Home > Articles > Operating Systems, Server > Solaris

  • Print
  • + Share This
This chapter is from the book

6.2 Monitoring the Processes

In Solaris, you can monitor processes that are currently executing on a system by using one of the commands listed in Table 6.1.

Table 6.1. Commands to Monitor the Processes

Command

Description

ps

Print status and information about active processes

pgrep

Find the process id (PID) of a process

prstat

View overall process statistics (similar to Linux top command)

preap

Reap zombie processes

pstop

Temporarily freeze a process

prun

Continue a process that was stopped by pstop command

pwait

Wait for a process to finish

pwdx

List working directory for a process

pargs

Print the arguments and environment variables of a process

pfiles

Print the list of file descriptors associated with the process

pldd

List dynamic libraries associated with process (similar to ldd for executable)

ptree

Print a process ancestry tree

pstack

Get stack back trace of a process for debugging purposes

truss

Trace system calls and signals for a process

svcs

With the -p option, this command will list processes associated with each service instance. For more details, refer to Section 2.2, "Service Management Facility," in Chapter 2, "Boot, Service Management, and Shutdown."

Now let us examine each of the commands from Table 6.1 in more detail.

6.2.1 Process Status: ps

The ps command can be used to view the processes running on the system. Without options, ps prints information about processes that have the same effective user ID and the same controlling terminal as the invoker of ps command. The output contains only the process ID (PID), terminal identifier (TTY), cumulative execution time (TIME), and the command name (CMD). The output of the ps command is as shown below.

# ps
   PID TTY         TIME CMD
 27014 syscon      0:00 sh
 27151 syscon      0:00 ps
 27018 syscon      0:00 bash

You can print more detailed and comprehensive information about the running processes using different options available for the ps command, as described in Table 6.2.

Table 6.2. ps Command Options

Option

Description

-a

Lists information about all the most frequently requested processes. Processes not associated with a terminal will not be listed.

-e

Lists information about every process on the system.

-A

Lists information for all processes. Identical to the -e option.

-f

Lists full information for all processes.

-l

Generates a long listing.

-P

Prints the number of the processor to which the process is bound, if any, under an additional column header PSR. This is a useful option on systems that have multiple processors.

-u <username>

Lists only process data for a particular user. In the listing, the numerical user ID is printed unless you give -f option, which prints the login name.

Following is an example of using the ps command to list every process in the system:

# ps -ef
     UID    PID   PPID  C  STIME  TTY  TIME  CMD
    root     0     0   0  Apr 09 ?    1:15  sched
    root     1     0   0  Apr 09 ?    0:01  /sbin/init
    root     2     0   0  Apr 09 ?    0:00  pageout
    root     3     0   0  Apr 09 ?    7:06  fsflush
    root     7     1   0  Apr 09 ?    0:03  /lib/svc/bin/svc.startd
    root     9     1   0  Apr 09 ?    0:22  /lib/svc/bin/svc.configd
    root    505   504  0  Apr 09 ?    0:03  /usr/lib/autofs/automountd
  daemon    336    1   0  Apr 09 ?    0:00  /usr/lib/nfs/lockd
    root    151    1   0  Apr 09 ?    0:00  /usr/lib/picl/picld
    root    382    1   0  Apr 09 ?    0:02  /usr/lib/inet/inetd start
    root    170    1   0  Apr 09 ?    0:00  devfsadmd
  daemon    302    1   0  Apr 09 ?    0:00  /usr/bin/rpcbind
    root    311    1   0  Apr 09 ?    0:00  /usr/lib/netsvc/yp/ypbind
    root    144    1   0  Apr 09 ?    0:08  /usr/sbin/nscd
    root    616    1   0  Apr 09 ?    0:02  /usr/sfw/sbin/snmpd
    root    381    1   0  Apr 09 ?    0:00  /usr/sbin/cron
    root    313    1   0  Apr 09 ?    0:00  /usr/sbin/keyserv
  daemon    142    1   0  Apr 09 ?    0:00  /usr/lib/crypto/kcfd
  daemon    312    1   0  Apr 09 ?    0:00  /usr/lib/nfs/statd
    root    123    1   0  Apr 09 ?    0:00  /usr/lib/sysevent/syseventd
    root    159    1   0  Apr 09 ?    0:00  /usr/lib/power/powerd
    root    383   350  0  Apr 09 ?    0:00  /usr/lib/saf/ttymon
    root    350    7   0  Apr 09 ?    0:00  /usr/lib/saf/sac -t 300

Table 6.3 lists and describes the different process attribute fields displayed with the ps command.

