ktrace - enable kernel process tracing ktrace [ -Cica ] [ -p pid ] [ -g pgrp ] [ -f trfile ] [ -t trstr ]

ktrace [ -ida ] [ -f trfile ] [ command ]

Ktrace enables kernel trace points on the indicated processes. Kernel trace data is logged to the file "ktrace.data" in the current directory, or to the file named with the -f flag. The current set of trace points include: system calls, namei translations, and i/o. By default, system calls and namei translations are traced. To enable specific trace points, use the -t flag as described below. Once tracing is enabled on a process, trace data will be logged until either the process exits or the trace point is cleared with the -c flag. A traced process can log enormous amounts of data quickly, and compounded with the child inherit flag, -i, tracing can become unwieldly. It is strongly recommended that one memorize how to globally disable all tracing before attempting to trace a process. The following command is sufficient to disable tracing on all owned processes (if root, all processes in the system):

 $ trace -C

The trace records are binary format: use kdump(1) to display the trace records. Following is a description of the options:

-C Disable tracing on all user owned processes (if root, all processes in the system).

-f trfile Log trace records to trfile instead of "trace.out".

-t trstr The string argument represents the kernel trace points, one per letter. The following table equates the letters with the tracepoints:

 c - trace system calls
 n - trace namei translations
 g - trace generic i/o (utilizing read(2)/write(2))
 a - all currently implemented trace points
 s - trace socket i/o (unimplemented)
 l - trace receipt of signals (unimplemented)

-p pid Enable (disable) tracing on the indicated process id (only one -p flag allowed);

-g pgid Enable (disable) tracing on all processes in the indicated process group.

-a Append to the tracefile instead of truncating it.

-c Clear the indicated trace points.

-i Pass the trace flag to child processes on fork. Also, descend to all children of the indicated processes and set (clear) the trace flags. Be careful with this option. For example, "ktrace -cip1" will enable tracing on all processes in the system.

command Run command with the specified trace flags.

The -p, -g, and command options are mutually exclusive.

# trace system calls and namei translations of process id 34

 $ ktrace -p34

# enable all trace points on processes in process group 15 and
# pass the trace flags to all current and future children

 $ ktrace -ta -ig15

# disable all trace points on process 65

 $ ktrace -ta -cp65

# disable all trace points on process 70 and all children

 $ ktrace -ta -cip70

# enable tracing of generic i/o on process 67

 $ ktrace -tg -p67

# run the command "w" with all all trace points enabled

 $ ktrace -ta w

# disable all tracing to the file "tracedata"

 $ ktrace -ta -c -f tracedata

# disable tracing on all processes

 $ ktrace -C

kdump(1) - display kernel trace data.