.TH statsnoop 1m  "$Date:: 2007-09-23 #$" "USER COMMANDS"
.SH NAME
statsnoop \- snoop file stats as they occur. Uses DTrace.
.SH SYNOPSIS
.B statsnoop
[\-a|\-A|\-ceghsvxZ] [\-f pathname] [\-n name] [\-p PID]
.SH DESCRIPTION
statsnoop traces the stat variety of syscalls.
As a process issues a file stat, details
such as UID, PID and pathname are printed out. 

The returned file descriptor is printed,
a value of -1 indicates an error. This can be useful
for troubleshooting to determine if appliacions are attempting to
stat files that do not exist. 

Since this uses DTrace, only the root user or users with the
dtrace_kernel privilege can run this command.
.SH OS
Solaris
.SH STABILITY
stable - needs the syscall provider.
.SH OPTIONS
.TP
\-a
print all data
.TP
\-A
dump all data, space delimited
.TP
\-c
print current working directory of process
.TP
\-e
print errno value
.TP
\-g
print full command arguments
.TP
\-s
print start time, us
.TP
\-v
print start time, string
.TP
\-x
only print failed stats
.TP
\-Z
print zonename
.TP
\-f pathname
file pathname to snoop
.TP
\-n name
process name to snoop
.TP
\-p PID
process ID to snoop
.PP
.SH EXAMPLES
.TP
Default output, print file stats by process as they occur,
# 
.B statsnoop
.PP
.TP
Print human readable timestamps,
# 
.B statsnoop
\-v 
.PP
.TP
See error codes,
#
.B statsnoop
\-e
.PP
.TP
Snoop this file only,
#
.B statsnoop
\-f /etc/passwd
.PP
.SH FIELDS
.TP
ZONE
Zone name
.TP
UID
User ID
.TP
PID
Process ID
.TP
PPID
Parent Process ID
.TP
FD
File Descriptor (-1 is error)
.TP
ERR
errno value (see /usr/include/sys/errno.h)
.TP
CWD
current working directory of process
.TP
PATH
pathname for file stat
.TP
COMM
command name for the process
.TP
ARGS
argument listing for the process
.TP
TIME
timestamp for the stat event, us
.TP
STRTIME
timestamp for the stat event, string
.SH DOCUMENTATION
See the DTraceToolkit for further documentation under the 
Docs directory. The DTraceToolkit docs may include full worked
examples with verbose descriptions explaining the output.
.SH EXIT
statsnoop will run forever until Ctrl\-C is hit. 
.SH BUGS
occasionally the pathname for the file stat cannot be read
and the following error will be seen,

dtrace: error on enabled probe ID 6 (...): invalid address

this is normal behaviour.
.SH AUTHOR
Brendan Gregg
[Sydney, Australia]
.SH SEE ALSO
dtrace(1M), truss(1)