Table 6.3. Process Attribute Fields

Field

Description

F

Flags associated with the process.

S

The state of the process. Refer to Table 6.4 for a complete list of the process states.

UID

The user ID of the process owner.

PID

The process ID of each process. This value should be unique. Generally, PIDs are allocated lowest to highest, but they wrap at some point.

PPID

The parent process ID. This identifies the parent process that started the process. Using the PPID enables you to trace the sequence of process creation that took place.

PRI

The priority of the process. Without -c option, higher numbers mean lower priority. With -c option, higher numbers mean higher priority.

NI

The nice value, used in priority computation. This is not printed when -c option is used. A process'sing priority. Making a process nicer means lowering its priority.

ADDR

The memory address of the process.

SZ

The SIZE field. This is the total number of pages in the process. Page size may vary on different hardware platforms. To display the page size on your system, issue the /usr/bin/pagesize command.

WCHAN

The address of an event for which the process is sleeping. If the address is -, then the process is running.

STIME

The starting time of the process (in hours, minutes, and seconds).

TTY

The terminal assigned to your process.

TIME

The cumulative CPU time used by the process in minutes and seconds.

CMD

The command (truncated) that generated the process.

Table 6.4 lists the codes used to show the various process states by the S field of the ps command.

Table 6.4. Process States

Code

Process state

Description

O

Running

The process is running on a CPU.

S

Sleeping

The process is waiting for an event to complete.

R

Runnable

The process is in the run queue.

Z

Zombie

The process was terminated and the parent is not waiting.

T

Traced

The process was stopped by a signal because the parent is tracing it.

W

Waiting

The process is waiting for CPU usage to drop to the CPU-caps enforced limits.

6.2.2 Grepping for Process: pgrep

The pgrep command examines the active processes on the system and reports the process IDs of the processes whose attributes match the criteria specified on the command line. It can be used to replace the combination of the ps and grep commands to get the PID of a process based on some known process attributes. Following is an example of using the pgrep command. It also shows how the pgrep command can be used to replace the combination of the ps and grep commands:

# ps -e|grep sh
     3      ?         0:22    fsflush
  1238      pts/2     0:00    bash
   606      ?         0:00    sshd
  1234      pts/2     0:00    sh
  1274      pts/3     0:00    bash
  1270      pts/3     0:00    sh
#
# pgrep sh
3
1238
606
1234
1274
1270

6.2.3 Process Statistics Summary: prstat

The prstat command iteratively examines all active processes on the system and reports overall statistics on screen. The interesting thing about the prstat command is that information remains on the screen and gets updated periodically. By default, the prstat command updates the information screen every five seconds. However, the user can specify the sampling interval of choice on the command line. This command is similar to the top command in Linux. The syntax for the prstat command is as follows:

prstat [options] <count> <interval>

Table 6.5 describes some of the main options. Table 6.6 describes different arguments for the prstat command.

Table 6.5. Options for the prstat Command

Option

Description

-a

Displays separate reports about processes and users at the same time.

-c

Continuously prints new reports below previous reports instead of overwriting them.

-n <nproc>

Restricts the number of output lines. The <nproc> argument specifies how many lines of process or LWP (Light Weight Process or thread) statistics are reported.

-p <pidlist>

Reports only on processes that have a PID in the given list.

-s <key>

Sorts output lines by key in descending order. The four possible keys include: cpu time, size, rss, and pri. You can use only one key at a time.

-S <key>

Sorts output lines by key in ascending order.

-t

Reports total usage summary for each user.

-u <uidlist>

Reports only on processes that have an effective user ID (EUID) in the given list.

-U <uidlist>

Reports only on processes that have a real UID in the given list.

Table 6.6. Arguments for the prstat Command

Argument

Description

<count>

Specifies the number of times that the statistics are repeated. By default, prstat reports statistics until a termination signal is received.

