Jon Haslam's Weblog

A certain Alec Muffet reminded me at lunch that I should post a few more "normal" DTrace scripts. What is meant by "normal" in this context are scripts that are simple and old but are good for learning the basics of D; good for morphing into something specific that you want to do. After all, when I learnt Perl I did it via ripping other peoples examples around to do what I wanted to do and not by reading a man page.

Alec, I'll try to do better in the future but now my big tummy is a rumblin' for some tea so I'll leave you with something that you wouldn't really run as you'd stop people logging in! However, it's good for a laugh and I'm sure you can use the principle in many other areas ...

#cat read.d
#!/usr/sbin/dtrace -ws

ufs_read:entry
/ stringof(args[0]->v_path) == $$1 /
{
        printf("File %s read by %d\n", $$1, curpsinfo->pr_uid);
        raise(SIGKILL);
}

In another window we do:

# more /etc/passwd
Killed

The read.d script output looks like this:

# ./read.d /etc/passwd
dtrace: script './read.d' matched 1 probe
dtrace: allowing destructive actions
CPU     ID                    FUNCTION:NAME
  0  15625                   ufs_read:entry File /etc/passwd read by 0

Oops!