Sunday, June 1, 2008

Tracing system calls in HP-UX 11.x

The tool to use is tusc. Available from http://hpux.cs.utah.edu/hppd/hpux/Sysadmin/tusc-7.8/.

1) Download the file (it is in .shar)
2) Unpack is by running (may need to strip off the ^M characters first from the .shar file)
# sh tusc.xx.shar
3) There will be a binary named "tusc" and some other files.
4) tusc -help

Below is the output from tusc -help:

Usage: tusc [-]  -OR- 
-a: show exec arguments
-A: append to output file
-b bsize: dump 'bsize' max bytes (-r/-w)
-c: count syscalls instead of printing trace
-d [+][!][fd | all]: select only syscalls using fd
-e: show environment variables
-E: show syscall entries
-f: follow forks
-F: show kernel's ttrace feature level
-g: don't attach to members of my session
-h: show state of all processes when idle
-i: don't display interruptible syscalls
-I start[/stop]: single-step and show instructions
-k: keep alive (wait for *all* processes)
-l: print lwpids
-n: print process names
-o [file|fd]: send trace output to file or fd
-p: print pids
-Q: be quiet about some warnings
-r [!][fd | all]: dump read buffers
-R: show syscall restarts
-s [!]syscalls: [un]select these syscalls
-S [!]signals: [un]select these signals
-t: detach process if it becomes traced
-T timestamp: print time stamps
-u: print user thread IDs (pthreads)
-v: verbose (some system calls only)
-V: print version
-w [!][fd | all]: dump write buffers
-x: print raw (hex) arguments
-z: only show failing syscalls
Similar system calls tracing tools exist for other unixes:
AIX: truss
Linux: strace
Linux 64bit: strace32
Solaris: truss

No comments: