dtrace: use pid provider on multiple libraries simultaneously

Question

This dtrace script will fire every time any function is called in libx by process 12345.

dtrace -q -n 'pid12345:libx::entry { printf("probe fired"); }'

But what I really want is to detect function calls in several libraries, say libx, liby, and libz... something like:

dtrace -q -n 'pid12345:libx,liby,libz::entry { printf("probe fired"); }'

Does anyone know if this is possible using the pid provider - or any other provider?

Thanks!

score 0 · Answer 1 · answered Jul 28 '15 at 15:44

I think I found the answer to my own question, but would welcome any other suggestions. The solution I found is to add multiple comma-separated probes:

dtrace -q -n 'pid12345:libx::entry, pid12345:liby::entry, pid12345:libz::entry { printf("probe fired"); }'

score 0 · Accepted Answer · answered Jul 29 '15 at 11:36

0

You can use globbing in the probe description, e.g.

dtrace -q -n 'pid12345:lib[xyz].so::entry { printf("probe fired"); }'

answered Jul 29 '15 at 11:36

Robert Harris

1,522
9
11

Thanks Robert. Very useful. – user2048466 Sep 23 '15 at 08:26

dtrace: use pid provider on multiple libraries simultaneously

2 Answers2