Search code examples
dtrace

dtrace a user process which will run in future

There is a user process-1 which can 'exec' a second process-2. Can I dtrace this second process-2 when I don't know when it might be created. I can't use both '-p' and '-c' option with dtrace script without knowing the pid and don't want to exec the process manually.

Using the PID provider I get a namespace error (function not belonging to the process 1). I tried "::functio_name:entry /execname == "process-2"/ {}, but this doesn't compile for userspace programs.

Thanks for any pointers.

Solution

  • I think this post can help you. You need 2 DTrace scripts:

    (1) The first script is used to track when the process-2 is started. Once it begins to run, start another script to trace process-2: 

    # cat followfork.d
proc:::start
/ppid == $target/
{
    stop();
    printf("fork %d\\n", pid);
   system("dtrace -qs child.d -p %d", pid);
}

    (2) The second script traces focused functions: 

    # cat child.d
pid$target::function_name:entry
{
    ......
}

    You can also refer related discussions on DTrace mailing list:
    How to trace libc module of both parent andchild processes?
    When a process is stopped by stop() action, when and how does the process is restarted?

    BTW, you can also refer Sergey Klyaus's Dynamic Tracing with DTrace & SystemTap to check which probes should be used in process creation:
    enter image description here