starttrace command

Purpose

Records selected system events.

Syntax

starttrace [ -event Event[, Event ] ...]

Description

The starttrace command starts the trace daemon which configures a trace session and starts the collection of system events. The data collected by the trace function is recorded in the trace log. A report from the trace log can be generated with the cattracerpt command.

Flags

Flag name Description
-event Event[,Event] Specifies the user-defined events for which you want to collect trace data. The Event list items should be separated by commas.
Note: The following events are used to determine the pid, the cpuid and the exec path name in the cattracerpt report:
  • 106 DISPATCH
  • 10C DISPATCH IDLE PROCESS
  • 134 EXEC SYSTEM CALL
  • 139 FORK SYSTEM CALL
  • 465 KTHREAD CREATE
If any of these events is missing, the information reported by the cattracerpt command will be incomplete. When using the -event flag, you should include all these events in the Event list.

Examples

  1. To trace hook 234 and the hooks that will allow you to see the process names, enter:
    starttrace -event 234,106,10C,134,139,465



Last updated: Wed, November 18, 2020