Examples from www.dtracebook.com

[hiren panchasara]

On Tue, Dec 10, 2013 at 5:00 PM, Mark Johnston <markj at freebsd.org> wrote:
> On Tue, Dec 10, 2013 at 04:54:36PM -0800, hiren panchasara wrote:
>> On Tue, Dec 10, 2013 at 4:32 PM, Mark Johnston <markj at freebsd.org> wrote:
>> > On Tue, Dec 10, 2013 at 04:26:54PM -0800, hiren panchasara wrote:
>> >> $ sudo dtrace -n 'proc:::exec-success { trace(curpsinfo->pr_psargs); }'
>> >> dtrace: description 'proc:::exec-success ' matched 1 probe
>> >> CPU     ID                    FUNCTION:NAME
>> >>   5  48876                    :exec-success   /bin/sh /usr/bin/man ls
>> >>   2  48876                    :exec-success   /sbin/sysctl -n hw.machine_arch
>> >>   6  48876                    :exec-success   /sbin/sysctl -n hw.machine
>> >>   0  48876                    :exec-success   /usr/bin/locale
>> >>   7  48876                    :exec-success   /usr/bin/zcat
>> >> /usr/share/man/man1/ls.1.gz
>> >>   2  48876                    :exec-success   head -1
>> >>   1  48876                    :exec-success   tbl
>> >>   6  48876                    :exec-success   groff -S -P-h -Wall
>> >> -mtty-char -man -Tascii -P-c
>> >>   7  48876                    :exec-success   /usr/bin/zcat
>> >> /usr/share/man/man1/ls.1.gz
>> >>   3  48876                    :exec-success   less
>> >>   3  48876                    :exec-success   troff -Wall -mtty-char
>> >> -man -Tascii
>> >>   7  48876                    :exec-success   grotty -h -c
>> >>
>> >>
>> >>   6  48876                    :exec-success   top
>> >>   7  48876                    :exec-success   ps awwux
>> >>   7  48876                    :exec-success   iostat
>> >>   5  48876                    :exec-success   vmstat 1
>> >>   4  48876                    :exec-success   bash
>> >>   4  48876                    :exec-success   whois
>> >>   5  48876                    :exec-success   whoami
>> >>   4  48876                    :exec-success   devinfo
>> >>   4  48876                    :exec-success   dmesg
>> >>   6  48876                    :exec-success   pciconf -lv
>> >>
>> >> I am getting interesting info only when "man" is executed and not for
>> >> any other command. What does that tell me? How is man special? Other
>> >> programs must also be doing exec(2), no?
>> >
>> > /usr/bin/man is a shell script. You'll see similar output for any
>> > executable that starts with a shebang.
>>
>> Thanks Mark for responding but that doesn't seem true.
>>
>> I tried apropos(1) without luck.
>
> I get the following with "apropos dtrace":
>
> mark at raichu: ~ $ sudo dtrace -n 'proc:::exec-success {trace(curpsinfo->pr_psargs);}'
> Password:
> dtrace: description 'proc:::exec-success ' matched 1 probe
> CPU     ID                    FUNCTION:NAME
>  4  35852                    :exec-success   /bin/sh /usr/bin/apropos dtrace
>  2  35852                    :exec-success   grep -Ehi -- dtrace /usr/share/man/whatis /usr/local/man/whatis /usr/share/openssl/man/whatis /usr/local/lib/perl5/5.14/man/whatis /usr/local/lib/perl5/5.14/perl/man/whatis
>  2  35852                    :exec-success   /usr/bin/less -i
>
> I don't really know what you mean by "interesting info." The other
> programs you ran (whoami, pciconf, dmesg, devinfo) above don't call
> execv().

My bad. I am now seeing the o/p what you are seeing above.

"interesting info" == exec calls :p

Thanks a lot,
Hiren