Friday afternoon japes

A certain Alec Muffet reminded me at lunch that I should post a few more "normal" DTrace scripts. What is meant by "normal" in this context are scripts that are simple and old but are good for learning the basics of D; good for morphing into something specific that you want to do. After all, when I learnt Perl I did it via ripping other peoples examples around to do what I wanted to do and not by reading a man page.

Alec, I'll try to do better in the future but now my big tummy is a rumblin' for some tea so I'll leave you with something that you wouldn't really run as you'd stop people logging in! However, it's good for a laugh and I'm sure you can use the principle in many other areas ...
#cat read.d
#!/usr/sbin/dtrace -ws

ufs_read:entry
/ stringof(args[0]->v_path) == $$1 /
{
        printf("File %s read by %d\\n", $$1, curpsinfo->pr_uid);
        raise(SIGKILL);
}
In another window we do:
# more /etc/passwd
Killed
The read.d script output looks like this:
# ./read.d /etc/passwd
dtrace: script './read.d' matched 1 probe
dtrace: allowing destructive actions
CPU     ID                    FUNCTION:NAME
  0  15625                   ufs_read:entry File /etc/passwd read by 0
Oops!
Comments:

dude! that's a good one! more like that, please!

Posted by alecm on July 23, 2004 at 02:20 PM GMT+00:00 #

Post a Comment:
Comments are closed for this entry.
About

jonh

Search

Categories
Archives
« July 2014
MonTueWedThuFriSatSun
 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
   
       
Today