Vivek Joshi's Weblog

Who sent me the signal ?

I was going through certain DTrace exercises and found one which displays some interesting things. It displays the signal sender. I have experimented this with three terminals windows as followings,

--------------------xxxxxxxxxx--------------------
Window 1 :
[solaris-devx] / > ps
PID TTY TIME CMD
1887 pts/4 0:00 bash
1872 pts/4 0:00 sh
1896 pts/4 0:00 ps
[solaris-devx] / > kill -9 1892
[solaris-devx] / >

Window 2 :
[solaris-devx] / > ps
PID TTY TIME CMD
1892 pts/5 0:00 bash
1891 pts/5 0:00 sh
1893 pts/5 0:00 ps
[solaris-devx] / > Killed
#

Window 3:
#./sig.d
1892 9 1887 bash
--------------------xxxxxxxxxx--------------------

Let us examine what's going on ... I have two terminal windows open, both run sh and then, bash. From one of the terminal (from bash:process 1887), I kill another bash process 1892. And, it's captured by dtrace script sig.d thats running in some another terminal window.

Look at this output from sig.d script,
1892 9 1887 bash

It means 1892 was killed as it was sent a kill signal (9) by process 1887 which is a process bash. Here's the sig.d script,

[solaris-devx] dtrace > cat sig.d
#!/usr/sbin/dtrace -qs
syscall::kill:entry
{
trace(arg0);
printf("\t");
trace(arg1);
printf("\t");
trace(pid);
printf("\t");
trace(execname);
printf("\n");
}

Here, argument 0 and 1 are related to process that was killed whereas pid and execname are related to process that sent the signal.

It reminds me one older issue where 'ksh' used to dump core because of sigbus at certain time .... I tried to figure out the reason but didn't find any obvious thing in 'ksh' source code. I also wrote a C program to capture the sender ... Later, it came out as linker issue but it was very hard to debug.

DTrace provides such probes without affecting the performance ! I'll update more as I learn more interesting things about DTrace. I'd like to write a couple of blogs regarding Solaris IPC in upcoming entries.

Posted at 05:08PM Jan 09, 2007 by vbjoshi in General  |