Truss on process to check the files referenced by it.

How do i run truss on a process id to check the files opened by it on solaris 10?

I am looking for an output like below..

/16:    stat64("/usr/share/webconsole/webapps/console/WEB-INF/web.xml", 0xE637E938) = 0

/16:    access("/usr/share/webconsole/webapps/console/WEB-INF/web.xml", R_OK) = 0

/16:    stat64("/usr/share/webconsole/webapps/console/WEB-INF/web.xml", 0xE637E998) = 0

/16:    stat64("/usr/share/webconsole/webapps/console/WEB-INF/web.xml", 0xE637E9A8) = 0

/16:    stat64("/usr/share/webconsole/webapps/console/WEB-INF", 0xE637E938) = 0

/16:    access("/usr/share/webconsole/webapps/console/WEB-INF", R_OK) = 0

/16:    stat64("/usr/share/webconsole/webapps/console/WEB-INF", 0xE637E998) = 0
Who is Participating?
Brian UtterbackConnect With a Mentor Principle Software EngineerCommented:
You are using the c-shell, which uses the ! character as the history substitution character. Either use a different shell or escape the ! with a backslash:

truss -l -taccess,stat64 -s\!all -p 558
Depening if you have it installed lsof -p pid might be a bit nicer to read

p0sreedAuthor Commented:
We don't have lsof installed on all the boxes.

I am looking for the similar output as in my example.
Get expert help—faster!

Need expert help—fast? Use the Help Bell for personalized assistance getting answers to your important questions.

Brian UtterbackPrinciple Software EngineerCommented:
I am not sure if you are asking to monitor new files being opened or old files that are already opened. If the former, then truss will do it, just as you showed above. If the latter, then you should use the pfiles command. If there is something else in addition I don't understand, then please let me know
p0sreedAuthor Commented:
I am talking about new files being opened.

what is the proper truss command to produce the output that i pasted in my first post.
Brian UtterbackPrinciple Software EngineerCommented:
Okay, one more question. In your example, your show only access and stat64 lines. Do you want only those two, or any syscall that touches a file by filename?

For the former, you want this:

truss -l -taccess,stat64 -s!all -p pid

You might want to try adding stat and lstat to the above list, depending on your purpose.

However, if you want to catch any file, then you need to add a bunch more syscalls to the above  list.
p0sreedAuthor Commented:
root@clyde:/ # truss -l -taccess,stat64 -s!all -p 558
bash: !all: event not found
root@clyde:/ #

Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

All Courses

From novice to tech pro — start learning today.