Re: dtracing unlink

[RVP <rvp%SDF.ORG@localhost>]

On Sun, 22 Oct 2023, Thomas Klausner wrote:

> I tried that (see attachment), didn't help.
>
> dtrace: error on enabled probe ID 1 (ID 404: syscall::unlink:entry): invalid address (0x7a8e0685a7ce) in action #1 at DIF offset 12
> : No such file or directory
> dtrace: error on enabled probe ID 2 (ID 405: syscall::unlink:return): invalid address (0x0) in action #2
> : No such file or directory
> dtrace: error on enabled probe ID 1 (ID 404: syscall::unlink:entry): invalid address (0x7a8e0685a7ce) in action #1 at DIF offset 12
> : No such file or directory
> dtrace: error on enabled probe ID 2 (ID 405: syscall::unlink:return): invalid address (0x0) in action #2
> : No such file or directory

Ah, that attachment is still based on _my_ version which is plain wrong: You
can't do copyinstr(arg0) in the :entry action because the kernel may not have
paged in the memory containing the pathname (yet).

Use your version (which is correct--it does copyinstr() in :return when the
kernel is sure to have the pathname already in memory):

```
#!/usr/sbin/dtrace -s

#pragma D option quiet

syscall::unlink:entry
/pid == MY_PID/
{
	self->file = arg0;
}

syscall::unlink:return
/pid == MY_PID/
{
	printf("%s\n", copyinstr(self->file));
	self->file = 0;
}
```

> The machine has 128 GB RAM and ~450 GB swap. I haven't tried limiting
> the RAM from BIOS yet.

Don't bother: this is a red herring barking up the wrong tree.

-RVP