4.3BSD-Reno/share/man/cat1/ktrace.0

KTRACE(1)		    UNIX Reference Manual		     KTRACE(1)

NNAAMMEE
     kkttrraaccee - enable kernel process tracing

SSYYNNOOPPSSIISS
     kkttrraaccee [--CCiiccaa] [--pp _p_i_d] [--gg _p_g_r_p] [--ff _t_r_f_i_l_e] [--tt _t_r_s_t_r]
     kkttrraaccee [--iiddaa] [--ff _t_r_f_i_l_e] [command]

DDEESSCCRRIIPPTTIIOONN
     KKttrraaccee enables kernel trace logging for the specified processes.  Kernel
     trace data is logged to the file `_k_t_r_a_c_e._o_u_t' in the current directory,
     or to the file named with the --ff flag.  The current set of kernel opera-
     tions that can be traced include: system calls, namei translations, sig-
     nal processing, and i/o.  By default, all operations are traced.  To res-
     trict logging to specific operations, use the --tt flag as described below.
     Once tracing is enabled on a process, trace data will be logged until ei-
     ther the process exits or the trace point is cleared with the --cc flag.  A
     traced process can generate enormous amounts of log data quickly; com-
     pounded with the action of the inherit flag, --ii, tracing can become
     unwieldly.  It is strongly suggested that the user memorize how to glo-
     bally disable all tracing before attempting to trace a process.  The fol-
     lowing command is sufficient to disable tracing on all user owned
     processes (if root, all processes in the system):

	   $ trace -C

     The trace file is binary format: use kdump(1) to decode it.  Following is
     a description of the options:

     --CC    Disable tracing on all user owned processes (if root, all processes
	   in the system).

     --ff _t_r_f_i_l_e
	   Log trace records to _t_r_f_i_l_e instead of ``_t_r_a_c_e._o_u_t''.

     --tt _t_r_s_t_r
	   The string argument represents the kernel trace points, one per
	   letter.  The following table equates the letters with the
	   tracepoints:

		 cc     trace system calls
		 nn     trace namei translations
		 ii     trace I/O
		 ss     trace processing of signals


     --pp _p_i_d
	   Enable (disable) tracing on the indicated process id (only one --pp
	   flag allowed);

     --gg _p_g_i_d
	   Enable (disable) tracing on all processes in the indicated process
	   group.

     --aa    Append to the tracefile instead of truncating it.

     --cc    Clear the indicated trace points.

     --ii    Pass the trace flag to all future children of the designated
	   processes.

     --II    Pass the trace flag to all current and future children of the
	   designated processes.

     _c_o_m_m_a_n_d
	   Run _c_o_m_m_a_n_d with the specified trace flags.

     The --pp, --gg, and command options are mutually exclusive.

EEXXAAMMPPLLEESS
	   # trace all kernel operations of process id 34
		 $ ktrace -p34
	   # trace all kernel operations of processes in process group 15 and
	   # pass the trace flags to all current and future children
		 $ ktrace -Ig15
	   # disable all tracing of process 65
		 $ ktrace -cp65
	   # disable tracing signals on process 70 and all current children
		 $ ktrace -ts -cip70
	   # enable tracing of i/o on process 67
		 $ ktrace -ti -p67
	   # run the command "w", tracing only system calls
		 $ ktrace -tc w
	   # disable all tracing to the file "tracedata"
		 $ ktrace -c -f tracedata
	   # disable tracing of all processes owned by the user
		 $ ktrace -C

SSEEEE AALLSSOO
     kdump(1) - display kernel trace data.

HHIISSTTOORRYY
     4.4 BSD.