Karim Vaes

DTrace
DTrace is a comprehensive dynamic tracing framework for the Solaris Operating Environment. DTrace provides a powerful infrastructure to permit administrators, developers, and service personnel to concisely answer arbitrary questions about the behavior of the operating system and user programs.

I’ve been using the “execsnoop”-script (from brendangregg.com) today, and it’s been proving to be a very useful script.

execsnoop is a program to snoop process activity. As processes are executed on the server their details are printed out. Another user was logged in running a few commands which can be seen below. This is especially useful in troubleshooting short lived processes that are otherwise hard to spot. More examples.

# execsnoop
UID PID PPID CMD
100 3008 2656 ls
100 3009 2656 ls -l
100 3010 2656 cat /etc/passwd
100 3011 2656 vi /etc/hosts
100 3012 2656 date
100 3013 2656 ls -l
100 3014 2656 ls
100 3015 2656 finger
[...]

* Execsnoop has options to add the date and time (-v), or watch a particular command (-c command).
* Standalone execsnoop.d is the original DTrace only version..

Links
Guide
Howto
Scripts @ brendangregg.com (TIP)
Scripts @ Opensolaris.org
Scripts @ SolarisInternals.com