1 .TH statsnoop 1m "$Date:: 2007-09-23 #$" "USER COMMANDS"
3 statsnoop \- snoop file stats as they occur. Uses DTrace.
6 [\-a|\-A|\-ceghsvxZ] [\-f pathname] [\-n name] [\-p PID]
8 statsnoop traces the stat variety of syscalls.
9 As a process issues a file stat, details
10 such as UID, PID and pathname are printed out.
12 The returned file descriptor is printed,
13 a value of -1 indicates an error. This can be useful
14 for troubleshooting to determine if appliacions are attempting to
15 stat files that do not exist.
17 Since this uses DTrace, only the root user or users with the
18 dtrace_kernel privilege can run this command.
22 stable - needs the syscall provider.
29 dump all data, space delimited
32 print current working directory of process
38 print full command arguments
44 print start time, string
47 only print failed stats
53 file pathname to snoop
63 Default output, print file stats by process as they occur,
68 Print human readable timestamps,
100 File Descriptor (-1 is error)
103 errno value (see /usr/include/sys/errno.h)
106 current working directory of process
109 pathname for file stat
112 command name for the process
115 argument listing for the process
118 timestamp for the stat event, us
121 timestamp for the stat event, string
123 See the DTraceToolkit for further documentation under the
124 Docs directory. The DTraceToolkit docs may include full worked
125 examples with verbose descriptions explaining the output.
127 statsnoop will run forever until Ctrl\-C is hit.
129 occasionally the pathname for the file stat cannot be read
130 and the following error will be seen,
132 dtrace: error on enabled probe ID 6 (...): invalid address
134 this is normal behaviour.