Solved

Truss on process to check the files referenced by it.

Posted on 2008-10-18
8
775 Views
Last Modified: 2013-12-27
How do i run truss on a process id to check the files opened by it on solaris 10?

I am looking for an output like below..





/16:    stat64("/usr/share/webconsole/webapps/console/WEB-INF/web.xml", 0xE637E938) = 0

/16:    access("/usr/share/webconsole/webapps/console/WEB-INF/web.xml", R_OK) = 0

/16:    stat64("/usr/share/webconsole/webapps/console/WEB-INF/web.xml", 0xE637E998) = 0

/16:    stat64("/usr/share/webconsole/webapps/console/WEB-INF/web.xml", 0xE637E9A8) = 0

/16:    stat64("/usr/share/webconsole/webapps/console/WEB-INF", 0xE637E938) = 0

/16:    access("/usr/share/webconsole/webapps/console/WEB-INF", R_OK) = 0

/16:    stat64("/usr/share/webconsole/webapps/console/WEB-INF", 0xE637E998) = 0
0
Comment
Question by:p0sreed
  • 3
  • 3
8 Comments
 
LVL 6

Expert Comment

by:wwnosal
ID: 22747721
Depening if you have it installed lsof -p pid might be a bit nicer to read

0
 

Author Comment

by:p0sreed
ID: 22761597
We don't have lsof installed on all the boxes.

I am looking for the similar output as in my example.
0
 
LVL 22

Expert Comment

by:blu
ID: 22965355
I am not sure if you are asking to monitor new files being opened or old files that are already opened. If the former, then truss will do it, just as you showed above. If the latter, then you should use the pfiles command. If there is something else in addition I don't understand, then please let me know
0
Is Your Active Directory as Secure as You Think?

More than 75% of all records are compromised because of the loss or theft of a privileged credential. Experts have been exploring Active Directory infrastructure to identify key threats and establish best practices for keeping data safe. Attend this month’s webinar to learn more.

 

Author Comment

by:p0sreed
ID: 22965415
I am talking about new files being opened.

what is the proper truss command to produce the output that i pasted in my first post.
0
 
LVL 22

Expert Comment

by:blu
ID: 22966409
Okay, one more question. In your example, your show only access and stat64 lines. Do you want only those two, or any syscall that touches a file by filename?

For the former, you want this:

truss -l -taccess,stat64 -s!all -p pid

You might want to try adding stat and lstat to the above list, depending on your purpose.

However, if you want to catch any file, then you need to add a bunch more syscalls to the above  list.
0
 

Author Comment

by:p0sreed
ID: 22974258
root@clyde:/ # truss -l -taccess,stat64 -s!all -p 558
bash: !all: event not found
root@clyde:/ #

0
 
LVL 22

Accepted Solution

by:
blu earned 500 total points
ID: 22975033
You are using the c-shell, which uses the ! character as the history substitution character. Either use a different shell or escape the ! with a backslash:

truss -l -taccess,stat64 -s\!all -p 558
0

Featured Post

Is Your Active Directory as Secure as You Think?

More than 75% of all records are compromised because of the loss or theft of a privileged credential. Experts have been exploring Active Directory infrastructure to identify key threats and establish best practices for keeping data safe. Attend this month’s webinar to learn more.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

A metadevice consists of one or more devices (slices). It can be expanded by adding slices. Then, it can be grown to fill a larger space while the file system is in use. However, not all UNIX file systems (UFS) can be expanded this way. The conca…
Using libpcap/Jpcap to capture and send packets on Solaris version (10/11) Library used: 1.      Libpcap (http://www.tcpdump.org) Version 1.2 2.      Jpcap(http://netresearch.ics.uci.edu/kfujii/Jpcap/doc/index.html) Version 0.6 Prerequisite: 1.      GCC …
Learn several ways to interact with files and get file information from the bash shell. ls lists the contents of a directory: Using the -a flag displays hidden files: Using the -l flag formats the output in a long list: The file command gives us mor…
This video shows how to set up a shell script to accept a positional parameter when called, pass that to a SQL script, accept the output from the statement back and then manipulate it in the Shell.

912 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

18 Experts available now in Live!

Get 1:1 Help Now