloc:entry 18

Clearly you can have the child script do what ever you wish.

Better solutions are welcome!

 

Advertisements

From → Solaris

2 Comments
  1. [Trackback] I’ve been working with a customer to try and find a memory “leak”
    in their application. Many things have been tried, libumem, and the
    mdb ::findleaks command all with no success.
    So I was, as I am sure others before me have, pondering …

  2. this is handy but when the proc:::start probe fires no user-level instructions have executed. this means that it is not possible to trace dynamically loaded libraries in this way.
    doing so is straightforward using the technique above. instead of stop()ing on proc:::start I trussed the child application and picked a system call that ran immediately after the relevant library was loaded and launched child.d at that point.

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s

%d bloggers like this: