| /*===- ptreetime.dtrace ---------------------------------------------------=== |
| * |
| * This source file is part of the Swift.org open source project |
| * |
| * Copyright (c) 2017 Apple Inc. and the Swift project authors |
| * Licensed under Apache License v2.0 with Runtime Library Exception |
| * |
| * See http://swift.org/LICENSE.txt for license information |
| * See http://swift.org/CONTRIBUTORS.txt for the list of Swift project authors |
| * |
| *===----------------------------------------------------------------------===*/ |
| |
| /* DTrace module for use with `ptreetime`. |
| * |
| * This dtrace module adds probes on the kernel process creation and exit |
| * events, in order to precisely track an entire process tree. |
| * |
| * By itself, the events generated by this module can only be used to determine |
| * the wall time a process used and the name of the primary executable. However, |
| * in conjunction with the ``ptreetime_interpose`` dylib, the events can be |
| * combined to gather information about the exact command lines that were |
| * executed, the process resource usage (user and CPU times), and the wall times |
| * of additional events (like the time between when the kernel created the |
| * process and when the processes' first user constructor ran). |
| */ |
| |
| #pragma D option quiet |
| |
| dtrace:::BEGIN { |
| printf("PTREETIME { \"ts\" : %d, \"evt\" : \"%-14s\", ", |
| walltimestamp/1000, "START"); |
| printf("\"target\" : %d }\n", $target); |
| } |
| |
| proc:::create { |
| printf("PTREETIME { \"ts\" : %d, \"evt\" : \"%-14s\", ", |
| walltimestamp/1000, "proc:::create"); |
| printf("\"pid\" : %d, \"parent\" : %d }\n", |
| ((struct proc*) arg0)->p_pid, ((struct proc*) arg0)->p_ppid); |
| } |
| |
| proc:::exit { |
| printf("PTREETIME { \"ts\" : %d, \"evt\" : \"%-14s\", ", |
| walltimestamp/1000, "proc:::exit"); |
| printf("\"pid\" : %d, \"parent\" : %d, \"name\" : \"%s\" }\n", |
| curproc->p_pid, curproc->p_ppid, curproc->p_comm); |
| } |
| |
| dtrace:::END { |
| printf("PTREETIME { \"ts\" : %d, \"evt\" : \"%-14s\" }\n", |
| walltimestamp/1000, "END"); |
| } |