Date: Mon, 3 May 2010 16:39:36 -0500 From: Dan Nelson <dnelson@allantgroup.com> To: Dan McNulty <dkmcnulty@gmail.com> Cc: freebsd-questions@freebsd.org Subject: Re: Finding out when a child process forks or calls exec Message-ID: <20100503213936.GL14572@dan.emsphone.com> In-Reply-To: <i2i1efdac3e1005031339zb359cc7bseca1556bf80615@mail.gmail.com> References: <i2i1efdac3e1005031339zb359cc7bseca1556bf80615@mail.gmail.com>
next in thread | previous in thread | raw e-mail | index | archive | help
In the last episode (May 03), Dan McNulty said: > I am trying to port a debugging tool that uses the ptrace interface from > Linux to FreeBSD. From what I can tell, the ptrace interface on FreeBSD > is pretty similar to the Linux interface; however, it doesn't appear that > the FreeBSD interface generate events when the child process forks, calls > exec, creates a new LWP, etc. My question then is: > > Does FreeBSD provide any way to determine from a parent/tracing > process if a child process has called fork, exec, exit, or created a > new LWP? /usr/bin/truss watches for syscalls named "fork", "rfork", and "vfork", and when they return it forks another copy of itself to watch the child. See /usr/src/usr.bin/truss/i386-fbsd.c and main.c (search for "in_fork"). You can tell when a new lwp is created because lwpid changes. In setup.c the waitevent() function calls ptrace(PT_LWPINFO...) on every syscall entry/exit so it's easy to track; it then calls the find_thread() function which allocates a new helper struct every time a new lwp appears. -- Dan Nelson dnelson@allantgroup.com
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20100503213936.GL14572>