From owner-freebsd-questions@FreeBSD.ORG Mon May 3 21:39:38 2010 Return-Path: Delivered-To: freebsd-questions@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [69.147.83.52]) by hub.freebsd.org (Postfix) with ESMTP id 60956106564A for ; Mon, 3 May 2010 21:39:38 +0000 (UTC) (envelope-from dan@dan.emsphone.com) Received: from email1.allantgroup.com (email1.emsphone.com [199.67.51.115]) by mx1.freebsd.org (Postfix) with ESMTP id 269C88FC18 for ; Mon, 3 May 2010 21:39:37 +0000 (UTC) Received: from dan.emsphone.com (dan.emsphone.com [199.67.51.101]) by email1.allantgroup.com (8.14.0/8.14.0) with ESMTP id o43Ldbdr015801 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO) for ; Mon, 3 May 2010 16:39:37 -0500 (CDT) (envelope-from dan@dan.emsphone.com) Received: from dan.emsphone.com (smmsp@localhost [127.0.0.1]) by dan.emsphone.com (8.14.4/8.14.3) with ESMTP id o43LdaMQ004168 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO) for ; Mon, 3 May 2010 16:39:36 -0500 (CDT) (envelope-from dan@dan.emsphone.com) Received: (from dan@localhost) by dan.emsphone.com (8.14.4/8.14.3/Submit) id o43Lda76004167; Mon, 3 May 2010 16:39:36 -0500 (CDT) (envelope-from dan) Date: Mon, 3 May 2010 16:39:36 -0500 From: Dan Nelson To: Dan McNulty Message-ID: <20100503213936.GL14572@dan.emsphone.com> References: MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: X-OS: FreeBSD 8.0-STABLE User-Agent: Mutt/1.5.20 (2009-06-14) X-Virus-Scanned: clamav-milter 0.96 at email1.allantgroup.com X-Virus-Status: Clean X-Greylist: Sender IP whitelisted, not delayed by milter-greylist-2.0.2 (email1.allantgroup.com [199.67.51.78]); Mon, 03 May 2010 16:39:37 -0500 (CDT) X-Scanned-By: MIMEDefang 2.45 Cc: freebsd-questions@freebsd.org Subject: Re: Finding out when a child process forks or calls exec X-BeenThere: freebsd-questions@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: User questions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 03 May 2010 21:39:38 -0000 In the last episode (May 03), Dan McNulty said: > I am trying to port a debugging tool that uses the ptrace interface from > Linux to FreeBSD. From what I can tell, the ptrace interface on FreeBSD > is pretty similar to the Linux interface; however, it doesn't appear that > the FreeBSD interface generate events when the child process forks, calls > exec, creates a new LWP, etc. My question then is: > > Does FreeBSD provide any way to determine from a parent/tracing > process if a child process has called fork, exec, exit, or created a > new LWP? /usr/bin/truss watches for syscalls named "fork", "rfork", and "vfork", and when they return it forks another copy of itself to watch the child. See /usr/src/usr.bin/truss/i386-fbsd.c and main.c (search for "in_fork"). You can tell when a new lwp is created because lwpid changes. In setup.c the waitevent() function calls ptrace(PT_LWPINFO...) on every syscall entry/exit so it's easy to track; it then calls the find_thread() function which allocates a new helper struct every time a new lwp appears. -- Dan Nelson dnelson@allantgroup.com