Hi all,

        I refer this post to write a simple script to trace fork system call.
        
        The C program is like this:


        #include <stdio.h>
        #include <sys/types.h>
        #include <unistd.h>


        int main(void) {
                        pid_t pid = 0;
                        
                        pid = fork();
                        if (pid > 0) {
                                        printf("Parent:%d\n", time(NULL));
                        } else if (pid == 0) {
                                        printf("Child:%d\n", time(NULL));
                        }
                        
                        return 0;
        }       
        


        The DTrace script is like this (debug.d):


        #!/usr/sbin/dtrace -ws


        proc:::start
        /ppid == $target/
        {
                        stop();
                        printf("fork %d\n", pid);
                        system("./debug.d -p %d", pid);
        }


        pid$target:libc:time:return
        {
                        trace(arg1);
                        ustack();
        }
        


        The execution and output are like the following:


        bash-3.2# ./debug.d -c ./fork
        dtrace: script './debug.d' matched 2 probes
        dtrace: allowing destructive actions
        Parent:1414458615
        dtrace: pid 709 has exited
        CPU     ID                    FUNCTION:NAME
          6    910            lwp_rtt_initial:start fork 710
        dtrace: script './debug.d' matched 2 probes
        dtrace: allowing destructive actions
        Child:1414458616
        dtrace: pid 710 has exited
        CPU     ID                    FUNCTION:NAME
          7  58632                      time:return        1414458616
                                  libc.so.1`time+0x22
                                  fork`_start+0x80






         10  58627                      time:return        1414458615
                                  libc.so.1`time+0x22
                                  fork`_start+0x80


         
        From the explanation of stop action, it only refers "the process that 
fires the enabled probe to stop when it next leaves the kernel". But from the 
above output, we can see both parent and child processes have exited.
        
        My question is when a process is stopped by stop() action, when and how 
does the process is restarted? 


        Thanks very much in advance!


Best Regards
Nan Xiao

‍


-------------------------------------------
dtrace-discuss
Archives: https://www.listbox.com/member/archive/184261/=now
RSS Feed: https://www.listbox.com/member/archive/rss/184261/25769126-e243886f
Modify Your Subscription: 
https://www.listbox.com/member/?member_id=25769126&id_secret=25769126-8d47a7b2
Powered by Listbox: http://www.listbox.com

Reply via email to