KTRACE(1) BSD Reference Manual KTRACE(1) NNAAMMEE kkttrraaccee - enable kernel process tracing SSYYNNOOPPSSIISS kkttrraaccee [--aaCCccddii] [--ff _t_r_f_i_l_e] [--gg _p_g_r_p] [--pp _p_i_d] [--tt _t_r_s_t_r] kkttrraaccee [--aaddii] [--ff _t_r_f_i_l_e] [--tt _t_r_s_t_r] command DDEESSCCRRIIPPTTIIOONN KKttrraaccee enables kernel trace logging for the specified processes. Kernel trace data is logged to the file _k_t_r_a_c_e_._o_u_t. The kernel operations that are traced include system calls, namei translations, signal processing, and I/O. Once tracing is enabled on a process, trace data will be logged until ei- ther the process exits or the trace point is cleared. A traced process can generate enormous amounts of log data quickly; It is strongly sug- gested that users memorize how to disable tracing before attempting to trace a process. The following command is sufficient to disable tracing on all user owned processes, and, if executed by root, all processes: $ trace -C The trace file is not human readable; use kdump(1) to decode it. The options are as follows: --aa Append to the trace file instead of truncating it. --CC Disable tracing on all user owned processes, and, if executed by root, all processes in the system. --cc Clear the trace points associated with the specified file or pro- cesses. --dd Descendants; perform the operation for all current children of the designated processes. --ff _f_i_l_e Log trace records to _f_i_l_e instead of _k_t_r_a_c_e_._o_u_t. --gg _p_g_i_d Enable (disable) tracing on all processes in the process group (only one --gg flag is permitted). --ii Inherit; pass the trace flags to all future children of the des- ignated processes. --pp _p_i_d Enable (disable) tracing on the indicated process id (only one --pp flag is permitted). --tt _t_r_s_t_r The string argument represents the kernel trace points, one per letter. The following table equates the letters with the trace- points: cc trace system calls nn trace namei translations ii trace I/O ss trace signal processing _c_o_m_m_a_n_d Execute _c_o_m_m_a_n_d with the specified trace flags. The --pp, --gg, and _c_o_m_m_a_n_d options are mutually exclusive. EEXXAAMMPPLLEESS # trace all kernel operations of process id 34 $ ktrace -p 34 # trace all kernel operations of processes in process group 15 and # pass the trace flags to all current and future children $ ktrace -idg 15 # disable all tracing of process 65 $ ktrace -cp 65 # disable tracing signals on process 70 and all current children $ ktrace -t s -cdp 70 # enable tracing of I/O on process 67 $ ktrace -ti -p 67 # run the command "w", tracing only system calls $ ktrace -tc w # disable all tracing to the file "tracedata" $ ktrace -c -f tracedata # disable tracing of all processes owned by the user $ ktrace -C SSEEEE AALLSSOO kdump(1) HHIISSTTOORRYY The kkttrraaccee command appears in 4.4BSD. 4.4BSD June 6, 1993 2