Examples from www.dtracebook.com

[hiren panchasara]

On Tue, Dec 10, 2013 at 3:47 PM, David Wolfskill <david at catwhisker.org> wrote:
> On Tue, Dec 10, 2013 at 03:43:16PM -0800, hiren panchasara wrote:
>> http://www.dtracebook.com/index.php/Introduction_to_DTrace:read-syscall.d
>>
>> $ sudo dtrace -n 'syscall::read:entry /execname != "dtrace"/ {
>> @reads[execname, fds[arg0].fi_pathname] = count(); }'
>> dtrace: invalid probe specifier syscall::read:entry /execname !=
>> "dtrace"/ { @reads[execname, fds[arg0].fi_pathname] = count(); }: in
>> action list: fds has not yet been declared or assigned
>>
>> This is on FreeBSD -head.
>>
>>
>> $ sudo dtrace -l | grep " read entry"
>> 49341    syscall         freebsd32                              read entry
>> 50413    syscall           freebsd                              read entry
>>
>> What am I missing? What does "invalid probe specifier " mean here?
>> ....
>
> Exactly what the message says: "fds has not yet been declared or
> assigned".  We don't presently have the fds array -- see p. 131 of the
> book.

Ah, thanks David :-)

$ sudo dtrace -n 'syscall::read:entry /execname != "dtrace"/ {
@reads[execname] = count(); }'
dtrace: description 'syscall::read:entry ' matched 2 probes
^C

  devd                                                              1
  stty                                                              2
  sendmail                                                          7
  top                                                              10
  bash                                                             54
  sshd                                                            297
  grep                                                           5856


First column is proc name and second one is number of read(2) calls.

cheers,
Hiren

ps: I will keep posting here as I find something that I do not understand.