1/*===- ptreetime.dtrace ---------------------------------------------------===
2 *
3 * This source file is part of the Swift.org open source project
4 *
5 * Copyright (c) 2017 Apple Inc. and the Swift project authors
6 * Licensed under Apache License v2.0 with Runtime Library Exception
7 *
8 * See http://swift.org/LICENSE.txt for license information
9 * See http://swift.org/CONTRIBUTORS.txt for the list of Swift project authors
10 *
11 *===----------------------------------------------------------------------===*/
12
13/* DTrace module for use with `ptreetime`.
14 *
15 * This dtrace module adds probes on the kernel process creation and exit
16 * events, in order to precisely track an entire process tree.
17 *
18 * By itself, the events generated by this module can only be used to determine
19 * the wall time a process used and the name of the primary executable. However,
20 * in conjunction with the ``ptreetime_interpose`` dylib, the events can be
21 * combined to gather information about the exact command lines that were
22 * executed, the process resource usage (user and CPU times), and the wall times
23 * of additional events (like the time between when the kernel created the
24 * process and when the processes' first user constructor ran).
25 */
26
27#pragma D option quiet
28
29dtrace:::BEGIN {
30  printf("PTREETIME { \"ts\" : %d, \"evt\" : \"%-14s\", ",
31         walltimestamp/1000, "START");
32  printf("\"target\" : %d }\n", $target);
33}
34
35proc:::create {
36  printf("PTREETIME { \"ts\" : %d, \"evt\" : \"%-14s\", ",
37         walltimestamp/1000, "proc:::create");
38  printf("\"pid\" : %d, \"parent\" : %d }\n",
39         ((struct proc*) arg0)->p_pid, ((struct proc*) arg0)->p_ppid);
40}
41
42proc:::exit {
43  printf("PTREETIME { \"ts\" : %d, \"evt\" : \"%-14s\", ",
44         walltimestamp/1000, "proc:::exit");
45  printf("\"pid\" : %d, \"parent\" : %d, \"name\" : \"%s\" }\n",
46         curproc->p_pid, curproc->p_ppid, curproc->p_comm);
47}
48
49dtrace:::END {
50  printf("PTREETIME { \"ts\" : %d, \"evt\" : \"%-14s\" }\n",
51         walltimestamp/1000, "END");
52}
53