1 #!/usr/bin/ksh 2 # 3 # lastwords - print last few syscalls for dying processes. 4 # Written using DTrace (Solaris 10 3/05). 5 # 6 # $Id: lastwords,v 1.1.1.1 2015/09/30 22:01:06 christos Exp $ 7 # 8 # This prints the last few system calls for processes matching 9 # the given name, when they exit. This makes use of a ring buffer 10 # so that the impact on the system is minimised. 11 # 12 # USAGE: lastwords command 13 # eg, 14 # lastwords netscape 15 # 16 # FIELDS: 17 # TIME Time of syscall return, ns 18 # PID Process ID 19 # EXEC Process name (execname) 20 # SYSCALL System call 21 # RETURN Return value for system call 22 # ERR errno for system call 23 # 24 # BASED ON: /usr/demo/dtrace/ring.d 25 # 26 # SEE ALSO: DTrace Guide "Buffers and Buffering" chapter (docs.sun.com) 27 # dtruss (DTraceToolkit) 28 # 29 # PORTIONS: Copyright (c) 2005, 2006 Brendan Gregg. 30 # 31 # CDDL HEADER START 32 # 33 # The contents of this file are subject to the terms of the 34 # Common Development and Distribution License, Version 1.0 only 35 # (the "License"). You may not use this file except in compliance 36 # with the License. 37 # 38 # You can obtain a copy of the license at Docs/cddl1.txt 39 # or http://www.opensolaris.org/os/licensing. 40 # See the License for the specific language governing permissions 41 # and limitations under the License. 42 # 43 # CDDL HEADER END 44 # 45 # 09-Jun-2005 Brendan Gregg Created this. 46 # 20-Apr-2006 " " Last update. 47 # 48 49 ### Usage 50 function usage 51 { 52 cat <<-END >&2 53 USAGE: lastwords command 54 eg, 55 lastwords netscape 56 END 57 exit 1 58 } 59 60 ### Process arguments 61 if (( $# != 1 )); then 62 usage 63 fi 64 command=$1 65 66 print "Tracing... Waiting for $command to exit..." 67 68 ### Run DTrace 69 /usr/sbin/dtrace -n ' 70 #pragma D option quiet 71 #pragma D option bufpolicy=ring 72 #pragma D option bufsize=16k 73 74 syscall:::return 75 /execname == $$1/ 76 { 77 /* buffer syscall details */ 78 printf("%-18d %5d %12s %12s %10x %3d\n", 79 timestamp,pid,execname,probefunc,(int)arg0,errno); 80 } 81 82 proc::proc_exit:exit 83 /execname == $$1/ 84 { 85 /* print, erm, footer */ 86 printf("%-18s %5s %12s %12s %10s %3s\n", 87 "TIME","PID","EXEC","SYSCALL","RETURN","ERR"); 88 exit(0); 89 } 90 ' "$command" 91