<interval>

Specifies the sampling interval in seconds; the default interval is 5 seconds.

Following is an example of using prstat command with the sampling interval as one second:

# prstat 1
  PID  USERNAME SIZE  RSS    STATE PRI NICE TIME     CPU  PROCESS/NLWP
 796  noaccess 183M  100M   sleep 59  0    0:00:23 0.1% java/32
 1347 root     3440K 2888K  cpu5  59  0    0:00:00 0.0% prstat/1
 606  root     3520K 1280K  sleep 59  0    0:00:00 0.0% sshd/1
 567  root     2152K 1292K  sleep 59  0    0:00:00 0.0% snmpdx/1

(output edited for brevity)

 369  root     2040K 1164K  sleep 59  0    0:00:00 0.0% ttymon/1
 399 daemon    2448K 1272K  sleep 59  0    0:00:00 0.0% nfsmapid/6
 9   root      11M   9900K  sleep 59  0    0:00:05 0.0% svc.configd/14
 7   root      13M   11M    sleep 59  0    0:00:01 0.0% svc.startd/14
Total: 58 processes, 211 lwps, load averages: 0.00, 0.00, 0.00

Table 6.7 describes the column headings and their meanings in a prstat report.

Table 6.7. Column Headings for the prstat Command

Argument

Description

PID

The unique process identification number of the process

USERNAME

Login name or UID of the owner of the process

SIZE

The total virtual memory size of the process in kilobytes (K), megabytes (M), or gigabytes (G)

RSS

The resident set size of the process in kilobytes (K), megabytes (M), or gigabytes (G)

STATE

The state of the process:

* cpu - The process is running on the CPU.

* sleep - The process is waiting for an event to complete.

* run - The process is in the run queue.

* zombie- The process has terminated, and the parent is not waiting.

* stop - The process is stopped.

PRI

The priority of the process

NICE

The value used in priority computation

TIME

The cumulative execution time for the process

CPU

The percentage of recent CPU time used by the process

PROCESS

The name of the process

NLWP

The number of lightweight processes (LWPs) or threads in the process

6.2.4 Reap a Zombie Process: preap

You can use the preap command to clean up a defunct or a zombie process. A zombie process has not yet had its exit status reaped, or claimed, by its parent. These processes are generally harmless, but can consume system resources if they are numerous. You need to specify the PID of the zombie process to be reaped with the preap command as shown below:

# ps -efl|grep Z
 F S UID  PID PPID C PRI NI  ADDR  SZ  WCHAN STIME TTY TIME CMD
 0 Z root 810 809  0 0   -   -     0   -        -  ?   0:00    <defunct>
 0 Z root 755 754  0 0   -   -     0   -        -  ?   0:00    <defunct>
 0 Z root 756 753  0 0   -   -     0   -        -  ?   0:00    <defunct>
#
# preap 810
810: exited with status 0
#
# ps -efl|grep Z
 F S UID  PID PPID C PRI NI  ADDR  SZ  WCHAN STIME TTY TIME CMD
 0 Z root 755 754  0 0   -   -     0   -        -  ?    0:00 <defunct>
 0 Z root 756 753  0 0   -   -     0   -        -  ?    0:00 <defunct>

In this example, the preap command successfully removed the zombie process with PID 810. Otherwise, the only way to remove them is to reboot the system.

6.2.5 Temporarily Stop a Process: pstop

A process can be temporarily suspended with the pstop command. You need to specify the PID of the process to be suspended as shown below:

# pstop 1234

6.2.6 Resuming a Suspended Process: prun

A temporarily suspended process can be resumed and made runnable with the prun command as shown below:

# prun 1234

6.2.7 Wait for Process Completion: pwait

The pwait command blocks and waits for termination of a process as shown below:

# pwait 1234
(sleep...)

6.2.8 Process Working Directory: pwdx

The current working directory of a process can be displayed using the pwdx command as shown below:

# pwd
/tmp/exp
# sleep 200
(sleep...)
# pgrep sleep
1408
# pwdx 1408
1408:   /tmp/exp
#

6.2.9 Process Arguments: pargs

The pargs command can be used to print the arguments and environment variables associated with a process. The pargs command solves a problem of the ps command being unable to display all the arguments that are passed to a process. The ps command, when used with -f option, prints the full command name and its arguments, up to a limit of 80 characters. If the limit is crossed then the command line is truncated.

