SMB DTrace Provider

This appendix provides information about the SMB DTrace provider, which enables you to use stable probe names to write DTrace scripts for the SMB server. DTrace is a feature of the Oracle Solaris OS.

This appendix covers the following topics:

• SMB DTrace Overview

• SMB DTrace Probes

• SMB DTrace Arguments

• SMB DTrace Examples

SMB DTrace Overview

The SMB DTrace provider enables you to use stable probe names to write DTrace scripts for the SMB server. For more information about the dynamic tracing capabilities of the Oracle Solaris OS, see Oracle Solaris 11.2 Dynamic Tracing Guide and the dtrace (1M) man page.

The SMB server supports the following two probe types for each SMB request:

• The operation-start probe is called before the request is executed.

• The operation-done probe is called after the request has been executed.

SMB DTrace Probes

You can see the list of available SMB DTrace probes by running the dtrace -P smb -l command.

The following table shows the operation probes and the specific SMB write (arg[2]) argument that is used by the probe, if applicable. For more information, see SMB DTrace Arguments.

SMB DTrace Arguments

This section describes the arguments that you use for the various SMB DTrace probes.

All probes use the first and second arguments, which are shown in the following code fragment:

args[0]        conninfo_t *        socket connection information
args[1]        smbopinfo_t *       SMB operation properties

typedef struct conninfo {
	string ci_local;        /* local host address */
	string ci_remote;       /* remote host address */
	string ci_protocol;     /* protocol (ipv4, ipv6, etc) */
} conninfo_t;

typedef struct smbopinfo {
	cred_t   *soi_cred;   /* credentials for operation */
	string   soi_curpath; /* current file handle path (if any) */
	uint64_t soi_sid;     /* session id */
	uint32_t soi_pid;     /* process id */
	uint32_t soi_status;  /* status */
	uint16_t soi_tid;     /* tree id */
	uint16_t soi_uid;     /* user id */
	uint16_t soi_mid;     /* request id */
	uint16_t soi_flags2;  /* flags2 */
	uint8_t  soi_flags;   /* flags */
} smbopinfo_t;

Read operation probes also use the third argument, which is shown in the following code fragment:

args[2]	smbReadArgs_t *

typedef struct smbReadArgs {
	off_t	soa_offset;
	uint_t	soa_count;
} smbReadArgs_t;

Write operation probes also use the third argument, which is shown in the following code fragment:

args[2]	smbWriteArgs_t *

typedef struct smbWriteArgs {
	off_t	soa_offset;
	uint_t	soa_count;
} smbWriteArgs_t;

SMB DTrace Examples

The following example DTrace script shows how to trace all SMB requests.

#!/usr/sbin/dtrace -s

#pragma D option quiet

dtrace:::BEGIN
{
        printf(
            "%39s/%-17s %-31s %8s %-10s %5s %9s %5s %6s %4s\n",
            "CLIENT",
            "SESSION",
            "REQUEST",
            "TIME(us)",
            "STATUS",
            "MID",
            "PID",
            "TID",
            "FLAGS2",
            "FLAGS");
}

dtrace:::END
{
        printf(
            "%39s/%-17s %-31s %8s %-10s %5s %9s %5s %6s %4s\n",
            "CLIENT",
            "SESSION",
            "REQUEST",
            "TIME(us)",
            "STATUS",
            "MID",
            "PID",
            "TID",
            "FLAGS2",
            "FLAGS");
}

