2.7.8 Example: Counting the Number of Times a Program Reads From Different Files in 10 Seconds (fdscount.d)

The following D program counts the number of times a program reads from different files, within ten seconds, and displays just the top five results.

# emacs fdscount.d
# dtrace -C -D ENAME='"emacs"' -qs fdscount.d

  /usr/share/terminfo/x/xterm                                       2
  /dev/urandom                                                      3
  /usr/share/emacs/24.3/lisp/calendar/time-date.elc                 5
  /dev/tty                                                          8
  /usr/share/emacs/24.3/lisp/term/xterm.elc                         8

Use the fds[] built-in array to determine which file corresponds to the file descriptor argument arg0 to read(). The fi_pathname member of the fileinfo_t structure that is indexed in fds[] by arg0 contains the full pathname of the file.

See fileinfo_t in the Oracle Linux Dynamic Tracing Guide for more information about the members of the fileinfo_t structure.

The trunc() function in the END action instructs DTrace to display just the top five results from the aggregation.

DTrace has access to the profile:::tick-10s probe, the fds[] built-in array, and the syscall::read:entry probe. You specify a C preprocessor directive to dtrace that sets the value of the ENAME variable, such as to emacs. Although, you could choose any executable. Note that you must use additional single quotes to escape the string quotes, for example:

# dtrace -C -D ENAME='"emacs"' -qs fdscount.d

/usr/share/terminfo/x/xterm 2
/dev/tty 3
/dev/urandom 3
/usr/share/emacs/24.3/lisp/calendar/time-date.elc 5
/usr/share/emacs/24.3/lisp/term/xterm.elc 8

If the executable under test shows a /proc/pid/maps entry in the output, it refers to a file in the procfs file system that contains information about the process's mapped memory regions and permissions. Seeing pipe:inode and socket:inode entries would refer to inodes in the pipefs and socketfs file systems.