4.4BSD/usr/share/man/cat1/ktrace.0

KTRACE(1)                    BSD Reference Manual                    KTRACE(1)

NNAAMMEE
     kkttrraaccee - enable kernel process tracing

SSYYNNOOPPSSIISS
     kkttrraaccee [--aaCCccddii] [--ff _t_r_f_i_l_e] [--gg _p_g_r_p] [--pp _p_i_d] [--tt _t_r_s_t_r]
     kkttrraaccee [--aaddii] [--ff _t_r_f_i_l_e] [--tt _t_r_s_t_r] command

DDEESSCCRRIIPPTTIIOONN
     KKttrraaccee enables kernel trace logging for the specified processes.  Kernel
     trace data is logged to the file _k_t_r_a_c_e_._o_u_t. The kernel operations that
     are traced include system calls, namei translations, signal processing,
     and I/O.

     Once tracing is enabled on a process, trace data will be logged until ei-
     ther the process exits or the trace point is cleared.  A traced process
     can generate enormous amounts of log data quickly; It is strongly sug-
     gested that users memorize how to disable tracing before attempting to
     trace a process.  The following command is sufficient to disable tracing
     on all user owned processes, and, if executed by root, all processes:

           $ trace -C

     The trace file is not human readable; use kdump(1) to decode it.

     The options are as follows:

     --aa      Append to the trace file instead of truncating it.

     --CC      Disable tracing on all user owned processes, and, if executed by
             root, all processes in the system.

     --cc      Clear the trace points associated with the specified file or pro-
             cesses.

     --dd      Descendants; perform the operation for all current children of
             the designated processes.

     --ff _f_i_l_e
             Log trace records to _f_i_l_e instead of _k_t_r_a_c_e_._o_u_t.

     --gg _p_g_i_d
             Enable (disable) tracing on all processes in the process group
             (only one --gg flag is permitted).

     --ii      Inherit; pass the trace flags to all future children of the des-
             ignated processes.

     --pp _p_i_d  Enable (disable) tracing on the indicated process id (only one --pp
             flag is permitted).

     --tt _t_r_s_t_r
             The string argument represents the kernel trace points, one per
             letter.  The following table equates the letters with the trace-
             points:

             cc     trace system calls
             nn     trace namei translations
             ii     trace I/O
             ss     trace signal processing

     _c_o_m_m_a_n_d
             Execute _c_o_m_m_a_n_d with the specified trace flags.


     The --pp, --gg, and _c_o_m_m_a_n_d options are mutually exclusive.

EEXXAAMMPPLLEESS
     # trace all kernel operations of process id 34
           $ ktrace -p 34

     # trace all kernel operations of processes in process group 15 and # pass
     the trace flags to all current and future children
           $ ktrace -idg 15

     # disable all tracing of process 65
           $ ktrace -cp 65

     # disable tracing signals on process 70 and all current children
           $ ktrace -t s -cdp 70

     # enable tracing of I/O on process 67
           $ ktrace -ti -p 67

     # run the command "w", tracing only system calls
           $ ktrace -tc w

     # disable all tracing to the file "tracedata"
           $ ktrace -c -f tracedata

     # disable tracing of all processes owned by the user
           $ ktrace -C

SSEEEE AALLSSOO
     kdump(1)

HHIISSTTOORRYY
     The kkttrraaccee command appears in 4.4BSD.

4.4BSD                           June 6, 1993                                2