Jon Haslam's Weblog

I have no idea just how they do it but the DTrace chaps have managed to chock more stuff into build 63. One of the ease of use bits I've been waiting for arrived in this build and that is the ability to run a command under the control of dtrace(1M). Quite frequently I want to apply some D to a process early in its lifecycle or to a process that has a short lifecycle. To do this prior to build 63 you have to apply tricks such as stopping the process at its main() entry point with truss, apply your D and then prun it, i.e:

# truss -U a.out:main -t\!all ls
/1@1:   -> main(0x1, 0xffbffd9c, 0xffbffda4, 0x26000)
(Run dtrace(1M) in another window now)
# prun `pgrep ls`

This can become quite a chore when you've got to do it a lot. However, courtesy of Mike Shapiro, life is now simple as it should be as we have the -c and -p options to control a process or attach to an already existing one. Here's an example of how we can use this to simply look at the option string for a command so we can see what options it is looking for:

# cat getopt.d
pid$target:libc:getopt:entry
{
        printf("option string: %s\n", stringof(copyinstr(arg2)));
}

# dtrace -q -c "pkill -Q" -s ./getopt.d 2>/dev/null
option string: fnovVxD:u:U:G:P:g:s:t:z:J:T:

Note that we refer to the current pid with $target and also that I fed pkill(1) a bogus argument so it would fail and I redirect the whining to /dev/null. So, what is interesting about this? Well, sometimes commands have options that aren't documented in the man page and pkill(1) is no different. A word of warning - if you do spot which option is in there that isn't documented and decide to give it a go, make sure noboy on that systems wants vold(1M) running ;-).

DTrace. A Purgers friend.