12.8.1 Examining the Stack Trace of a User-Space Application

You can use the ustack() function to perform a stack trace of any user-space application, for example:

# dtrace -n syscall::write:entry'/pid == $target/ \
{ustack(); \
exit(0)}' -c "ls -l /"
dtrace: description 'syscall::write:entry' matched 1 probe
total 125
dr-xr-xr-x.   2 root root       4096 Apr 22 09:11 bin
dr-xr-xr-x.   5 root root       4096 Sep 24 09:42 boot
...
drwxr-xr-x.  14 root root       4096 Nov  2  2012 usr
drwxr-xr-x.  25 root root       4096 Apr 20 13:18 var
CPU     ID                    FUNCTION:NAME
  1      6                      write:entry
              libc.so.6`_IO_file_write+0x43
              libc.so.6`_IO_do_write+0x95
              libc.so.6`_IO_file_close_it+0x160
              libc.so.6`fclose+0x178
              ls`0x411fc9
              ls`close_stdout+0x14
              libc.so.6`exit+0xe2
              ls`0x409620
              libc.so.6`_IO_file_underflow+0x138
              libc.so.6`flush_cleanup
              libc.so.6`fclose+0x14d
              libc.so.6`fclose+0x14d
              libselinux.so.1`0x3f1840ce6f
              ls`0x412040
              ls`0x40216b
              ls`0x4027e0
              libc.so.6`__libc_start_main+0xfd
              ls`0x408480
              ls`0x4027e0
              ls`0x4027e0
              ls`0x402809

DTrace can translate the stack frames into symbols for shared libraries (such as libc) and unstripped executables. As ls is a stripped executable, the addresses remain unconverted. dtrace can translate stack frames for stripped executables if the --export-dynamic option was specified when the program was linked. This option causes the linker to add all symbols to the dynamic symbol table.