Mac OS X in a Nutshell

Name

ktrace

Synopsis

ktrace [options] command
                  

Trace kernel operations for process command and log data to file ktrace.out in the current working directory. The tracing will continue until you either exit command or clear the trace points (with the -c or -C options). Use kdump to view the trace log.

Options

-a

Append new data to the trace file instead of overwriting it.

-C

Stop tracing of all processess run by a user invoking ktrace. If this option is used with superuser privileges, the tracing of all processes will be stopped.

-c

Stop tracing of process command.

-d

Also trace any current child processes of the specified process.

-f file

Log to file instead of ktrace.out, the default.

-g pgid

Toggle tracing of all processes that are part of the process group pgid.

-i

Also trace any future child processes of the specified process.

-p pid

Toggle tracing of process pid.

-t tracepoints

Trace only kernel operations specified in tracepoints. Use the appropriate letters from this list to indicate which type of operation(s) to trace:

c

System calls

i

I/O

n

Name translations

s

Signal processing

u

Userland operations

w

Context switches

Examples

Trace only system calls and I/O on process 489:

                     ktrace -t ci -p 489

Run the atlookup command and trace all of its kernel operations:

                     ktrace atlookup

Turn off tracing for all user processes:

                     ktrace -C