Section 11.4. Snooping a Program s kstat Use with DTrace

11.4. Snooping a Program's kstat Use with DTrace

Using DTrace, it is possible to examine the kstat instances that a program uses. The following DTrace script shows how this could be done.

#!/usr/sbin/dtrace -s #pragma D option quiet dtrace:::BEGIN {         printf("%-16s %-16s %-6s %s\n",             "CMD", "CLASS", "TYPE", "MOD:INS:NAME"); } fbt::read_kstat_data:entry {         self->uk = (kstat_t *)copyin((uintptr_t)arg1, sizeof (kstat_t));         printf("%-16s %-16s %-6s %s:%d:%s\n", execname, self->uk->ks_class,             self->uk->ks_type == 0 ? "raw"             :  self->uk->ks_type == 1 ? "named"             :  self->uk->ks_type == 2 ? "intr"             :  self->uk->ks_type == 3 ? "io"             :  self->uk->ks_type == 4 ? "timer" : "?",             self->uk->ks_module, self->uk->ks_instance, self->uk->ks_name); } 

When we run the DTrace script above, it prints out the commands and their use of kstat.

# kstat_types.d CMD              CLASS            TYPE   MOD:INS:NAME vmstat           misc             named  cpu_info:0:cpu_info0 vmstat           misc             named  cpu:0:vm vmstat           misc             named  cpu:0:sys vmstat           disk             io     cmdk:0:cmdk0 vmstat           disk             io     sd:0:sd0 vmstat           misc             raw    unix:0:sysinfo vmstat           vm               raw    unix:0:vminfo vmstat           misc             named  unix:0:dnlcstats vmstat           misc             named  unix:0:system_misc