Switch to SpeakEasy.net DSL

The Modular Manual Browser

Home Page
Manual: (OpenBSD-5.7)
Apropos / Subsearch:
optional field

KTRACE(2)                   BSD System Calls Manual                  KTRACE(2)

     ktrace -- process tracing

     #include <&lt;sys/types.h>&gt;
     #include <&lt;sys/param.h>&gt;
     #include <&lt;sys/uio.h>&gt;
     #include <&lt;sys/ktrace.h>&gt;

     ktrace(const char *tracefile, int ops, int trpoints, pid_t pid);

     The ktrace() function enables or disables tracing of one or more pro-
     cesses.  Users may only trace their own processes.  Only the superuser
     can trace setuid or setgid programs.  ktrace() is only available on ker-
     nels compiled with the KTRACE option.

     tracefile gives the pathname of the file to be used for tracing.  The
     file must exist, be writable by the calling process, and not be a sym-
     bolic link.  All trace records are always appended to the file, so the
     file must be truncated to zero length to discard previous trace data.  If
     tracing points are being disabled (see KTROP_CLEAR below), tracefile may
     be NULL.

     The ops parameter specifies the requested ktrace operation.  The defined
     operations are:

           KTROP_SET        Enable trace points specified in trpoints.
           KTROP_CLEAR      Disable trace points specified in trpoints.
           KTROP_CLEARFILE  Stop all tracing.
           KTRFLAG_DESCEND  The tracing change should apply to the specified
                            process and all its current children.

     The trpoints parameter specifies the trace points of interest.  The
     defined trace points are:

           KTRFAC_SYSCALL  Trace system calls.
           KTRFAC_SYSRET   Trace return values from system calls.
           KTRFAC_NAMEI    Trace name lookup operations.
           KTRFAC_GENIO    Trace all I/O (note that this option can generate
                           much output).
           KTRFAC_PSIG     Trace posted signals.
           KTRFAC_EMUL     Trace emulation changes.
           KTRFAC_CSW      Trace context switch points.
           KTRFAC_STRUCT   Trace various structs
           KTRFAC_USER     Trace user data coming from utrace(2) calls.
           KTRFAC_INHERIT  Inherit tracing to future children.

     The pid parameter refers to a process ID.  If it is negative, it refers
     to a process group ID.

     Each tracing event outputs a record composed of a generic header followed
     by a trace point specific structure.  The generic header is:

     struct ktr_header {
             uint    ktr_type;               /* trace record type */
             pid_t   ktr_pid;                /* process id */
             pid_t   ktr_tid;                /* thread id */
             struct  timespec ktr_time;      /* timestamp */
             char    ktr_comm[MAXCOMLEN+1];  /* command name */
             size_t  ktr_len;                /* length of buf */

     The ktr_len field specifies the length of the ktr_type data that follows
     this header.  The ktr_pid, ktr_tid, and ktr_comm fields specify the
     process, thread, and command generating the record.  The ktr_time field
     gives the time (with nanosecond resolution) that the record was gener-

     The generic header is followed by ktr_len bytes of a ktr_type record.
     The type specific records are defined in the <sys/ktrace.h> include file.

     Upon successful completion, the value 0 is returned; otherwise the
     value -1 is returned and the global variable errno is set to indicate the

     ktrace() will fail if:

     [ENOTDIR]       A component of the path prefix is not a directory.

     [EINVAL]        No trace points were selected.

     [ENAMETOOLONG]  A component of a pathname exceeded NAME_MAX characters,
                     or an entire pathname (including the terminating NUL)
                     exceeded PATH_MAX bytes.

     [ENOENT]        The named tracefile does not exist.

     [EACCES]        Search permission is denied for a component of the path
                     prefix or the path refers to a symbolic link.

     [ELOOP]         Too many symbolic links were encountered in translating
                     the pathname.

     [EIO]           An I/O error occurred while reading from or writing to
                     the file system.

     [ESRCH]         No process can be found corresponding to that specified
                     by pid.

     kdump(1), ktrace(1), utrace(2)

     A ktrace() function call first appeared in 4.4BSD.

BSD                            January 19, 2015                            BSD