1*62045Sbostic.\" Copyright (c) 1990, 1993 2*62045Sbostic.\" The Regents of the University of California. All rights reserved. 344955Scael.\" 450582Scael.\" %sccs.include.redist.roff% 544955Scael.\" 6*62045Sbostic.\" @(#)ktrace.1 8.1 (Berkeley) 06/06/93 744955Scael.\" 844955Scael.Dd 944955Scael.Dt KTRACE 1 1058795Scael.Os BSD 4.4 1144955Scael.Sh NAME 1244955Scael.Nm ktrace 1344955Scael.Nd enable kernel process tracing 1444955Scael.Sh SYNOPSIS 1544955Scael.Nm ktrace 1645987Sbostic.Op Fl aCcdi 1745987Sbostic.Op Fl f Ar trfile 1845987Sbostic.Op Fl g Ar pgrp 1944955Scael.Op Fl p Ar pid 2044955Scael.Op Fl t Ar trstr 2144955Scael.Nm ktrace 2245987Sbostic.Op Fl adi 2344955Scael.Op Fl f Ar trfile 2445987Sbostic.Op Fl t Ar trstr 2545987Sbosticcommand 2644955Scael.Sh DESCRIPTION 2744955Scael.Nm Ktrace 2844955Scaelenables kernel trace logging for the specified processes. 2950582ScaelKernel trace data is logged to the file 3050582Scael.Pa ktrace.out . 3145987SbosticThe kernel operations that are traced include system calls, namei 3250582Scaeltranslations, signal processing, and 3350582Scael.Tn I/O . 3444955Scael.Pp 3545987SbosticOnce tracing is enabled on a process, trace data will be logged until 3645987Sbosticeither the process exits or the trace point is cleared. 3745987SbosticA traced process can generate enormous amounts of log data quickly; 3845987SbosticIt is strongly suggested that users memorize how to disable tracing before 3945987Sbosticattempting to trace a process. 4045987SbosticThe following command is sufficient to disable tracing on all user owned 4145987Sbosticprocesses, and, if executed by root, all processes: 4245987Sbostic.Pp 4344955Scael.Dl \&$ trace -C 4444955Scael.Pp 4545987SbosticThe trace file is not human readable; use 4644955Scael.Xr kdump 1 4744955Scaelto decode it. 4845987Sbostic.Pp 4945987SbosticThe options are as follows: 5050582Scael.Bl -tag -width indent 5150582Scael.It Fl a 5245987SbosticAppend to the trace file instead of truncating it. 5350582Scael.It Fl C 5445987SbosticDisable tracing on all user owned processes, and, if executed by root, all 5545987Sbosticprocesses in the system. 5650582Scael.It Fl c 5745989SbosticClear the trace points associated with the specified file or processes. 5850582Scael.It Fl d 5945989SbosticDescendants; perform the operation for all current children of the 6045989Sbosticdesignated processes. 6150582Scael.It Fl f Ar file 6244955ScaelLog trace records to 6345987Sbostic.Ar file 6450582Scaelinstead of 6550582Scael.Pa ktrace.out . 6650582Scael.It Fl g Ar pgid 6745987SbosticEnable (disable) tracing on all processes in the process group (only one 6845987Sbostic.Fl g 6945987Sbosticflag is permitted). 7050582Scael.It Fl i 7145989SbosticInherit; pass the trace flags to all future children of the designated 7245987Sbosticprocesses. 7350582Scael.It Fl p Ar pid 7445987SbosticEnable (disable) tracing on the indicated process id (only one 7545987Sbostic.Fl p 7645987Sbosticflag is permitted). 7750582Scael.It Fl t Ar trstr 7845987SbosticThe string argument represents the kernel trace points, one per letter. 7945987SbosticThe following table equates the letters with the tracepoints: 8050582Scael.Pp 8150582Scael.Bl -tag -width flag -compact 8250582Scael.It Cm c 8344955Scaeltrace system calls 8450582Scael.It Cm n 8544955Scaeltrace namei translations 8650582Scael.It Cm i 8750582Scaeltrace 8850582Scael.Tn I/O 8950582Scael.It Cm s 9045987Sbostictrace signal processing 9150582Scael.El 9250582Scael.It Ar command 9345987SbosticExecute 9444955Scael.Ar command 9544955Scaelwith the specified trace flags. 9650582Scael.El 9744955Scael.Pp 9844955ScaelThe 9944955Scael.Fl p , 10044955Scael.Fl g , 10150582Scaeland 10250582Scael.Ar command 10350582Scaeloptions are mutually exclusive. 10444955Scael.Sh EXAMPLES 10544583Smarc# trace all kernel operations of process id 34 10645987Sbostic.Dl $ ktrace -p 34 10750582Scael.Pp 10844583Smarc# trace all kernel operations of processes in process group 15 and 10937231Smarc# pass the trace flags to all current and future children 11047067Smarc.Dl $ ktrace -idg 15 11150582Scael.Pp 11244583Smarc# disable all tracing of process 65 11345987Sbostic.Dl $ ktrace -cp 65 11450582Scael.Pp 11544583Smarc# disable tracing signals on process 70 and all current children 11647067Smarc.Dl $ ktrace -t s -cdp 70 11750582Scael.Pp 11850582Scael# enable tracing of 11950582Scael.Tn I/O 12050582Scaelon process 67 12145987Sbostic.Dl $ ktrace -ti -p 67 12250582Scael.Pp 12344583Smarc# run the command "w", tracing only system calls 12444955Scael.Dl $ ktrace -tc w 12550582Scael.Pp 12637231Smarc# disable all tracing to the file "tracedata" 12744955Scael.Dl $ ktrace -c -f tracedata 12850582Scael.Pp 12944583Smarc# disable tracing of all processes owned by the user 13044955Scael.Dl $ ktrace -C 13144955Scael.Sh SEE ALSO 13244955Scael.Xr kdump 1 13344955Scael.Sh HISTORY 13450582ScaelThe 13550582Scael.Nm ktrace 13658795Scaelcommand appears in 13758795Scael.Bx 4.4 . 138