1#!/bin/ksh 2# #!/usr/bin/ksh 3# 4# rwsnoop - snoop read/write events. 5# Written using DTrace (Solaris 10 3/05). 6# 7# This is measuring reads and writes at the application level. This matches 8# the syscalls read, write, pread and pwrite. 9# 10# 17-Sep-2005, ver 0.75 (check for newer versions) 11# 12# USAGE: rwsnoop [-jPtvZ] [-n name] [-p pid] 13# 14# rwsnoop # default output 15# 16# -j # print project ID 17# -P # print parent process ID 18# -t # print timestamp, us 19# -v # print time, string 20# -Z # print zone ID 21# -n name # this process name only 22# -p PID # this PID only 23# eg, 24# rwsnoop -Z # print zone ID 25# rwsnoop -n bash # monitor processes named "bash" 26# rwsnoop > out.txt # recommended 27# 28# NOTE: 29# rwsnoop usually prints plenty of output, which itself will cause 30# more output. It can be better to redirect the output of rwsnoop 31# to a file to prevent this. 32# 33# FIELDS: 34# TIME Timestamp, us 35# TIMESTR Time, string 36# ZONE Zone ID 37# PROJ Project ID 38# UID User ID 39# PID Process ID 40# PPID Parent Process ID 41# CMD Process name 42# D Direction, Read or Write 43# BYTES Total bytes during sample, -1 for error 44# FILE Filename, if file based 45# 46# Reads and writes that are not file based, for example with sockets, will 47# print "<unknown>" as the filename. 48# 49# SEE ALSO: rwtop 50# 51# COPYRIGHT: Copyright (c) 2005 Brendan Gregg. 52# 53# CDDL HEADER START 54# 55# The contents of this file are subject to the terms of the 56# Common Development and Distribution License, Version 1.0 only 57# (the "License"). You may not use this file except in compliance 58# with the License. 59# 60# You can obtain a copy of the license at Docs/cddl1.txt 61# or http://www.opensolaris.org/os/licensing. 62# See the License for the specific language governing permissions 63# and limitations under the License. 64# 65# CDDL HEADER END 66# 67# TODO: 68# Track readv and writev. 69# 70# Author: Brendan Gregg [Sydney, Australia] 71# 72# 24-Jul-2005 Brendan Gregg Created this. 73# 17-Sep-2005 " " Increased switchrate. 74# 75 76 77############################## 78# --- Process Arguments --- 79# 80 81### default variables 82opt_name=0; opt_pid=0; opt_proj=0; opt_zone=0; opt_time=0; opt_timestr=0 83opt_bytes=1; filter=0; pname=.; pid=0; opt_ppid=0 84 85### process options 86while getopts n:Pp:jtvZ name 87do 88 case $name in 89 n) opt_name=1; pname=$OPTARG ;; 90 p) opt_pid=1; pid=$OPTARG ;; 91 P) opt_ppid=1 ;; 92 j) opt_proj=1 ;; 93 t) opt_time=1 ;; 94 v) opt_timestr=1 ;; 95 Z) opt_zone=1 ;; 96 h|?) cat <<-END >&2 97 USAGE: rwsnoop [-jPtvZ] [-n name] [-p pid] 98 99 -j # print project ID 100 -P # print parent process ID 101 -t # print timestamp, us 102 -v # print time, string 103 -Z # print zone ID 104 -n name # this process name only 105 -p PID # this PID only 106 eg, 107 rwsnoop # default output 108 rwsnoop -Z # print zone ID 109 rwsnoop -n bash # monitor processes named "bash" 110 END 111 exit 1 112 esac 113done 114 115shift $(( $OPTIND - 1 )) 116 117### option logic 118if (( opt_name || opt_pid )); then 119 filter=1 120fi 121 122 123 124################################# 125# --- Main Program, DTrace --- 126# 127/usr/sbin/dtrace -n ' 128 /* 129 * Command line arguments 130 */ 131 inline int OPT_proj = '$opt_proj'; 132 inline int OPT_zone = '$opt_zone'; 133 