From owner-freebsd-hackers@FreeBSD.ORG  Mon May 17 19:28:49 2010
Return-Path: <owner-freebsd-hackers@FreeBSD.ORG>
Delivered-To: freebsd-hackers@freebsd.org
Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34])
	by hub.freebsd.org (Postfix) with ESMTP id C931F1065676
	for <freebsd-hackers@freebsd.org>; Mon, 17 May 2010 19:28:49 +0000 (UTC)
	(envelope-from fergleiser@yahoo.com)
Received: from web31706.mail.mud.yahoo.com (web31706.mail.mud.yahoo.com
	[68.142.201.186])
	by mx1.freebsd.org (Postfix) with SMTP id 86EB18FC1C
	for <freebsd-hackers@freebsd.org>; Mon, 17 May 2010 19:28:49 +0000 (UTC)
Received: (qmail 28840 invoked by uid 60001); 17 May 2010 19:28:49 -0000
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=yahoo.com; s=s1024;
	t=1274124529; bh=lmdfgnil7frSk4W8pUXi8Ir+ntBu7zHOnuvuHg4Axgg=;
	h=Message-ID:X-YMail-OSG:Received:X-Mailer:References:Date:From:Subject:To:In-Reply-To:MIME-Version:Content-Type;
	b=oCmXw1iMptYLrysc3eRyN4xRYaNgPjFNk+n7lPaNJLehdeIc0pr3V1g8tu/TyiqAXWtEgA4zN6Qgqr8djeDSMDt7d03tTFM58WQAmTRezhztRE8R+4/ZVGGMx5IRtq8eO/6gJ8lZ3ygtZTJlDVBTCfj833p5cLTt3IfUkm2H/zw=
DomainKey-Signature: a=rsa-sha1; q=dns; c=nofws; s=s1024; d=yahoo.com;
	h=Message-ID:X-YMail-OSG:Received:X-Mailer:References:Date:From:Subject:To:In-Reply-To:MIME-Version:Content-Type;
	b=1vXfoHNRbhXEKyfL6BGJ7gEOs+ki+Wd2t8p5UPB0ay1xi8FX3zeXIC5X9GDztur6GIOHCiyh9HssR0nRX5qcvvneVoyC8fnla1cvc7G4Gj+XCNpzFTuvY+D/G4/Ns2iBUWaGuIqvmnPK2/x6pI1OEaJ4GnA8n68ON0dTZbHEIHM=;
Message-ID: <167913.27782.qm@web31706.mail.mud.yahoo.com>
X-YMail-OSG: qOjWeIkVM1kBU2icC4SXKUrPVFiHmOrEqIBtAKZj2kU4Fna
	Ra7vXwAHPsViZY2xe7jPUxbiEPpzqv29iiwR_ceiPTkwJy5DKaMuYJ4IwTZ4
	WMypV22a6uugEhbbKUfkDIBdsVICnanreEgoIBcyC6510kJvWGn3.2RJ5HmA
	fheT3SeiSZxqvn7RmN29Ky7BpV3CwW5TV6Sa8DkPN7r04dPJsMrYfCnq3Mc8
	_pkWoiwFHdaclTy0p5oStSZWhHL2D0HqIeRIQFwrmIvXtyaDWIkGNSxPhyKM
	vWvuPEal3bbqJw_zDa00maBla.2TxtUegDXNM.U1P3ba2ZlxFai1pJ6VkzWJ 75SY-
Received: from [186.109.140.158] by web31706.mail.mud.yahoo.com via HTTP;
	Mon, 17 May 2010 12:28:49 PDT
X-Mailer: YahooMailRC/374.4 YahooMailWebService/0.8.103.269680
References: <AANLkTinO0hqywG7sCWJYXTsayOtad2qnP1SPDn6NzCYm@mail.gmail.com>
Date: Mon, 17 May 2010 12:28:49 -0700 (PDT)
From: Fernando Gleiser <fergleiser@yahoo.com>
To: Dan McNulty <dkmcnulty@gmail.com>, freebsd-hackers@freebsd.org
In-Reply-To: <AANLkTinO0hqywG7sCWJYXTsayOtad2qnP1SPDn6NzCYm@mail.gmail.com>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Cc: 
Subject: Re: Efficient way to determine when a child process forks or calls
	exec
X-BeenThere: freebsd-hackers@freebsd.org
X-Mailman-Version: 2.1.5
Precedence: list
List-Id: Technical Discussions relating to FreeBSD
	<freebsd-hackers.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-hackers>, 
	<mailto:freebsd-hackers-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-hackers>
List-Post: <mailto:freebsd-hackers@freebsd.org>
List-Help: <mailto:freebsd-hackers-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-hackers>,
	<mailto:freebsd-hackers-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Mon, 17 May 2010 19:28:49 -0000





----- Original Message ----
> From: Dan McNulty <dkmcnulty@gmail.com>
> To: freebsd-hackers@freebsd.org
> Sent: Mon, May 17, 2010 11:33:31 AM
> Subject: Efficient way to determine when a child process forks or calls exec
> 
> Hi all,
>I have been experimenting with ptrace to determine when a 
> child process forks or calls exec. Particularly, I have explored 
> tracing every system call entry and exit similar to what the truss 
> utility does, and for my case, the performance impact of tracing every 
> system call is too great.

> Is there a more efficient way than tracing 
> every system call entry and exit to determine when a child process forks, 
> calls exec, or creates a new LWP?

You can do that very easily with DTrace's syscall provider

#!/usr/sbin/dtrace -s

syscall::fork:entry
{
           self->traceme=1;
}
syscall::exec*:entry
/self->traceme/
{
     printf("pid %d has called %s\n", pid, probefunc);
     self->traceme=0;
}



Hope that helps
}


Thanks a lot for your 
> help!
-Dan
_______________________________________________

> ymailto="mailto:freebsd-hackers@freebsd.org" 
> href="mailto:freebsd-hackers@freebsd.org">freebsd-hackers@freebsd.org 
> mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-hackers
To 
> unsubscribe, send any mail to "
> ymailto="mailto:freebsd-hackers-unsubscribe@freebsd.org" 
> href="mailto:freebsd-hackers-unsubscribe@freebsd.org">freebsd-hackers-unsubscribe@freebsd.org"