This discussion is archived
2 Replies Latest reply: Mar 13, 2012 3:56 AM by SteveS RSS

a script to monitor a file in S11 ?

807736 Newbie
Currently Being Moderated
hello all,
i need to find which process access a particular lib in Solaris 11. Unfortunately, iosnoop in DTraceToolkit-0.99 doesn't work anymore. Nor the script found in /usr/demo/dtrace:

root@antigone:~# dtrace /usr/demo/dtrace/iosnoop.d /tmp/toto
dtrace: no probes specified

Are there other sources of dtrace scripts for S11 ?

thanks i, advance for help,

gerard
  • 1. Re: a script to monitor a file in S11 ?
    807736 Newbie
    Currently Being Moderated
    ok, found the existence of /usr/dtrace/DTT, wich works, but i have a question:

    i found which process is using the uncorrect lib, by using opensnoop and grep:
    /usr/dtrace/DTT/Bin/opensnoop|grep mysql
    ...
    80 18488 opac-export.pl 5 /usr/mysql/5.0/lib/mysql/libmysqlclient.so.15

    Trying to use the following command (the process and the lib are in NGZ):
    /usr/dtrace/DTT/Bin/opensnoop -f libmysqlclient.so.15
    UID PID COMM FD PATH
    gives no results at all!

    What am i doing wrong?
  • 2. Re: a script to monitor a file in S11 ?
    SteveS Pro
    Currently Being Moderated
    Are there other sources of dtrace scripts for S11 ?
    I'm currently working on updating and refreshing the DTT. See Doc ID 1428139.1 - "DTraceToolkit - A Collection Of Useful DTrace Scripts". This project will get the current scripts working on S10 and S11 and introduce new useful scripts. It's a very time consuming project, which I'm doing on my own time, so will take me a while to get a new version pushed out.
    /usr/dtrace/DTT/Bin/opensnoop -f libmysqlclient.so.15
    UID PID COMM FD PATH
    gives no results at all!

    What am i doing wrong?
    Two probable causes

    1) opensnoop used the following probes:

    syscall::open:entry, syscall::open64:entry
    syscall::open:return, syscall::open64:return

    In Solaris 11, open() and open64() system calls (and many more) changed to *at, eg:

    ID PROVIDER MODULE FUNCTION NAME
    9912 syscall openat entry
    9914 syscall openat64 entry

    So the probes you have won't fire. Also note that the arguments to open() Vs openat() are different

    int open(const char path, int oflag, / mode_t mode */);
    int openat(int fildes, const char path, int oflag, / mode_t mode */);

    You'll need to modify the opensnoop to change the probes and args.

    2) Secondly you need to specify the full path including the filename, not just the filename itself. Try

    $ /usr/dtrace/DTT/Bin/opensnoop -f "/usr/mysql/5.0/lib/mysql/libmysqlclient.so.15"

    HTH
    Steve

Legend

  • Correct Answers - 10 points
  • Helpful Answers - 5 points