utils/ptreetime/libptreetime/ptreetime.dtrace

/*===- ptreetime.dtrace ---------------------------------------------------===
 *
 * This source file is part of the Swift.org open source project
 *
 * Copyright (c) 2017 Apple Inc. and the Swift project authors
 * Licensed under Apache License v2.0 with Runtime Library Exception
 *
 * See http://swift.org/LICENSE.txt for license information
 * See http://swift.org/CONTRIBUTORS.txt for the list of Swift project authors
 *
 *===----------------------------------------------------------------------===*/

/* DTrace module for use with `ptreetime`.
 *
 * This dtrace module adds probes on the kernel process creation and exit
 * events, in order to precisely track an entire process tree.
 *
 * By itself, the events generated by this module can only be used to determine
 * the wall time a process used and the name of the primary executable. However,
 * in conjunction with the ``ptreetime_interpose`` dylib, the events can be
 * combined to gather information about the exact command lines that were
 * executed, the process resource usage (user and CPU times), and the wall times
 * of additional events (like the time between when the kernel created the
 * process and when the processes' first user constructor ran).
 */

#pragma D option quiet
 
dtrace:::BEGIN {
  printf("PTREETIME { \"ts\" : %d, \"evt\" : \"%-14s\", ",
         walltimestamp/1000, "START");
  printf("\"target\" : %d }\n", $target);
}

proc:::create {
  printf("PTREETIME { \"ts\" : %d, \"evt\" : \"%-14s\", ",
         walltimestamp/1000, "proc:::create");
  printf("\"pid\" : %d, \"parent\" : %d }\n",
         ((struct proc*) arg0)->p_pid, ((struct proc*) arg0)->p_ppid);
}

proc:::exit {
  printf("PTREETIME { \"ts\" : %d, \"evt\" : \"%-14s\", ",
         walltimestamp/1000, "proc:::exit");
  printf("\"pid\" : %d, \"parent\" : %d, \"name\" : \"%s\" }\n",
         curproc->p_pid, curproc->p_ppid, curproc->p_comm);
}

dtrace:::END {
  printf("PTREETIME { \"ts\" : %d, \"evt\" : \"%-14s\" }\n",
         walltimestamp/1000, "END");
}