On Mon, Feb 7, 2011 at 11:47 AM, Michael Schuster <michaelspriv...@gmail.com> wrote: > which fs is in use here should be irrelevant; I'd monitor the open and > write system calls, maybe starting with something like this (check the > details, I'm typing this from memory): > > syscall::open:entry > /arg0 == "/etc/hosts" || arg0 == "/etc/inet/hosts" / /* also check
This won't work. You need to copyinstr() the argument, but aside from that, DTrace probes run in DTrace context, which cannot page things in. If the argument is not paged in, then you can't get it in syscall::open:entry. You can get it in syscall::open:return (though that's not reliable, since the application could have changed it), or you can get it from the file descriptor's vnode's v_path, though that's less portable. Nico -- _______________________________________________ dtrace-discuss mailing list dtrace-discuss@opensolaris.org