inline int OPT_bytes = '$opt_bytes'; 134 inline int OPT_name = '$opt_name'; 135 inline int OPT_ppid = '$opt_ppid'; 136 inline int OPT_pid = '$opt_pid'; 137 inline int OPT_time = '$opt_time'; 138 inline int OPT_timestr = '$opt_timestr'; 139 inline int FILTER = '$filter'; 140 inline int PID = '$pid'; 141 inline string NAME = "'$pname'"; 142 143 #pragma D option quiet 144 #pragma D option switchrate=10hz 145 146 /* 147 * Print header 148 */ 149 dtrace:::BEGIN 150 { 151 /* print header */ 152 OPT_time ? printf("%-14s ", "TIME") : 1; 153 OPT_timestr ? printf("%-20s ", "TIMESTR") : 1; 154 OPT_proj ? printf("%5s ", "PROJ") : 1; 155 OPT_zone ? printf("%5s ", "ZONE") : 1; 156 OPT_ppid ? printf("%6s ", "PPID") : 1; 157 printf("%5s %6s %-12s %1s %7s %s\n", 158 "UID", "PID", "CMD", "D", "BYTES", "FILE"); 159 } 160 161 /* 162 * Check event is being traced 163 */ 164 syscall::*read_nocancel:entry, 165 syscall::*write_nocancel:entry, 166 syscall::*read:entry, 167 syscall::*write:entry 168 /pid != $pid/ 169 { 170 /* default is to trace unless filtering, */ 171 self->ok = FILTER ? 0 : 1; 172 173 /* check each filter, */ 174 (OPT_name == 1 && NAME == strstr(NAME, execname))? self->ok = 1 : 1; 175 (OPT_name == 1 && execname == strstr(execname, NAME))? self->ok = 1 : 1; 176 (OPT_pid == 1 && PID == pid) ? self->ok = 1 : 1; 177 178 /* save file descriptor */ 179 self->fd = self->ok ? arg0 : 0; 180 } 181 182 /* 183 * Save read details 184 */ 185 syscall::*read_nocancel:return, 186 syscall::*read:return 187 /self->ok/ 188 { 189 self->rw = "R"; 190 self->size = arg0; 191 } 192 193 /* 194 * Save write details 195 */ 196 syscall::*write_nocancel:entry, 197 syscall::*write:entry 198 /self->ok/ 199 { 200 self->rw = "W"; 201 self->size = arg2; 202 } 203 204 /* 205 * Process event 206 */ 207 syscall::*read_nocancel:return, 208 syscall::*write_nocancel:entry, 209 syscall::read:return, 210 syscall::write:entry, 211 syscall::pread:return, 212 syscall::pwrite:entry 213/* 214 syscall::*read:return, 215 syscall::*write:entry 216*/ 217 /self->ok/ 218 { 219 /* 220 * Fetch filename 221 */ 222/* 223 this->filistp = curthread->t_procp->p_user.u_finfo.fi_list; 224 this->ufentryp = (uf_entry_t *)((uint64_t)this->filistp + 225 (uint64_t)self->fd * (uint64_t)sizeof(uf_entry_t)); 226 this->filep = this->ufentryp->uf_file; 227 this->vnodep = this->filep != 0 ? this->filep->f_vnode : 0; 228 self->vpath = this->vnodep ? (this->vnodep->v_path != 0 ? 229 cleanpath(this->vnodep->v_path) : "<unknown>") : "<unknown>"; 230*/ 231 this->fpp = &(curproc->p_fd->fd_ofiles[self->fd]); 232 this->fg = (struct fileglob *)((*(this->fpp))->f_fglob); 233 this->vnodep = (struct vnode *)(this->fg->fg_data); 234 self->vpath = this->vnodep ? (this->vnodep->v_name != 0 ? 235 this->vnodep->v_name : "<unknown>") : "<unknown>"; 236 237 /* 238 * Print details 239 */ 240 OPT_time ? printf("%-14d ", timestamp / 1000) : 1; 241 OPT_timestr ? printf("%-20Y ", walltimestamp) : 1; 242 OPT_proj ? printf("%5d ", curpsinfo->pr_projid) : 1; 243 OPT_zone ? printf("%5d ", curpsinfo->pr_zoneid) : 1; 244 OPT_ppid ? printf("%6d ", ppid) : 1; 245 printf("%5d %6d %-12.12s %1s %7d %s\n", 246 uid, pid, execname, self->rw, (int)self->size, self->vpath); 247 248 self->ok = 0; 249 self->fd = 0; 250 self->rw = 0; 251 self->size = 0; 252 self->vpath = 0; 253 } 254' 255