trace Daemon

Purpose

Records selected system events.

Syntax

trace [  -a [  -g ] ] [  -f |  -l ] [ -b |  -B] [ -c] [ -C [ CPUList | all ]] [  -d ] [ -e string-cmd ] [  -h ] [ -j EventList ] [ -k  EventgroupList ] [ -J EventgroupList ] [ -K EventgroupList ] [  -m Message ]  [ -M ] [ -N ] [  -n ] [  -o Name ] [  -o- ] [  -p ] [ -r reglist ] [  -s ] [ -A ProcessIDList ] [ -t ThreadIDList ] [ -x program-specification | -X program-specification ] [ -I ] [ -P trace-propagation ][  -L Size ] [  -T Size ] [ -W ] [ -@ WparList ]

Description

The trace daemon configures a trace session and starts the collection of system events. The data collected by the trace function is recorded in the trace log. A report from the trace log can be generated with the trcrpt command.

When invoked with the -a, -x, or -X flags, the trace daemon is run asynchronously (for example, as a background task). Otherwise, it is run interactively and prompts you for subcommands.

To put the WPARconfigured ID (CID) in the trace hooks, use the -W flag.

To trace specific WPAR, use the -@ flag with a list of WPAR names that you want to trace.

You can use the System Management Interface Tool (SMIT) to run the trace daemon. To use SMIT, enter:

smit trace

The following are modes of trace data collection:

You can elect to trace only selected processes or threads. You can also trace a single program. You can specify whether the trace is to be propagated or extended to newly created processes or threads. You can optionally include interrupt events in such traces. This is only valid for trace channel 0.

Flags

106 DISPATCH
10C DISPATCH IDLE PROCESS
134 EXEC SYSTEM CALL
139 FORK SYSTEM CALL
465 KTHREAD CREATE

Subcommands

When run interactively, trace recognizes the following subcommands:

Signals

The INTERRUPT signal acts as a toggle to start and stop the collection of trace data. Interruptions are set to SIG_IGN for the traced process.

Security

Examples

1. To use trace interactively, enter trace, (the > prompt is displayed), then specify the subcommands you want. For example, to trace system events during the run of the anycmd command, enter:

   trace
   > !anycmd
   > q

2. To avoid delays when the command finishes, start trace asynchronously ( -a), using only one command line, enter:

   trace -a; anycmd; trcstop

3. To trace the system itself for a period of 10 seconds, enter:

   trace -a; sleep 10; trcstop

4. To output trace data to a specific trace log file (instead of the /var/adm/ras/trcfile default trace log file), :

   trace -a -o /tmp/my_trace_log; anycmd; trcstop

5. To capture the execution of a cp command, excluding specific events from the collection process:

   trace -a -k "20e,20f" -x "cp /bin/track /tmp/junk"

   In the example above, the -k option suppresses the collection of events from the lockl and unlockl functions (20e and 20f events).

   Also notice that the -x flag was used, so only hooks associated with the cp command process will be traced, and no interrupt activity will be traced.

6. To trace hook 234 and the hooks that will allow you to see the process names, use:

   trace -a -j 234 -J tidhk

   This traces the hooks in the event-group "tidhk" plus hook 234.
7. To have trace use one set of buffers per processor, specify:

   trace -aC all

   The files produced are /var/adm/ras/trcfile, /var/adm/ras/trcfile-0, /var/adm/ras/trcfile-1, etc. up to /var/adm/ras/trcfile-(n-1), where n is the number of procssors in the system.

   Tip: trace -aCall -o mylog produces the files mylog, mylog-0, mylog-1, ...
8. To trace a program that starts a daemon process, and to continue tracing the daemon after the original program has finished, use

   trace -X "mydaemon"

   The trace must be stopped with trcstop.
9. To trace mydaemon, which is currently running, use:

   trace -A mydaemon-process-id -Pp

   Where mydaemon-process-id is the process for mydaemon as returned by the ps command. The -Pp flag tells trace to also trace any processes and threads created by mydaemon while the trace is running.
10. To capture the PURR, and PMC1 and PMC2, type:

    trace -ar "PURR PMC1 PMC2"

11. To trace hooks 1A00,1A10,...,1AF0, DCA0 and 1AB1, enter:

    trace -aj 1A,DCA,1AB1 

Files