Jim, thanks a lot for your suggestions! I just came up with a different solution a few minutes ago, here it is:
as the filesystem IO read and writes are always embedded in opens and closes, and I know the name of the UNIX domain socket, I can match against that in open:entry: syscall::open*:entry /(((OPT_command || OPT_pid) && pid == $target) || (OPT_name && execname == NAME)) && copyinstr(arg0) != "/path/to/socket"/ { /* set start details */ self->start = timestamp; self->vstart = vtimestamp; } Then in open:return I can grab the fd: syscall::*open*:return /self->start/ { /* save fd number */ self->fd = arg0; /* calculate elapsed time */ .... } In read:entry/return I can now test if the read/write is on the fd of the last open: syscall::*read*:entry, syscall::*write*:entry /((OPT_command || OPT_pid) && pid == $target) || (OPT_name && execname == NAME)/ { self->fd = self->fd == arg0 ? arg0 : 0; /* set start details */ self->start = timestamp; self->vstart = vtimestamp; } /* * filesystem IO */ syscall::*read*:return, syscall::*write*:return /self->start && self->fd/ { /* calculate elapsed time */ .... } /* * socket IO */ syscall::*read*:return, syscall::*write*:return /self->start && self->fd == 0/ { /* calculate elapsed time */ .... } -- This message posted from opensolaris.org _______________________________________________ dtrace-discuss mailing list dtrace-discuss@opensolaris.org