Search code examples
macosdtrace

Tracing system calls using dtrace

I am running an application that runs with a process Id 423. Basically want to debug this process.

The problem is that, using the command sudo dtruss -a -t open_nocancel -p 423 I dont see print messages executed and also systems signals like sudo kill -30 423 dont seem to show in the stack trace. Am I missing something?. How do I achieve this?.

Sample Stack trace below

    PID/THRD  RELATIVE  ELAPSD    CPU SYSCALL(args)          = return
  423/0xcf5:  109498638      14      9 open_nocancel("/Users/krishna/.rstudio-desktop/sdb/s-3F25A09C/373AE888\0", 0x0, 0x1B6)    = 21 0
  423/0xcf5:  109509540      20     16 open_nocancel("/Users/krishna/.rstudio-desktop/history_database\0", 0x209, 0x1B6)     = 20 0
  423/0xcf5:  109510342      56     44 open_nocancel(".\0", 0x0, 0x1)        = 20 0
  423/0xcf5:  109516113      19     15 open_nocancel("/Users/krishna/.rstudio-desktop/history_database\0", 0x209, 0x1B6)     = 20 0
  423/0xcf5:  109517099      35     30 open_nocancel(".\0", 0x0, 0x1)        = 20 0
  423/0xcf5:  109576820      16     11 open_nocancel("/Users/krishna/.rstudio-desktop/sdb/s-3F25A09C/373AE888\0", 0x0, 0x1B6)    = 21 0
  423/0xcf5:  109673038      16     10 open_nocancel("/Users/krishna/.rstudio-desktop/sdb/s-3F25A09C/373AE888\0", 0x0, 0x1B6)    = 21 0
Solution

  • The command sudo dtruss -a -t open_nocancel -p 423 will trace only the open_nocancel system call. Per the OS X man page for dtruss:

    NAME
       dtruss - process syscall details. Uses DTrace.

SYNOPSIS
       dtruss [-acdeflhoLs] [-t syscall] { -p PID | -n name | command }

...

       -t syscall
              examine this syscall only

    If you want to trace other system calls, you need to either change the -t ... argument, or remove it.