1/*===- ptreetime.dtrace ---------------------------------------------------=== 2 * 3 * This source file is part of the Swift.org open source project 4 * 5 * Copyright (c) 2017 Apple Inc. and the Swift project authors 6 * Licensed under Apache License v2.0 with Runtime Library Exception 7 * 8 * See http://swift.org/LICENSE.txt for license information 9 * See http://swift.org/CONTRIBUTORS.txt for the list of Swift project authors 10 * 11 *===----------------------------------------------------------------------===*/ 12 13/* DTrace module for use with `ptreetime`. 14 * 15 * This dtrace module adds probes on the kernel process creation and exit 16 * events, in order to precisely track an entire process tree. 17 * 18 * By itself, the events generated by this module can only be used to determine 19 * the wall time a process used and the name of the primary executable. However, 20 * in conjunction with the ``ptreetime_interpose`` dylib, the events can be 21 * combined to gather information about the exact command lines that were 22 * executed, the process resource usage (user and CPU times), and the wall times 23 * of additional events (like the time between when the kernel created the 24 * process and when the processes' first user constructor ran). 25 */ 26 27#pragma D option quiet 28 29dtrace:::BEGIN { 30 printf("PTREETIME { \"ts\" : %d, \"evt\" : \"%-14s\", ", 31 walltimestamp/1000, "START"); 32 printf("\"target\" : %d }\n", $target); 33} 34 35proc:::create { 36 printf("PTREETIME { \"ts\" : %d, \"evt\" : \"%-14s\", ", 37 walltimestamp/1000, "proc:::create"); 38 printf("\"pid\" : %d, \"parent\" : %d }\n", 39 ((struct proc*) arg0)->p_pid, ((struct proc*) arg0)->p_ppid); 40} 41 42proc:::exit { 43 printf("PTREETIME { \"ts\" : %d, \"evt\" : \"%-14s\", ", 44 walltimestamp/1000, "proc:::exit"); 45 printf("\"pid\" : %d, \"parent\" : %d, \"name\" : \"%s\" }\n", 46 curproc->p_pid, curproc->p_ppid, curproc->p_comm); 47} 48 49dtrace:::END { 50 printf("PTREETIME { \"ts\" : %d, \"evt\" : \"%-14s\" }\n", 51 walltimestamp/1000, "END"); 52} 53