KTRACE(1) UNIX Reference Manual KTRACE(1) NNAAMMEE kkttrraaccee - enable kernel process tracing SSYYNNOOPPSSIISS kkttrraaccee [--CCiiccaa] [--pp _p_i_d] [--gg _p_g_r_p] [--ff _t_r_f_i_l_e] [--tt _t_r_s_t_r] kkttrraaccee [--iiddaa] [--ff _t_r_f_i_l_e] [command] DDEESSCCRRIIPPTTIIOONN KKttrraaccee enables kernel trace logging for the specified processes. Kernel trace data is logged to the file `_k_t_r_a_c_e._o_u_t' in the current directory, or to the file named with the --ff flag. The current set of kernel opera- tions that can be traced include: system calls, namei translations, sig- nal processing, and i/o. By default, all operations are traced. To res- trict logging to specific operations, use the --tt flag as described below. Once tracing is enabled on a process, trace data will be logged until ei- ther the process exits or the trace point is cleared with the --cc flag. A traced process can generate enormous amounts of log data quickly; com- pounded with the action of the inherit flag, --ii, tracing can become unwieldly. It is strongly suggested that the user memorize how to glo- bally disable all tracing before attempting to trace a process. The fol- lowing command is sufficient to disable tracing on all user owned processes (if root, all processes in the system): $ trace -C The trace file is binary format: use kdump(1) to decode it. Following is a description of the options: --CC Disable tracing on all user owned processes (if root, all processes in the system). --ff _t_r_f_i_l_e Log trace records to _t_r_f_i_l_e instead of ``_t_r_a_c_e._o_u_t''. --tt _t_r_s_t_r The string argument represents the kernel trace points, one per letter. The following table equates the letters with the tracepoints: cc trace system calls nn trace namei translations ii trace I/O ss trace processing of signals --pp _p_i_d Enable (disable) tracing on the indicated process id (only one --pp flag allowed); --gg _p_g_i_d Enable (disable) tracing on all processes in the indicated process group. --aa Append to the tracefile instead of truncating it. --cc Clear the indicated trace points. --ii Pass the trace flag to all future children of the designated processes. --II Pass the trace flag to all current and future children of the designated processes. _c_o_m_m_a_n_d Run _c_o_m_m_a_n_d with the specified trace flags. The --pp, --gg, and command options are mutually exclusive. EEXXAAMMPPLLEESS # trace all kernel operations of process id 34 $ ktrace -p34 # trace all kernel operations of processes in process group 15 and # pass the trace flags to all current and future children $ ktrace -Ig15 # disable all tracing of process 65 $ ktrace -cp65 # disable tracing signals on process 70 and all current children $ ktrace -ts -cip70 # enable tracing of i/o on process 67 $ ktrace -ti -p67 # run the command "w", tracing only system calls $ ktrace -tc w # disable all tracing to the file "tracedata" $ ktrace -c -f tracedata # disable tracing of all processes owned by the user $ ktrace -C SSEEEE AALLSSOO kdump(1) - display kernel trace data. HHIISSTTOORRYY 4.4 BSD.