smb:::op-Read-start,
smb:::op-ReadRaw-start,
smb:::op-ReadX-start,
smb:::op-LockAndRead-start,
smb:::op-Write-start,
smb:::op-WriteAndClose-start,
smb:::op-WriteAndUnlock-start,
smb:::op-WriteRaw-start,
smb:::op-WriteX-start,
smb:::op-CheckDirectory-start,
smb:::op-Close-start,
smb:::op-CloseAndTreeDisconnect-start,
smb:::op-ClosePrintFile-start,
smb:::op-Create-start,
smb:::op-CreateDirectory-start,
smb:::op-CreateNew-start,
smb:::op-CreateTemporary-start,
smb:::op-Delete-start,
smb:::op-DeleteDirectory-start,
smb:::op-Echo-start,
smb:::op-Find-start,
smb:::op-FindClose-start,
smb:::op-FindClose2-start,
smb:::op-FindUnique-start,
smb:::op-Flush-start,
smb:::op-GetPrintQueue-start,
smb:::op-Ioctl-start,
smb:::op-LockByteRange-start,
smb:::op-LockingX-start,
smb:::op-LogoffX-start,
smb:::op-Negotiate-start,
smb:::op-NtCancel-start,
smb:::op-NtCreateX-start,
smb:::op-NtTransact-start,
smb:::op-NtTransactSecondary-start,
smb:::op-NtRename-start,
smb:::op-Open-start,
smb:::op-OpenPrintFile-start,
smb:::op-WritePrintFile-start,
smb:::op-OpenX-start,
smb:::op-ProcessExit-start,
smb:::op-QueryInformation-start,
smb:::op-QueryInformation2-start,
smb:::op-QueryInformationDisk-start,
smb:::op-Rename-start,
smb:::op-Search-start,
smb:::op-Seek-start,
smb:::op-SessionSetupX-start,
smb:::op-SetInformation-start,
smb:::op-SetInformation2-start,
smb:::op-Transaction-start,
smb:::op-Transaction2-start,
smb:::op-Transaction2Secondary-start,
smb:::op-TransactionSecondary-start,
smb:::op-TreeConnect-start,
smb:::op-TreeConnectX-start,
smb:::op-TreeDisconnect-start,
smb:::op-UnlockByteRange-start
{
        self->thread = curthread;
        self->start = timestamp;
}

smb:::op-Read-done,
smb:::op-ReadRaw-done,
smb:::op-ReadX-done,
smb:::op-LockAndRead-done,
smb:::op-Write-done,
smb:::op-WriteAndClose-done,
smb:::op-WriteAndUnlock-done,
smb:::op-WriteRaw-done,
smb:::op-WriteX-done,
smb:::op-CheckDirectory-done,
smb:::op-Close-done,
smb:::op-CloseAndTreeDisconnect-done,
smb:::op-ClosePrintFile-done,
smb:::op-Create-done,
smb:::op-CreateDirectory-done,
smb:::op-CreateNew-done,
smb:::op-CreateTemporary-done,
smb:::op-Delete-done,
smb:::op-DeleteDirectory-done,
smb:::op-Echo-done,
smb:::op-Find-done,
smb:::op-FindClose-done,
smb:::op-FindClose2-done,
smb:::op-FindUnique-done,
smb:::op-Flush-done,
smb:::op-GetPrintQueue-done,
smb:::op-Ioctl-done,
smb:::op-LockByteRange-done,
smb:::op-LockingX-done,
smb:::op-LogoffX-done,
smb:::op-Negotiate-done,
smb:::op-NtCancel-done,
smb:::op-NtCreateX-done,
smb:::op-NtTransact-done,
smb:::op-NtTransactSecondary-done,
smb:::op-NtRename-done,
smb:::op-Open-done,
smb:::op-OpenPrintFile-done,
smb:::op-WritePrintFile-done,
smb:::op-OpenX-done,
smb:::op-ProcessExit-done,
smb:::op-QueryInformation-done,
smb:::op-QueryInformation2-done,
smb:::op-QueryInformationDisk-done,
smb:::op-Rename-done,
smb:::op-Search-done,
smb:::op-Seek-done,
smb:::op-SessionSetupX-done,
smb:::op-SetInformation-done,
smb:::op-Transaction-done,
smb:::op-SetInformation2-done,
smb:::op-Transaction2-done,
smb:::op-Transaction2Secondary-done,
smb:::op-TransactionSecondary-done,
smb:::op-TreeConnect-done,
smb:::op-TreeConnectX-done,
smb:::op-TreeDisconnect-done,
smb:::op-UnlockByteRange-done
/self->thread == curthread/
{
        printf("%39s/%-17d %-31s %8d 0x%08x %5d %9d %5d 0x%04x 0x%02x\n",
               args[0]->ci_remote,
               args[1]->soi_sid,
               probename,
               (timestamp - self->start) / 1000,
               args[1]->soi_status,
               args[1]->soi_mid,
               args[1]->soi_pid,
               args[1]->soi_tid,
               args[1]->soi_flags2,
               args[1]->soi_flags);
}

The following example DTrace script traces reads and writes, which shows how the third argument is passed to read and write probes.

