Permalink
| Demonstrations of opensnoop, the Linux ftrace version. | |
| # ./opensnoop | |
| Tracing open()s. Ctrl-C to end. | |
| COMM PID FD FILE | |
| opensnoop 5334 0x3 | |
| <...> 5343 0x3 /etc/ld.so.cache | |
| opensnoop 5342 0x3 /etc/ld.so.cache | |
| <...> 5343 0x3 /lib/x86_64-linux-gnu/libc.so.6 | |
| opensnoop 5342 0x3 /lib/x86_64-linux-gnu/libm.so.6 | |
| opensnoop 5342 0x3 /lib/x86_64-linux-gnu/libc.so.6 | |
| <...> 5343 0x3 /usr/lib/locale/locale-archive | |
| <...> 5343 0x3 trace_pipe | |
| supervise 1684 0x9 supervise/status.new | |
| supervise 1684 0x9 supervise/status.new | |
| supervise 1688 0x9 supervise/status.new | |
| supervise 1688 0x9 supervise/status.new | |
| supervise 1686 0x9 supervise/status.new | |
| supervise 1685 0x9 supervise/status.new | |
| supervise 1685 0x9 supervise/status.new | |
| supervise 1686 0x9 supervise/status.new | |
| [...] | |
| The first several lines show opensnoop catching itself initializing. | |
| Use -h to print the USAGE message: | |
| # ./opensnoop -h | |
| USAGE: opensnoop [-htx] [-d secs] [-p PID] [-n name] [filename] | |
| -d seconds # trace duration, and use buffers | |
| -n name # process name to match on I/O issue | |
| -p PID # PID to match on I/O issue | |
| -t # include time (seconds) | |
| -x # only show failed opens | |
| -h # this usage message | |
| filename # match filename (partials, REs, ok) | |
| eg, | |
| opensnoop # watch open()s live (unbuffered) | |
| opensnoop -d 1 # trace 1 sec (buffered) | |
| opensnoop -p 181 # trace I/O issued by PID 181 only | |
| opensnoop conf # trace filenames containing "conf" | |
| opensnoop 'log$' # filenames ending in "log" | |
| See the man page and example file for more info. |