Examples from www.dtracebook.com

[Mark Johnston]

On Tue, Dec 10, 2013 at 04:54:36PM -0800, hiren panchasara wrote:
> On Tue, Dec 10, 2013 at 4:32 PM, Mark Johnston <markj at freebsd.org> wrote:
> > On Tue, Dec 10, 2013 at 04:26:54PM -0800, hiren panchasara wrote:
> >> $ sudo dtrace -n 'proc:::exec-success { trace(curpsinfo->pr_psargs); }'
> >> dtrace: description 'proc:::exec-success ' matched 1 probe
> >> CPU     ID                    FUNCTION:NAME
> >>   5  48876                    :exec-success   /bin/sh /usr/bin/man ls
> >>   2  48876                    :exec-success   /sbin/sysctl -n hw.machine_arch
> >>   6  48876                    :exec-success   /sbin/sysctl -n hw.machine
> >>   0  48876                    :exec-success   /usr/bin/locale
> >>   7  48876                    :exec-success   /usr/bin/zcat
> >> /usr/share/man/man1/ls.1.gz
> >>   2  48876                    :exec-success   head -1
> >>   1  48876                    :exec-success   tbl
> >>   6  48876                    :exec-success   groff -S -P-h -Wall
> >> -mtty-char -man -Tascii -P-c
> >>   7  48876                    :exec-success   /usr/bin/zcat
> >> /usr/share/man/man1/ls.1.gz
> >>   3  48876                    :exec-success   less
> >>   3  48876                    :exec-success   troff -Wall -mtty-char
> >> -man -Tascii
> >>   7  48876                    :exec-success   grotty -h -c
> >>
> >>
> >>   6  48876                    :exec-success   top
> >>   7  48876                    :exec-success   ps awwux
> >>   7  48876                    :exec-success   iostat
> >>   5  48876                    :exec-success   vmstat 1
> >>   4  48876                    :exec-success   bash
> >>   4  48876                    :exec-success   whois
> >>   5  48876                    :exec-success   whoami
> >>   4  48876                    :exec-success   devinfo
> >>   4  48876                    :exec-success   dmesg
> >>   6  48876                    :exec-success   pciconf -lv
> >>
> >> I am getting interesting info only when "man" is executed and not for
> >> any other command. What does that tell me? How is man special? Other
> >> programs must also be doing exec(2), no?
> >
> > /usr/bin/man is a shell script. You'll see similar output for any
> > executable that starts with a shebang.
> 
> Thanks Mark for responding but that doesn't seem true.
> 
> I tried apropos(1) without luck.

I get the following with "apropos dtrace":

mark at raichu: ~ $ sudo dtrace -n 'proc:::exec-success {trace(curpsinfo->pr_psargs);}'
Password:
dtrace: description 'proc:::exec-success ' matched 1 probe
CPU     ID                    FUNCTION:NAME
 4  35852                    :exec-success   /bin/sh /usr/bin/apropos dtrace  
 2  35852                    :exec-success   grep -Ehi -- dtrace /usr/share/man/whatis /usr/local/man/whatis /usr/share/openssl/man/whatis /usr/local/lib/perl5/5.14/man/whatis /usr/local/lib/perl5/5.14/perl/man/whatis
 2  35852                    :exec-success   /usr/bin/less -i     

I don't really know what you mean by "interesting info." The other
programs you ran (whoami, pciconf, dmesg, devinfo) above don't call
execv().