With the -e option, pargs command can be used to display the environment variables that are associated with a process. Following is an example of using the pargs command:

# ps -ef|grep proc
    root  1234  1008   0 21:29:13 pts/9       0:00 /bin/sh ./proc_exp arg1 arg2 arg3
#
# pargs 1234
1234:    /bin/sh ./proc_exp arg1 arg2 arg3
argv[0]: /bin/sh
argv[1]: ./proc_exp
argv[2]: arg1
argv[3]: arg2
argv[4]: arg3
#
# pargs -e 1234
1234:    /bin/sh ./proc_exp arg1 arg2 arg3
envp[0]: HZ=100
envp[1]: TERM=vt100
envp[2]: SHELL=/sbin/sh
envp[3]: PATH=/usr/sbin:/usr/bin
envp[4]: MAIL=/var/mail/root
envp[5]: PWD=/
envp[6]: TZ=Asia/Calcutta
envp[7]: SHLVL=1
envp[8]: HOME=/
envp[9]: LOGNAME=root
envp[10]: _=./proc_exp

6.2.10 Process File Table: pfiles

A list of files open within a process can be displayed with the pfiles command as shown below:

# pfiles 1368
1368:   /usr/sbin/in.rlogind
  Current rlimit: 256 file descriptors
   0: S_IFCHR mode:0000 dev:285,0 ino:64224 uid:0 gid:0 rdev:0,0
      O_RDWR|O_NDELAY
   1: S_IFCHR mode:0000 dev:285,0 ino:64224 uid:0 gid:0 rdev:0,0
      O_RDWR|O_NDELAY
   2: S_IFCHR mode:0000 dev:285,0 ino:64224 uid:0 gid:0 rdev:0,0
      O_RDWR|O_NDELAY
   3: S_IFDOOR mode:0444 dev:288,0 ino:55 uid:0 gid:0 size:0
      O_RDONLY|O_LARGEFILE FD_CLOEXEC  door to nscd[156]
      /var/run/name_service_door
   4: S_IFCHR mode:0000 dev:279,0 ino:44078 uid:0 gid:0 rdev:23,4
      O_RDWR|O_NDELAY
      /devices/pseudo/clone@0:ptm
   5: S_IFCHR mode:0000 dev:279,0 ino:29885 uid:0 gid:0 rdev:4,5
   O_RDWR
   /devices/pseudo/clone@0:logindmux
   6: S_IFCHR mode:0000 dev:279,0 ino:29884 uid:0 gid:0 rdev:4,6
   O_RDWR
   /devices/pseudo/clone@0:logindmux

This example lists the files open within the in.rlogind process, whose PID is 1368.

6.2.11 Process Libraries: pldd

A list of the libraries currently mapped into a process can be displayed with the pldd command. This is useful for verifying which version or path of a library is being dynamically linked into a process. Following is an example of using the pldd command:

# pldd 1368
1368:   /usr/sbin/in.rlogind
/lib/libc.so.1
/lib/libsocket.so.1
/lib/libnsl.so.1
/lib/libbsm.so.1
/lib/libmd.so.1
/lib/libsecdb.so.1
/lib/libcmd.so.1

6.2.12 Process Tree: ptree

When a Unix process forks or initiates a new process, the forking process is called a parent process and the forked process is called a child process. This parent-child relationship can be displayed with the ptree command. When the ptree command is executed for a PID, it prints the process ancestry tree, that is, all the parents and children for this process, with child processes indented from their respective parent processes as shown below:

# ptree 1733
397   /usr/lib/inet/inetd start
  1731  /usr/sbin/in.rlogind
    1733  -sh
      1737  bash
        1761  ptree 1733

6.2.13 Process Stack: pstack

The pstack command can be used to print the stack trace of a running process. In case of a multi-threaded process, the stack trace of all the threads within a process will be displayed by default as shown below: The pstack command can be very helpful for debugging the process/thread hang issues. You can also print a specific thread's stack trace by supplying the thread-id (thread#) to the pstack command as shown below:

