2 Replies Latest reply: Mar 13, 2012 5:56 AM by SteveS RSS

    a script to monitor a file in S11 ?

    807736
      hello all,
      i need to find which process access a particular lib in Solaris 11. Unfortunately, iosnoop in DTraceToolkit-0.99 doesn't work anymore. Nor the script found in /usr/demo/dtrace:

      root@antigone:~# dtrace /usr/demo/dtrace/iosnoop.d /tmp/toto
      dtrace: no probes specified

      Are there other sources of dtrace scripts for S11 ?

      thanks i, advance for help,

      gerard
        • 1. Re: a script to monitor a file in S11 ?
          807736
          ok, found the existence of /usr/dtrace/DTT, wich works, but i have a question:

          i found which process is using the uncorrect lib, by using opensnoop and grep:
          /usr/dtrace/DTT/Bin/opensnoop|grep mysql
          ...
          80 18488 opac-export.pl 5 /usr/mysql/5.0/lib/mysql/libmysqlclient.so.15

          Trying to use the following command (the process and the lib are in NGZ):
          /usr/dtrace/DTT/Bin/opensnoop -f libmysqlclient.so.15
          UID PID COMM FD PATH
          gives no results at all!

          What am i doing wrong?
          • 2. Re: a script to monitor a file in S11 ?
            SteveS
            Are there other sources of dtrace scripts for S11 ?
            I'm currently working on updating and refreshing the DTT. See Doc ID 1428139.1 - "DTraceToolkit - A Collection Of Useful DTrace Scripts". This project will get the current scripts working on S10 and S11 and introduce new useful scripts. It's a very time consuming project, which I'm doing on my own time, so will take me a while to get a new version pushed out.
            /usr/dtrace/DTT/Bin/opensnoop -f libmysqlclient.so.15
            UID PID COMM FD PATH
            gives no results at all!

            What am i doing wrong?
            Two probable causes

            1) opensnoop used the following probes:

            syscall::open:entry, syscall::open64:entry
            syscall::open:return, syscall::open64:return

            In Solaris 11, open() and open64() system calls (and many more) changed to *at, eg:

            ID PROVIDER MODULE FUNCTION NAME
            9912 syscall openat entry
            9914 syscall openat64 entry

            So the probes you have won't fire. Also note that the arguments to open() Vs openat() are different

            int open(const char path, int oflag, / mode_t mode */);
            int openat(int fildes, const char path, int oflag, / mode_t mode */);

            You'll need to modify the opensnoop to change the probes and args.

            2) Secondly you need to specify the full path including the filename, not just the filename itself. Try

            $ /usr/dtrace/DTT/Bin/opensnoop -f "/usr/mysql/5.0/lib/mysql/libmysqlclient.so.15"

            HTH
            Steve