The process is not restarted. It is likely that there's a bug whereby the flags set by the stop() action to cause the process to stop are cleared during the act of process creation. I'd suggest you choose a different probe such as syscall::forksys:return instead of proc:::start.
The script you posted worked fine for me on the version of illumos I tested it out on. Adam On Mon, Oct 27, 2014 at 7:02 PM, Nan Xiao via dtrace-discuss < dtrace-discuss@lists.dtrace.org> wrote: > Hi all, > > I refer this post > <https://blogs.oracle.com/chrisg/entry/follow_fork_for_dtrace_pid> to > write a simple script to trace fork system call. > The C program is like this: > > #include <stdio.h> > #include <sys/types.h> > #include <unistd.h> > > int main(void) { > pid_t pid = 0; > pid = fork(); > if (pid > 0) { > printf("Parent:%d\n", time(NULL)); > } else if (pid == 0) { > printf("Child:%d\n", time(NULL)); > } > return 0; > } > > The DTrace script is like this (debug.d): > > #!/usr/sbin/dtrace -ws > > proc:::start > /ppid == $target/ > { > stop(); > printf("fork %d\n", pid); > system("./debug.d -p %d", pid); > } > > pid$target:libc:time:return > { > trace(arg1); > ustack(); > } > > The execution and output are like the following: > > bash-3.2# ./debug.d -c ./fork > dtrace: script './debug.d' matched 2 probes > dtrace: allowing destructive actions > Parent:1414458615 > dtrace: pid 709 has exited > CPU ID FUNCTION:NAME > 6 910 lwp_rtt_initial:start fork 710 > dtrace: script './debug.d' matched 2 probes > dtrace: allowing destructive actions > Child:1414458616 > dtrace: pid 710 has exited > CPU ID FUNCTION:NAME > 7 58632 time:return 1414458616 > libc.so.1`time+0x22 > fork`_start+0x80 > > > > 10 58627 time:return 1414458615 > libc.so.1`time+0x22 > fork`_start+0x80 > > > From the explanation of stop > <https://wikis.oracle.com/display/DTrace/Actions+and+Subroutines#ActionsandSubroutines-CHPACTSUBSTOP> > action, it only refers "the process that fires the enabled probe to stop > when it next leaves the kernel". But from the above output, we can see > both parent and child processes have exited. > My question is when a process is stopped by stop() action, when and how > does the process is restarted? > > Thanks very much in advance! > > Best Regards > Nan Xiao > > *dtrace-discuss* | Archives > <https://www.listbox.com/member/archive/184261/=now> > <https://www.listbox.com/member/archive/rss/184261/21430995-5645506f> | > Modify > <https://www.listbox.com/member/?&;> > Your Subscription <http://www.listbox.com> > -- Adam Leventhal CTO, Delphix http://blog.delphix.com/ahl ------------------------------------------- dtrace-discuss Archives: https://www.listbox.com/member/archive/184261/=now RSS Feed: https://www.listbox.com/member/archive/rss/184261/25769126-e243886f Modify Your Subscription: https://www.listbox.com/member/?member_id=25769126&id_secret=25769126-8d47a7b2 Powered by Listbox: http://www.listbox.com
