On Fri, 20 Oct 2023, Thomas Klausner wrote:
# dtrace -n syscall::unlink:entry'/pid == 27647/{ self->file = arg0; }' -n syscall::unlink:return'{ trace(copyinstr(self->file)); self->file = 0; }'but this just gives me lots of dtrace: error on enabled probe ID 2 (ID 405: syscall::unlink:return): invalid address (0x79c4586577ce) in action #1 at DIF offset 12 : No such file or directory
Actually, this command-line is almost correct. What's missing is the paired /pid == 27647/ for syscall::unlink:return. Without it, unlink:return is called for _every_ pid and there's not going to be a valid self->file for almost every one of them. HTH, -RVP
