1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
|
.TH statsnoop 1m "$Date:: 2007-09-23 #$" "USER COMMANDS"
.SH NAME
statsnoop \- snoop file stats as they occur. Uses DTrace.
.SH SYNOPSIS
.B statsnoop
[\-a|\-A|\-ceghsvxZ] [\-f pathname] [\-n name] [\-p PID]
.SH DESCRIPTION
statsnoop traces the stat variety of syscalls.
As a process issues a file stat, details
such as UID, PID and pathname are printed out.
The returned file descriptor is printed,
a value of -1 indicates an error. This can be useful
for troubleshooting to determine if appliacions are attempting to
stat files that do not exist.
Since this uses DTrace, only the root user or users with the
dtrace_kernel privilege can run this command.
.SH OS
Solaris
.SH STABILITY
stable - needs the syscall provider.
.SH OPTIONS
.TP
\-a
print all data
.TP
\-A
dump all data, space delimited
.TP
\-c
print current working directory of process
.TP
\-e
print errno value
.TP
\-g
print full command arguments
.TP
\-s
print start time, us
.TP
\-v
print start time, string
.TP
\-x
only print failed stats
.TP
\-Z
print zonename
.TP
\-f pathname
file pathname to snoop
.TP
\-n name
process name to snoop
.TP
\-p PID
process ID to snoop
.PP
.SH EXAMPLES
.TP
Default output, print file stats by process as they occur,
#
.B statsnoop
.PP
.TP
Print human readable timestamps,
#
.B statsnoop
\-v
.PP
.TP
See error codes,
#
.B statsnoop
\-e
.PP
.TP
Snoop this file only,
#
.B statsnoop
\-f /etc/passwd
.PP
.SH FIELDS
.TP
ZONE
Zone name
.TP
UID
User ID
.TP
PID
Process ID
.TP
PPID
Parent Process ID
.TP
FD
File Descriptor (-1 is error)
.TP
ERR
errno value (see /usr/include/sys/errno.h)
.TP
CWD
current working directory of process
.TP
PATH
pathname for file stat
.TP
COMM
command name for the process
.TP
ARGS
argument listing for the process
.TP
TIME
timestamp for the stat event, us
.TP
STRTIME
timestamp for the stat event, string
.SH DOCUMENTATION
See the DTraceToolkit for further documentation under the
Docs directory. The DTraceToolkit docs may include full worked
examples with verbose descriptions explaining the output.
.SH EXIT
statsnoop will run forever until Ctrl\-C is hit.
.SH BUGS
occasionally the pathname for the file stat cannot be read
and the following error will be seen,
dtrace: error on enabled probe ID 6 (...): invalid address
this is normal behaviour.
.SH AUTHOR
Brendan Gregg
[Sydney, Australia]
.SH SEE ALSO
dtrace(1M), truss(1)
|
