In article <20060921065023.GS1277@snowdrop.l8s.co.uk>,
David Laight  <david@l8s.co.uk> wrote:
>On Wed, Sep 20, 2006 at 11:36:48PM -0700, Jason Thorpe wrote:
>> 
>> If we really want a better ktrace, we should get rid of it completely  
>> and instead integrate dtrace from OpenSolaris.
>
>Certainly something that works the way the SVR4 (and probably solaris)
>'truss' program does [1] would be better for general monitoring of
>programs - rather than splatting printf calls throughout the kernel.
>Of course you lose the tracing of internal kernel events - eg namei.
>
>	David
>
>[1] process blocks on syscall entry/exit allowing the tracing process
>to determine the syscall arguments and read (write??) the traced
>processes memory.  truss is just a very large nested switch statement
>with lots of printf call - but they are all in userspace.

It is called PT_SYSCALL and we already have it.

christos