Vijay forwarded me an email from Eugene and here’s what I wrote:
Eugene wrote: I have a code and I'd like to figure out where the user code is when brk is being called. Can this be done with truss? If it's done with dtrace I need some serious handholding. Canned scripts (or whatever) would be nice since I need to resolve this in a hurry.
Here is what I recommend:
1. download/untar the DTrace toolkit
2. run this command to see the stacks of all places that call brk
./DTraceToolkit-0.96/Bin/dtruss -s -t brk /bin/ls
Unless you give yourself dtrace permissions in /etc/user_attr, you will need to be root to run dtrace. The toolkit has a bunch of scripts in it that do wonderful things. And all without knowing anything about dtrace.
I went ahead and fiddled with dtrace for a bit, and here’s what I came up with:
% dtrace -n 'pid$target::sbrk:entry { @num[ustack()] = count()}' -c "find /usr -name 'xyzzy'"
dtrace: description 'pid$target::sbrk:entry ' matched 1 probe
^C
dtrace: pid 17201 terminated by SIGINT
libc.so.1`sbrk
libc.so.1`_morecore+0x24
libc.so.1`_malloc_unlocked+0x1fc
libc.so.1`_smalloc+0x4c
libc.so.1`malloc+0x4c
libc.so.1`calloc+0x58
libc.so.1`textdomain+0x38
find`main+0x1c
find`_start+0x108
1
libc.so.1`_morecore+0xdc
libc.so.1`_malloc_unlocked+0x1fc
libc.so.1`_smalloc+0x4c
libc.so.1`malloc+0x4c
libc.so.1`calloc+0x58
libc.so.1`textdomain+0x38
find`main+0x1c
find`_start+0x108
1
The number after each stack shows the number of times that stack trace was encountered.
Oh yeah. Did I tell you how much I hate the wysiwyg editor I’m using in Roller? Of course, once I get the content in the little box, it’s too much trouble to change editors. I took me almost as long to get the preformatted text right as to write the email, figure out the script and write the rest of this blog.
Silly me. I forgot about using Xinha! It’s in my firefox, but I forgot all about it. I’m using it to add this last paragraph, and it’s working fine.