# pstack 1234
1234    ./proc_exp arg1 arg2 arg3
-----------------  lwp# 1 / thread# 1  --------------------
 fef74077 nanosleep (8047e10, 8047e18)
 080509e7 main     (4, 8047e60, 8047e74) + af
 080508a2 ???????? (4, 8047f10, 8047f1b, 8047f20, 8047f25, 0)
-----------------  lwp# 2 / thread# 2  --------------------
 fef74077 nanosleep (feeaefb0, feeaefb8)
 08050af2 sub_b     (0) + 1a
 fef73a81 _thr_setup (feda0200) + 4e
 fef73d70 _lwp_start (feda0200, 0, 0, feeaeff8, fef73d70, feda0200)
-----------------  lwp# 3 / thread# 3  --------------------
 fef74077 nanosleep (fed9efa8, fed9efb0)
 08050ac2 sub_a     (2) + ba
 fef73a81 _thr_setup (feda0a00) + 4e
 fef73d70 _lwp_start (feda0a00, 0, 0, fed9eff8, fef73d70, feda0a00)
-----------------  lwp# 4 / thread# 4  --------------------
 fef74ad7 lwp_wait (5, fec9ff8c)
 fef70ce7 _thrp_join (5, fec9ffc4, fec9ffc0, 1) + 5a
 fef70e29 thr_join (5, fec9ffc4, fec9ffc0) + 20
 08050d0d sub_d     (2) + a5
 fef73a81 _thr_setup (feda1200) + 4e
 fef73d70 _lwp_start (feda1200, 0, 0, fec9fff8, fef73d70, feda1200)
-----------------  lwp# 5 / thread# 5  --------------------
 fef74ad7 lwp_wait (3, feba0f94)
 fef70ce7 _thrp_join (3, feba0fcc, feba0fc8, 1) + 5a
 fef70e29 thr_join (3, feba0fcc, feba0fc8) + 20
 08050deb sub_e     (0) + 33
 fef73a81 _thr_setup (feda1a00) + 4e
 fef73d70 _lwp_start (feda1a00, 0, 0, feba0ff8, fef73d70, feda1a00)

The pstack command can be very helpful for debugging the process/thread hang issues. You can also print a speci.c thread's stack trace by supplying the thread-id (thread#) to the pstack command as shown below:

# pstack 1234/4
1234:   ./proc_exp arg1 arg2 arg3
-----------------  lwp# 4 / thread# 4  --------------------
 fef74ad7 lwp_wait (5, fec9ff8c)
 fef70ce7 _thrp_join (5, fec9ffc4, fec9ffc0, 1) + 5a
 fef70e29 thr_join (5, fec9ffc4, fec9ffc0) + 20
 08050d0d sub_d    (2) + a5
 fef73a81 _thr_setup (feda1200) + 4e
 fef73d70 _lwp_start (feda1200, 0, 0, fec9fff8, fef73d70, feda1200)

6.2.14 Tracing Process: truss

One of the most useful commands, truss, can be used to trace the system calls and signals made or received by a new or existing process. When used with -d flag, truss command prints a time stamp on each line of the trace output as shown below:

