1#!/bin/ksh
2# #!/usr/bin/ksh
3#
4# lastwords - print last few syscalls for dying processes.
5#             Written using DTrace (Solaris 10 3/05).
6#
7# 20-Apr-2006, ver 0.71         (check for newer versions)
8#
9# This prints the last few system calls for processes matching
10# the given name, when they exit. This makes use of a ring buffer
11# so that the impact on the system is minimised.
12#
13# USAGE: lastwords command
14#    eg,
15#        lastwords netscape
16#
17# FIELDS:
18#           TIME     Time of syscall return, ns
19#           PID      Process ID
20#           EXEC     Process name (execname)
21#           SYSCALL  System call
22#           RETURN   Return value for system call
23#           ERR      errno for system call
24#
25# BASED ON: /usr/demo/dtrace/ring.d
26#
27# SEE ALSO: DTrace Guide "Buffers and Buffering" chapter (docs.sun.com)
28#           dtruss (DTraceToolkit)
29#
30# PORTIONS: Copyright (c) 2005, 2006 Brendan Gregg.
31#
32# CDDL HEADER START
33#
34#  The contents of this file are subject to the terms of the
35#  Common Development and Distribution License, Version 1.0 only
36#  (the "License").  You may not use this file except in compliance
37#  with the License.
38#
39#  You can obtain a copy of the license at Docs/cddl1.txt
40#  or http://www.opensolaris.org/os/licensing.
41#  See the License for the specific language governing permissions
42#  and limitations under the License.
43#
44# CDDL HEADER END
45#
46# 09-Jun-2005   Brendan Gregg   Created this.
47#
48
49### Usage
50function usage
51{
52	cat <<-END >&2
53	USAGE: lastwords command
54	   eg,
55	       lastwords netscape
56	END
57	exit 1
58}
59
60### Process arguments
61if (( $# != 1 )); then
62        usage
63fi
64command=$1
65
66print "Tracing... Waiting for $command to exit..."
67
68### Run DTrace
69/usr/sbin/dtrace -n '
70 #pragma D option quiet
71 #pragma D option bufpolicy=ring
72 #pragma D option bufsize=16k
73
74 syscall:::return
75 /execname == strstr(execname, $$1) || $$1 == strstr($$1, execname)/
76 {
77	/* buffer syscall details */
78	printf("%-18d %5d %12s %12s %10x %3d\n",
79	    timestamp,pid,execname,probefunc,(int)arg0,errno);
80 }
81
82 /* SOLARIS: proc::proc_exit:exit */
83 proc::exit1:exit
84 /execname == strstr(execname, $$1) || $$1 == strstr($$1, execname)/
85 {
86	/* print, erm, footer */
87	printf("%-18s %5s %12s %12s %10s %3s\n",
88	    "TIME","PID","EXEC","SYSCALL","RETURN","ERR");
89	exit(0);
90 }
91' "$command"
92