From owner-freebsd-dtrace@FreeBSD.ORG Wed Dec 11 01:00:46 2013 Return-Path: Delivered-To: freebsd-dtrace@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [8.8.178.115]) (using TLSv1 with cipher ADH-AES256-SHA (256/256 bits)) (No client certificate requested) by hub.freebsd.org (Postfix) with ESMTPS id 7C7C88A1 for ; Wed, 11 Dec 2013 01:00:46 +0000 (UTC) Received: from mail-ie0-x22a.google.com (mail-ie0-x22a.google.com [IPv6:2607:f8b0:4001:c03::22a]) (using TLSv1 with cipher ECDHE-RSA-RC4-SHA (128/128 bits)) (No client certificate requested) by mx1.freebsd.org (Postfix) with ESMTPS id 4366E1151 for ; Wed, 11 Dec 2013 01:00:46 +0000 (UTC) Received: by mail-ie0-f170.google.com with SMTP id qd12so10019604ieb.15 for ; Tue, 10 Dec 2013 17:00:45 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=sender:date:from:to:cc:subject:message-id:references:mime-version :content-type:content-disposition:in-reply-to:user-agent; bh=pIqZYQIuwgI8wnsvnNf1lIU1mTAw+xStgDKwx/RlKso=; b=jXq+QYf7WY0zq0Th7hGuuMMMkAGqJRYPBAtwUHYvGQe/85KeujkA4/mmSFZe+e59cQ vx50YJq7R+4NP6/qPI1uTpPZMBVOgdyVC/Q5TmCknzyv8gCji+aEHzVnoj5zOeGGZCi4 iSXxDW+t0uyNYLr/GQFU2XkAFygb4bwtYUg12IJrgppUcwLbiNUsoR9gbLgIkdnE3XfG GmNleaUA+IHuczcNp91rjK4xtqPb9RbfvJg6agXr3jqE+xj1IUhzFvzorLUS0/DJID8a Fv9VTMO6EIk6XOlDcEtXEw4jijVNRqOMcZZB8JB2tUVvYNH4dFmUL2FTQBUUfj6pMzxq MeJg== X-Received: by 10.50.61.232 with SMTP id t8mr586587igr.32.1386723645575; Tue, 10 Dec 2013 17:00:45 -0800 (PST) Received: from raichu (198-84-185-216.cpe.teksavvy.com. [198.84.185.216]) by mx.google.com with ESMTPSA id w4sm6233033igb.5.2013.12.10.17.00.44 for (version=TLSv1 cipher=ECDHE-RSA-RC4-SHA bits=128/128); Tue, 10 Dec 2013 17:00:45 -0800 (PST) Sender: Mark Johnston Date: Tue, 10 Dec 2013 20:00:42 -0500 From: Mark Johnston To: hiren panchasara Subject: Re: Examples from www.dtracebook.com Message-ID: <20131211010042.GB4080@raichu> References: <20131210234714.GQ1681@albert.catwhisker.org> <20131211003245.GA4080@raichu> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: User-Agent: Mutt/1.5.21 (2010-09-15) Cc: freebsd-dtrace@freebsd.org X-BeenThere: freebsd-dtrace@freebsd.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "A discussion list for developers working on DTrace in FreeBSD." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 11 Dec 2013 01:00:46 -0000 On Tue, Dec 10, 2013 at 04:54:36PM -0800, hiren panchasara wrote: > On Tue, Dec 10, 2013 at 4:32 PM, Mark Johnston wrote: > > On Tue, Dec 10, 2013 at 04:26:54PM -0800, hiren panchasara wrote: > >> $ sudo dtrace -n 'proc:::exec-success { trace(curpsinfo->pr_psargs); }' > >> dtrace: description 'proc:::exec-success ' matched 1 probe > >> CPU ID FUNCTION:NAME > >> 5 48876 :exec-success /bin/sh /usr/bin/man ls > >> 2 48876 :exec-success /sbin/sysctl -n hw.machine_arch > >> 6 48876 :exec-success /sbin/sysctl -n hw.machine > >> 0 48876 :exec-success /usr/bin/locale > >> 7 48876 :exec-success /usr/bin/zcat > >> /usr/share/man/man1/ls.1.gz > >> 2 48876 :exec-success head -1 > >> 1 48876 :exec-success tbl > >> 6 48876 :exec-success groff -S -P-h -Wall > >> -mtty-char -man -Tascii -P-c > >> 7 48876 :exec-success /usr/bin/zcat > >> /usr/share/man/man1/ls.1.gz > >> 3 48876 :exec-success less > >> 3 48876 :exec-success troff -Wall -mtty-char > >> -man -Tascii > >> 7 48876 :exec-success grotty -h -c > >> > >> > >> 6 48876 :exec-success top > >> 7 48876 :exec-success ps awwux > >> 7 48876 :exec-success iostat > >> 5 48876 :exec-success vmstat 1 > >> 4 48876 :exec-success bash > >> 4 48876 :exec-success whois > >> 5 48876 :exec-success whoami > >> 4 48876 :exec-success devinfo > >> 4 48876 :exec-success dmesg > >> 6 48876 :exec-success pciconf -lv > >> > >> I am getting interesting info only when "man" is executed and not for > >> any other command. What does that tell me? How is man special? Other > >> programs must also be doing exec(2), no? > > > > /usr/bin/man is a shell script. You'll see similar output for any > > executable that starts with a shebang. > > Thanks Mark for responding but that doesn't seem true. > > I tried apropos(1) without luck. I get the following with "apropos dtrace": mark@raichu: ~ $ sudo dtrace -n 'proc:::exec-success {trace(curpsinfo->pr_psargs);}' Password: dtrace: description 'proc:::exec-success ' matched 1 probe CPU ID FUNCTION:NAME 4 35852 :exec-success /bin/sh /usr/bin/apropos dtrace 2 35852 :exec-success grep -Ehi -- dtrace /usr/share/man/whatis /usr/local/man/whatis /usr/share/openssl/man/whatis /usr/local/lib/perl5/5.14/man/whatis /usr/local/lib/perl5/5.14/perl/man/whatis 2 35852 :exec-success /usr/bin/less -i I don't really know what you mean by "interesting info." The other programs you ran (whoami, pciconf, dmesg, devinfo) above don't call execv().