Last active
April 19, 2017 21:23
-
-
Save papertigers/6c75dac697b2900b6c4e3c41502456c0 to your computer and use it in GitHub Desktop.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| root@plex:~# /native/usr/sbin/dtrace -s testinotify.d | |
| dtrace: script 'testinotify.d' matched 4 probes | |
| CPU ID FUNCTION:NAME | |
| 20 2932 read:return struct inotify_event { | |
| int32_t wd = 0x242 | |
| uint32_t mask = 0x8 | |
| uint32_t cookie = 0 | |
| uint32_t len = 0x10 | |
| char [0] name = [ ] | |
| } | |
| 20 2932 read:return struct inotify_event { | |
| int32_t wd = 0x242 | |
| uint32_t mask = 0x200 | |
| uint32_t cookie = 0 | |
| uint32_t len = 0x10 | |
| char [0] name = [ ] | |
| } | |
| root@plex:/Recordings/Movies# touch test | |
| root@plex:/Recordings/Movies# rm test | |
| root@plex:/Recordings/Movies# /native/usr/bin/mdb | |
| > 242=D | |
| 578 |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| 21 3439 inotify_add_watch:entry Watching /Recordings/Movies | |
| 21 3440 inotify_add_watch:return 578 | |
| 21 3439 inotify_add_watch:entry Watching /Recordings/TV | |
| 21 3440 inotify_add_watch:return 579 |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| lx-syscall::read:entry | |
| /arg0 == 71/ | |
| { | |
| self->buf = arg1; | |
| } | |
| lx-syscall::read:return | |
| /self->buf/ | |
| { | |
| this->i = (struct inotify_event *)(copyin(self->buf, sizeof(struct inotify_event))); | |
| print(*(this->i)); | |
| self->buf = 0; | |
| } |
Author
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
71 in the predicate is the fd of /dev/inotify which can be find with pfiles.