1#!/bin/ksh 2# #!/usr/bin/ksh 3# 4# lastwords - print last few syscalls for dying processes. 5# Written using DTrace (Solaris 10 3/05). 6# 7# 20-Apr-2006, ver 0.71 (check for newer versions) 8# 9# This prints the last few system calls for processes matching 10# the given name, when they exit. This makes use of a ring buffer 11# so that the impact on the system is minimised. 12# 13# USAGE: lastwords command 14# eg, 15# lastwords netscape 16# 17# FIELDS: 18# TIME Time of syscall return, ns 19# PID Process ID 20# EXEC Process name (execname) 21# SYSCALL System call 22# RETURN Return value for system call 23# ERR errno for system call 24# 25# BASED ON: /usr/demo/dtrace/ring.d 26# 27# SEE ALSO: DTrace Guide "Buffers and Buffering" chapter (docs.sun.com) 28# dtruss (DTraceToolkit) 29# 30# PORTIONS: Copyright (c) 2005, 2006 Brendan Gregg. 31# 32# CDDL HEADER START 33# 34# The contents of this file are subject to the terms of the 35# Common Development and Distribution License, Version 1.0 only 36# (the "License"). You may not use this file except in compliance 37# with the License. 38# 39# You can obtain a copy of the license at Docs/cddl1.txt 40# or http://www.opensolaris.org/os/licensing. 41# See the License for the specific language governing permissions 42# and limitations under the License. 43# 44# CDDL HEADER END 45# 46# 09-Jun-2005 Brendan Gregg Created this. 47# 48 49### Usage 50function usage 51{ 52 cat <<-END >&2 53 USAGE: lastwords command 54 eg, 55 lastwords netscape 56 END 57 exit 1 58} 59 60### Process arguments 61if (( $# != 1 )); then 62 usage 63fi 64command=$1 65 66print "Tracing... Waiting for $command to exit..." 67 68### Run DTrace 69/usr/sbin/dtrace -n ' 70 #pragma D option quiet 71 #pragma D option bufpolicy=ring 72 #pragma D option bufsize=16k 73 74 syscall:::return 75 /execname == strstr(execname, $$1) || $$1 == strstr($$1, execname)/ 76 { 77 /* buffer syscall details */ 78 printf("%-18d %5d %12s %12s %10x %3d\n", 79 timestamp,pid,execname,probefunc,(int)arg0,errno); 80 } 81 82 /* SOLARIS: proc::proc_exit:exit */ 83 proc::exit1:exit 84 /execname == strstr(execname, $$1) || $$1 == strstr($$1, execname)/ 85 { 86 /* print, erm, footer */ 87 printf("%-18s %5s %12s %12s %10s %3s\n", 88 "TIME","PID","EXEC","SYSCALL","RETURN","ERR"); 89 exit(0); 90 } 91' "$command" 92