Mac OS X Panther in a Nutshell, 2nd Edition

Name

ktrace

Synopsis

ktrace [options] command
                  

Trace kernel operations for process command and log data to file ktrace.out in the current working directory. The tracing continues until you either exit command or clear the trace points (with the -c or -C options). Use kdump to view the trace log.

Options

-a

Append new data to the trace file instead of overwriting it.

-C

Stop tracing all processes run by a user invoking ktrace. If this option is used with superuser privileges, the tracing of all processes is stopped.

-c

Stop tracing process command.

-d

Also trace any current child processes of the specified process.

-f file

Log to file instead of ktrace.out, the default.

-g pgid

Toggle tracing of all processes that are part of the process group pgid.

-i

Also trace any future child processes of the specified process.

-p pid

Toggle tracing of process pid.

-t tracepoints

Trace only kernel operations specified in tracepoints. Use the appropriate letters from this list to indicate which type of operation(s) to trace:

c

System calls

i

I/O

n

Name translations

s

Signal processing

u

Userland operations

w

Context switches

Examples

Trace only system calls and I/O on process 489:

$ ktrace -t ci -p 489

Run the atlookup command and trace all of its kernel operations:

$ ktrace atlookup

Turn off tracing for all user processes:

$ ktrace -C