# truss -d date
Base time stamp:  1239816100.2290  [ Wed Apr 15 22:51:40 IST 2009 ]
 0.0000 execve("/usr/bin/date", 0x08047E78, 0x08047E80)  argc = 1
 0.0015 resolvepath("/usr/lib/ld.so.1", "/lib/ld.so.1", 1023) = 12
 0.0015 resolvepath("/usr/bin/date", "/usr/bin/date", 1023) = 13
 0.0016 sysconfig(_CONFIG_PAGESIZE)                     = 4096
 0.0016 xstat(2, "/usr/bin/date", 0x08047C58)            = 0
 0.0017 open("/var/ld/ld.config", O_RDONLY)              Err#2 ENOENT
 0.0017 mmap(0x00000000, 4096, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_ANON,
-1, 0) = 0xFEFF0000
 0.0018 xstat(2, "/lib/libc.so.1", 0x08047488)           = 0
 0.0018 resolvepath("/lib/libc.so.1", "/lib/libc.so.1", 1023) = 14
 0.0019 open("/lib/libc.so.1", O_RDONLY)                 = 3
 0.0020 mmap(0x00010000, 32768, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_ALIGN, 3, 0) =
0xFEFB0000
 0.0020 mmap(0x00010000, 876544, PROT_NONE, MAP_PRIVATE|MAP_NORESERVE|MAP_ANON|MAP_
ALIGN, -1, 0) = 0xFEED0000
 0.0020 mmap(0xFEED0000, 772221, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_TEXT,
3, 0) = 0xFEED0000
 0.0021 mmap(0xFEF9D000, 27239, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_INIT-
DATA, 3, 774144) = 0xFEF9D000
 0.0021 mmap(0xFEFA4000, 5392, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANON,
-1, 0) = 0xFEFA4000
 0.0021 munmap(0xFEF8D000, 65536)                        = 0
 0.0023 memcntl(0xFEED0000, 123472, MC_ADVISE, MADV_WILLNEED, 0, 0) = 0
 0.0023 close(3)                                         = 0
 0.0025 mmap(0x00010000, 24576, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_
ANON|MAP_ALIGN, -1, 0) = 0xFEF90000
 0.0026 munmap(0xFEFB0000, 32768)                        = 0
 0.0027 getcontext(0x08047A10)
 0.0027 getrlimit(RLIMIT_STACK, 0x08047A08)              = 0
 0.0027 getpid()                                         = 2532 [2531]
 0.0027 lwp_private(0, 1, 0xFEF92A00)                    = 0x000001C3
 0.0028 setustack(0xFEF92A60)
 0.0028 sysi86(SI86FPSTART, 0xFEFA4BC0, 0x0000133F, 0x00001F80) = 0x00000001
 0.0029 brk(0x08062ED0)                                  = 0
 0.0029 brk(0x08064ED0)                                  = 0
 0.0030 time()                                           = 1239816100
 0.0030 brk(0x08064ED0)                                  = 0
 0.0031 brk(0x08066ED0)                                  = 0
 0.0031 open("/usr/share/lib/zoneinfo/Asia/Calcutta", O_RDONLY) = 3
 0.0032 fstat64(3, 0x08047CC0)                           = 0
 0.0032 read(3, " T Z i f\0\0\0\0\0\0\0\0".., 109)       = 109
 0.0032 close(3)                                         = 0
 0.0033 ioctl(1, TCGETA, 0x08047CE4)                     = 0
 0.0034 fstat64(1, 0x08047C50)                           = 0
Wed Apr 15 22:51:40 IST 2009
 0.0034 write(1, " W e d   A p r   1 5   2".., 29)      = 29
 0.0035 _exit(0)

The truss command is very helpful in debugging the process hang and the core dump issues. It can also be used to see which system process is taking more time and what parameters are passed for each system call.

You can use -p flag to specify the PID of the process to be traced as shown below:

# truss -p 1234
/4:     lwp_wait(5, 0xFEC8EF8C)          (sleeping...)
/3:     nanosleep(0xFED8DFA8, 0xFED8DFB0) (sleeping...)
/2:     nanosleep(0xFEEAEFB0, 0xFEEAEFB8) (sleeping...)
/5:     lwp_wait(3, 0xFEB8FF94)          (sleeping...)
/1:     nanosleep(0x08047E10, 0x08047E18) (sleeping...)
/2:     nanosleep(0xFEEAEFB0, 0xFEEAEFB8)                = 0
/1:     nanosleep(0x08047E10, 0x08047E18)                = 0
/1:     write(1, " M a i n   T h r e a d  ".., 23)       = 23
/1:     lwp_sigmask(SIG_SETMASK, 0xFFBFFEFF, 0x0000FFF7) = 0xFFBFFEFF [0x0000FFFF]
/1:     lwp_exit()
/2:     write(1, " B :   T h r e a d   e x".., 21)       = 21
/2:     lwp_sigmask(SIG_SETMASK, 0xFFBFFEFF, 0x0000FFF7) = 0xFFBFFEFF [0x0000FFFF]
/2:     lwp_exit()
/3:     nanosleep(0xFED8DFA8, 0xFED8DFB0)                = 0
/3:     lwp_sigmask(SIG_SETMASK, 0xFFBFFEFF, 0x0000FFF7) = 0xFFBFFEFF [0x0000FFFF]
/3:     lwp_exit()
/5:     lwp_wait(3, 0xFEB8FF94)                          = 0
/5:     write(1, " E :   A   t h r e a d  ".., 48)       = 48
/5:     write(1, " E :   J o i n   B   t h".., 17)       = 17
/5:     lwp_wait(2, 0xFEB8FF94)                          = 0
/5:     write(1, " E :   B   t h r e a d  ".., 48)       = 48
/5:     write(1, " E :   J o i n   C   t h".., 17)       = 17
/5:     lwp_wait(0, 0xFEB8FF94)                          = 0
/5:     write(1, " E :   C   t h r e a d  ".., 47)       = 47
/5:     nanosleep(0xFEB8FFA8, 0xFEB8FFB0) (sleeping...)
/5:     nanosleep(0xFEB8FFA8, 0xFEB8FFB0)                = 0
/5:     write(1, " E :   T h r e a d   e x".., 21)       = 21
/5:     lwp_sigmask(SIG_SETMASK, 0xFFBFFEFF, 0x0000FFF7) = 0xFFBFFEFF [0x0000FFFF]
/5:     lwp_exit()
...

