System Call Tracing

[Frank Gilsdorf]

Hi,

does anybody out there know a tool to log all(!) system-calls over all(!) processes?

Tusc won't do this job because it only logs one process. With glance I can see the calls but I can't see which process did start them.

Frank

[Ravi_8]

Hi,

try with 'trace'

[Santosh Nair_1]

You should be able to use tusc to trace system calls. You can get tusc from the porting center:

http://hpux.connect.org.uk/hppd/hpux/Sysadmin/tusc-7.0/

If you need something for HPUX 10.x then you would have to get trace, also available from the porting center:

http://hpux.connect.org.uk/hppd/hpux/Sysadmin/trace-1.6/

-Santosh

[Frank Gilsdorf]

Sorry,

tusc won't do the job. I wan't to start the tracer and it has to log all actuall processes and the processes that will start in future.

I've heard on SGI padc will do this. Can I find something similar on HP-UX?

Frank

[Roger Baptiste]

Frank,

I once used a tool similar to what
you are looking for- logging all system calls,
snapshots of the system activity etc -
which was given by a HP performance expert
for diagonsing a performance problem.
I don't remember the name of the tool,
but it used to produce ouput in the order
of >500Mb in a matter of few minutes and
we used to run it only for a short while.

Another option you have is
to run truss with the -p option.
truss -p ; To check all the processes
running on the system, put ps command in
a loop, grab any new process id and run
truss on it. But, i understand it can
get clumsy with lots of truss commands running.

I will try to remember the HP tool and
post back.

-raj

[Santosh Nair_1 · Accepted solution]

Okay, how about this tool from HP called prospect...its supposed to monitor all system calls. One caveat though, the log files can grow rapidly especially on a busy system:

ftp://ftp.cup.hp.com/dist/networking/tools/prospect/

-Santosh

[Mladen Despic]

Frank,

I think Glance has PROCSYSCALL_??_?? types of metrics that you can use. Depending on what kind of a report you would like to generate, you could tailor your adviser syntax accordingly. I've attached an example. To see a sample of the report, save the attached file to, say, sc.syntax in your current directory; then run:

glance -adviser_only -syntax sc.syntax -iterations 3 | tail +20 > glance.out

Is the output file glance.out something like what you want to see?

Mladen