Re: dtracing unlink

[RVP <rvp%SDF.ORG@localhost>]

On Fri, 20 Oct 2023, Thomas Klausner wrote:

> # dtrace -n syscall::unlink:entry'/pid == 27647/{ self->file = arg0;  }' -n syscall::unlink:return'{ trace(copyinstr(self->file)); self->file = 0; }'
>
> but this just gives me lots of
>
> dtrace: error on enabled probe ID 2 (ID 405: syscall::unlink:return): invalid address (0x79c4586577ce) in action #1 at DIF offset 12
> : No such file or directory

Actually, this command-line is almost correct. What's missing is the paired
/pid == 27647/ for syscall::unlink:return. Without it, unlink:return is called
for _every_ pid and there's not going to be a valid self->file for almost every
one of them.

HTH,

-RVP