NAME
ktrace – enable kernel process tracing
SYNOPSIS
ktrace [-aCcdi] [-f trfile] [-g pgid] [-p pid] [-t trstr]
ktrace [-aBdiT] [-f trfile] [-t trstr] command
DESCRIPTION
ktrace enables kernel trace logging for the specified processes. By default, kernel trace data is logged to the file ktrace.out, unless overridden by the -f option. The kernel operations traced are system calls, namei translations, signal processing and I/O.
Once tracing is enabled on a process, trace data will be logged until either the process exits or the trace point is cleared. A traced process can generate enormous amounts of log data quickly; it is strongly suggested that users memorize how to disable tracing before attempting to trace a process. The following command is sufficient to disable tracing on all user owned processes and, if executed by root, all processes:
$ ktrace -C
The trace file is not human-readable; use kdump(1) to decode it.
The options are as follows:
- -a
-
Append to the trace file instead of recreating it.
- -B
-
Set the LD_BIND_NOW environment variable to specify that the dynamic linker should process relocations immediately instead of as they are encountered. This eliminates the resulting ld.so(1) relocation sequences.
- -C
-
Disable tracing on all user owned processes and, if executed by root, all processes in the system.
- -c
-
Clear the trace points associated with the trace file or any specified processes.
- -d
-
Descendants; perform the operation for all current children of the designated processes.
- -f trfile
-
Log trace records to trfile instead of ktrace.out.
- -g pgid
-
Enable (disable) tracing on all processes in the process group (only one -g flag is permitted).
- -i
-
Inherit; pass the trace flags to all future children of the designated processes.
- -p pid
-
Enable (disable) tracing on the indicated process ID (only one -p flag is permitted).
- -T
-
Disable userland timekeeping, making time related system calls more prevalent.
- -t trstr
-
Select which information to put into the dump file. The argument can contain one or more of the following letters. By default all trace points except for X are enabled.
- c
-
trace system calls
- i
-
trace I/O
- n
-
trace namei translations
- p
-
trace violation of pledge(2) restrictions
- s
-
trace signal processing
- S
-
trace violation of pinsyscalls(2)
- t
-
trace various structures
- u
-
trace user data coming from utrace(2)
- x
-
trace argument vector in execve(2)
- X
-
trace environment in execve(2)
- +
-
trace the default points
- command
-
Execute command with the specified trace flags.
The -p, -g, and command options are mutually exclusive.
FILES
- ktrace.out
-
default ktrace dump file
EXAMPLES
Trace all kernel operations of process ID 34:
$ ktrace -p 34
Trace all kernel operations of processes in process group 15 and pass the trace flags to all current and future children:
$ ktrace -idg 15
Disable all tracing of process 65:
$ ktrace -cp 65
Disable tracing signals on process 70 and all current children:
$ ktrace -t s -cdp 70
Enable tracing of I/O on process 67:
$ ktrace -ti -p 67
Run the command w(1), tracing only system calls:
$ ktrace -tc w
Disable all tracing to the file "tracedata":
$ ktrace -c -f tracedata
Disable tracing of all processes owned by the user:
$ ktrace -C
SEE ALSO
HISTORY
The ktrace command appeared in 4.3BSD-Reno.