1.\" Copyright (c) 1990, 1993 2.\" The Regents of the University of California. All rights reserved. 3.\" 4.\" %sccs.include.redist.roff% 5.\" 6.\" @(#)ktrace.1 8.1 (Berkeley) 06/06/93 7.\" 8.Dd 9.Dt KTRACE 1 10.Os BSD 4.4 11.Sh NAME 12.Nm ktrace 13.Nd enable kernel process tracing 14.Sh SYNOPSIS 15.Nm ktrace 16.Op Fl aCcdi 17.Op Fl f Ar trfile 18.Op Fl g Ar pgrp 19.Op Fl p Ar pid 20.Op Fl t Ar trstr 21.Nm ktrace 22.Op Fl adi 23.Op Fl f Ar trfile 24.Op Fl t Ar trstr 25command 26.Sh DESCRIPTION 27.Nm Ktrace 28enables kernel trace logging for the specified processes. 29Kernel trace data is logged to the file 30.Pa ktrace.out . 31The kernel operations that are traced include system calls, namei 32translations, signal processing, and 33.Tn I/O . 34.Pp 35Once tracing is enabled on a process, trace data will be logged until 36either the process exits or the trace point is cleared. 37A traced process can generate enormous amounts of log data quickly; 38It is strongly suggested that users memorize how to disable tracing before 39attempting to trace a process. 40The following command is sufficient to disable tracing on all user owned 41processes, and, if executed by root, all processes: 42.Pp 43.Dl \&$ trace -C 44.Pp 45The trace file is not human readable; use 46.Xr kdump 1 47to decode it. 48.Pp 49The options are as follows: 50.Bl -tag -width indent 51.It Fl a 52Append to the trace file instead of truncating it. 53.It Fl C 54Disable tracing on all user owned processes, and, if executed by root, all 55processes in the system. 56.It Fl c 57Clear the trace points associated with the specified file or processes. 58.It Fl d 59Descendants; perform the operation for all current children of the 60designated processes. 61.It Fl f Ar file 62Log trace records to 63.Ar file 64instead of 65.Pa ktrace.out . 66.It Fl g Ar pgid 67Enable (disable) tracing on all processes in the process group (only one 68.Fl g 69flag is permitted). 70.It Fl i 71Inherit; pass the trace flags to all future children of the designated 72processes. 73.It Fl p Ar pid 74Enable (disable) tracing on the indicated process id (only one 75.Fl p 76flag is permitted). 77.It Fl t Ar trstr 78The string argument represents the kernel trace points, one per letter. 79The following table equates the letters with the tracepoints: 80.Pp 81.Bl -tag -width flag -compact 82.It Cm c 83trace system calls 84.It Cm n 85trace namei translations 86.It Cm i 87trace 88.Tn I/O 89.It Cm s 90trace signal processing 91.El 92.It Ar command 93Execute 94.Ar command 95with the specified trace flags. 96.El 97.Pp 98The 99.Fl p , 100.Fl g , 101and 102.Ar command 103options are mutually exclusive. 104.Sh EXAMPLES 105# trace all kernel operations of process id 34 106.Dl $ ktrace -p 34 107.Pp 108# trace all kernel operations of processes in process group 15 and 109# pass the trace flags to all current and future children 110.Dl $ ktrace -idg 15 111.Pp 112# disable all tracing of process 65 113.Dl $ ktrace -cp 65 114.Pp 115# disable tracing signals on process 70 and all current children 116.Dl $ ktrace -t s -cdp 70 117.Pp 118# enable tracing of 119.Tn I/O 120on process 67 121.Dl $ ktrace -ti -p 67 122.Pp 123# run the command "w", tracing only system calls 124.Dl $ ktrace -tc w 125.Pp 126# disable all tracing to the file "tracedata" 127.Dl $ ktrace -c -f tracedata 128.Pp 129# disable tracing of all processes owned by the user 130.Dl $ ktrace -C 131.Sh SEE ALSO 132.Xr kdump 1 133.Sh HISTORY 134The 135.Nm ktrace 136command appears in 137.Bx 4.4 . 138