#!/usr/sbin/dtrace -s

#pragma D option quiet

dtrace:::BEGIN
{
        printf(
            "%39s/%-17s %-31s %8s %-10s %-17s %-10s %s\n",
            "CLIENT",
            "SESSION",
            "REQUEST",
            "TIME(us)",
            "STATUS",
            "OFFSET",
            "COUNT",
            "FILE");
}

dtrace:::END
{
        printf(
            "%39s/%-17s %-31s %8s %-10s %-17s %-10s %s\n",
            "CLIENT",
            "SESSION",
            "REQUEST",
            "TIME(us)",
            "STATUS",
            "OFFSET",
            "COUNT",
            "FILE");
}

smb:::op-Read-start,
smb:::op-ReadRaw-start,
smb:::op-ReadX-start,
smb:::op-LockAndRead-start
{
        self->thread = curthread;
        self->start = timestamp;
}

/*
 * The following action is executed if the field 'soi_curpath' is undefined (or
 * NULL). 
 */
smb:::op-Read-done,
smb:::op-ReadRaw-done,
smb:::op-ReadX-done,
smb:::op-LockAndRead-done
/self->thread == curthread && args[1]->soi_curpath == NULL/
{
        printf("%39s/%-17d %-31s %8d 0x%08x 0x%016x 0x%08x %s\n",
               args[0]->ci_remote,
               args[1]->soi_sid,
               probename,
               (timestamp - self->start) / 1000,
               args[1]->soi_status,
               args[2]->soa_offset,
               args[2]->soa_count,
               "NULL");
}

/*
 * The following action is executed if the field 'soi_curpath' is defined (or
 * points to an actual file path).
 */
smb:::op-Read-done,
smb:::op-ReadRaw-done,
smb:::op-ReadX-done,
smb:::op-LockAndRead-done
/self->thread == curthread && args[1]->soi_curpath != NULL/
{
        printf("%39s/%-17d %-31s %8d 0x%08x 0x%016x 0x%08x %s\n",
               args[0]->ci_remote,
               args[1]->soi_sid,
               probename,
               (timestamp - self->start) / 1000,
               args[1]->soi_status,
               args[2]->soa_offset,
               args[2]->soa_count,
               args[1]->soi_curpath);
}

smb:::op-Write-start,
smb:::op-WriteAndClose-start,
smb:::op-WriteAndUnlock-start,
smb:::op-WriteRaw-start,
smb:::op-WriteX-start
{
        self->thread = curthread;
        self->start = timestamp;
}

/*
 * The following action is executed if the field 'soi_curpath' is undefined (or
 * NULL).
 */
smb:::op-Write-done,
smb:::op-WriteAndClose-done,
smb:::op-WriteAndUnlock-done,
smb:::op-WriteRaw-done,
smb:::op-WriteX-done
/self->thread == curthread && args[1]->soi_curpath == NULL/
{
        printf("%39s/%-17d %-31s %8d 0x%08x 0x%016x 0x%08x %s\n",
               args[0]->ci_remote,
               args[1]->soi_sid,
               probename,
               (timestamp - self->start) / 1000,
               args[1]->soi_status,
               args[2]->soa_offset,
               args[2]->soa_count,
               "NULL");
}

/*
 * The following action is executed if the field 'soi_curpath' is defined (or
 * points to an actual file path).
 */
smb:::op-Write-done,
smb:::op-WriteAndClose-done,
smb:::op-WriteAndUnlock-done,
smb:::op-WriteRaw-done,
smb:::op-WriteX-done
/self->thread == curthread && args[1]->soi_curpath != NULL/
{
        printf("%39s/%-17d %-31s %8d 0x%08x 0x%016x 0x%08x %s\n",
               args[0]->ci_remote,
               args[1]->soi_sid,
               probename,
               (timestamp - self->start) / 1000,
               args[1]->soi_status,
               args[2]->soa_offset,
               args[2]->soa_count,
               args[1]->soi_curpath);
}