You can use the -t flag to specify the list of specific system calls you are interested in tracing. In the following example the user is interested in tracing only pread and pwrite system calls for the process having a PID of 2614:

# truss -tpread,pwrite -p 2614
pread(6, "\0\0\0\0\0\0\0\0\0\0\0\0".., 262144, 0xC9EC3400) = 262144
pwrite(6, "\0\0\0\0\0\0\0\0\0\0\0\0".., 262144, 0xC9F03400) = 262144
pread(6, "\0\0\0\0\0\0\0\0\0\0\0\0".., 262144, 0xC9F03400) = 262144
pwrite(6, "\0\0\0\0\0\0\0\0\0\0\0\0".., 262144, 0xC9F43400) = 262144
pread(6, "\0\0\0\0\0\0\0\0\0\0\0\0".., 262144, 0xC9F43400) = 262144
pwrite(6, "\0\0\0\0\0\0\0\0\0\0\0\0".., 262144, 0xC9F83400) = 262144
pread(6, "\0\0\0\0\0\0\0\0\0\0\0\0".., 262144, 0xC9F83400) = 262144
pwrite(6, "\0\0\0\0\0\0\0\0\0\0\0\0".., 262144, 0xC9FC3400) = 262144
pread(6, "\0\0\0\0\0\0\0\0\0\0\0\0".., 262144, 0xC9FC3400) = 262144
pwrite(6, "\0\0\0\0\0\0\0\0\0\0\0\0".., 262144, 0xCA003400) = 262144
pread(6, "\0\0\0\0\0\0\0\0\0\0\0\0".., 262144, 0xCA003400) = 262144
pwrite(6, "\0\0\0\0\0\0\0\0\0\0\0\0".., 262144, 0xCA043400) = 262144
pread(6, "\0\0\0\0\0\0\0\0\0\0\0\0".., 262144, 0xCA043400) = 262144
pwrite(6, "\0\0\0\0\0\0\0\0\0\0\0\0".., 262144, 0xCA083400) = 262144
pread(6, "\0\0\0\0\0\0\0\0\0\0\0\0".., 262144, 0xCA083400) = 262144
pwrite(6, "\0\0\0\0\0\0\0\0\0\0\0\0".., 262144, 0xCA0C3400) = 262144
pread(6, "\0\0\0\0\0\0\0\0\0\0\0\0".., 262144, 0xCA0C3400) = 262144
pwrite(6, "\0\0\0\0\0\0\0\0\0\0\0\0".., 262144, 0xCA103400) = 262144
pread(6, "\0\0\0\0\0\0\0\0\0\0\0\0".., 262144, 0xCA103400) = 262144
pwrite(6, "\0\0\0\0\0\0\0\0\0\0\0\0".., 262144, 0xCA143400) = 262144
pread(6, "\0\0\0\0\0\0\0\0\0\0\0\0".., 262144, 0xCA143400) = 262144
...

See the man pages for each of these commands for additional details.

  • + Share This
  • 🔖 Save To Your Account