-   Linux - General (
-   -   tracing 'create' system call called by any process to kernel (

viv_nan 02-20-2007 10:47 AM

tracing 'create' system call called by any process to kernel

i need to know when create system call is called by any process in my system.. how am i to do it..? strace works only for a single process.. is there anythin similar to dtrace in solaris or how should i solve it..

unSpawn 02-20-2007 02:43 PM

Hello and welcome to LQ, hope you like it here.

There's nothing that we can call a true equivalent of Dtrace AFAIK, but the Linux Trace Toolkit (LTT, 2.6 kernels) or SysCallTrack (SCT, 2.4 series) could help. For example in SCT you would just define a rule like:

        syscall_name = create_module
        rule_name = root_create_module_rule
        filter_expression {UID==0}
        action { type = LOG }

viv_nan 03-07-2007 09:51 AM

thanks ... i am using systemtap..

jlliagre 03-07-2007 12:09 PM

If you install Solaris Express and Linux on a lx branded zone, you actually can run dtrace on the global zone an see with the lx-syscall provider what Linux system calls are used.

See and for details.

All times are GMT -5. The time now is 06:25 AM.