summaryrefslogtreecommitdiff
path: root/static/openbsd/man2/ktrace.2
diff options
context:
space:
mode:
authorJacob McDonnell <jacob@jacobmcdonnell.com>2026-04-25 19:54:44 -0400
committerJacob McDonnell <jacob@jacobmcdonnell.com>2026-04-25 19:54:44 -0400
commita9157ce950dfe2fc30795d43b9d79b9d1bffc48b (patch)
tree9df484304b560466d145e662c1c254ff0e9ae0ba /static/openbsd/man2/ktrace.2
parent160aa82b2d39c46ad33723d7d909cb4972efbb03 (diff)
docs: Added All OpenBSD Manuals
Diffstat (limited to 'static/openbsd/man2/ktrace.2')
-rw-r--r--static/openbsd/man2/ktrace.2232
1 files changed, 232 insertions, 0 deletions
diff --git a/static/openbsd/man2/ktrace.2 b/static/openbsd/man2/ktrace.2
new file mode 100644
index 00000000..75bd466e
--- /dev/null
+++ b/static/openbsd/man2/ktrace.2
@@ -0,0 +1,232 @@
+.\" $OpenBSD: ktrace.2,v 1.43 2023/02/23 01:34:27 deraadt Exp $
+.\" $NetBSD: ktrace.2,v 1.2 1995/02/27 12:33:58 cgd Exp $
+.\"
+.\" Copyright (c) 1993
+.\" The Regents of the University of California. All rights reserved.
+.\"
+.\" Redistribution and use in source and binary forms, with or without
+.\" modification, are permitted provided that the following conditions
+.\" are met:
+.\" 1. Redistributions of source code must retain the above copyright
+.\" notice, this list of conditions and the following disclaimer.
+.\" 2. Redistributions in binary form must reproduce the above copyright
+.\" notice, this list of conditions and the following disclaimer in the
+.\" documentation and/or other materials provided with the distribution.
+.\" 3. Neither the name of the University nor the names of its contributors
+.\" may be used to endorse or promote products derived from this software
+.\" without specific prior written permission.
+.\"
+.\" THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
+.\" ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+.\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+.\" ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
+.\" FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+.\" DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+.\" OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+.\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+.\" LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+.\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+.\" SUCH DAMAGE.
+.\"
+.\" @(#)ktrace.2 8.1 (Berkeley) 6/4/93
+.\"
+.Dd $Mdocdate: February 23 2023 $
+.Dt KTRACE 2
+.Os
+.Sh NAME
+.Nm ktrace
+.Nd process tracing
+.Sh SYNOPSIS
+.In sys/types.h
+.In sys/ktrace.h
+.Ft int
+.Fn ktrace "const char *tracefile" "int ops" "int trpoints" "pid_t pid"
+.Sh DESCRIPTION
+The
+.Fn ktrace
+function enables or disables tracing of one or more processes.
+Users may only trace their own processes.
+Only the superuser can trace setuid or setgid programs.
+This function is only available on kernels compiled with the
+.Cm KTRACE
+option.
+.Pp
+.Fa tracefile
+gives the pathname of the file to be used for tracing.
+The file must exist, be writable by the calling process, and
+not be a symbolic link.
+If tracing points are being disabled (see
+.Dv KTROP_CLEAR
+below),
+.Fa tracefile
+must be
+.Dv NULL .
+.Pp
+Trace records are always appended to the file, ignoring the file offset,
+so the caller will usually want to truncate the file before calling
+these functions.
+.Pp
+The
+.Fa ops
+parameter specifies the requested ktrace operation.
+The defined operations are:
+.Pp
+.Bl -tag -width KTRFLAG_DESCEND -offset indent -compact
+.It Dv KTROP_SET
+Enable trace points specified in
+.Fa trpoints .
+.It Dv KTROP_CLEAR
+Disable trace points specified in
+.Fa trpoints .
+.It Dv KTROP_CLEARFILE
+Stop all tracing to the trace file.
+.It Dv KTRFLAG_DESCEND
+The tracing change should apply to the
+specified process and all its current children.
+.El
+.Pp
+The
+.Fa trpoints
+parameter specifies the trace points of interest.
+The defined trace points are:
+.Pp
+.Bl -tag -width KTRFAC_EXECARGS -offset indent -compact
+.It Dv KTRFAC_SYSCALL
+Trace system calls.
+.It Dv KTRFAC_SYSRET
+Trace return values from system calls.
+.It Dv KTRFAC_NAMEI
+Trace name lookup operations.
+.It Dv KTRFAC_GENIO
+Trace all I/O
+(note that this option can generate much output).
+.It Dv KTRFAC_PSIG
+Trace posted signals.
+.It Dv KTRFAC_STRUCT
+Trace various structs.
+.It Dv KTRFAC_USER
+Trace user data coming from
+.Xr utrace 2
+calls.
+.It Dv KTRFAC_EXECARGS
+Trace argument vector in
+.Xr execve 2
+calls.
+.It Dv KTRFAC_EXECENV
+Trace environment vector in
+.Xr execve 2
+calls.
+.It Dv KTRFAC_PLEDGE
+Trace violations of
+.Xr pledge 2
+restrictions.
+.It Dv KTRFAC_INHERIT
+Inherit tracing to future children.
+.El
+.Pp
+The
+.Fa pid
+parameter refers to a process ID.
+If it is negative,
+it refers to a process group ID.
+.Pp
+Each tracing event outputs a record composed of a generic header
+followed by a trace point specific structure.
+The generic header is:
+.Bd -literal
+struct ktr_header {
+ uint ktr_type; /* trace record type */
+ pid_t ktr_pid; /* process id */
+ pid_t ktr_tid; /* thread id */
+ struct timespec ktr_time; /* timestamp */
+ char ktr_comm[MAXCOMLEN+1]; /* command name */
+ size_t ktr_len; /* length of buf */
+};
+.Ed
+.Pp
+The
+.Fa ktr_len
+field specifies the length of the
+.Fa ktr_type
+data that follows this header.
+The
+.Fa ktr_pid , ktr_tid ,
+and
+.Fa ktr_comm
+fields specify the process, thread, and command generating the record.
+The
+.Fa ktr_time
+field gives the time (with nanosecond resolution)
+that the record was generated.
+.Pp
+The generic header is followed by
+.Fa ktr_len
+bytes of a
+.Fa ktr_type
+record.
+The type specific records are defined in the
+.In sys/ktrace.h
+include file.
+.Sh RETURN VALUES
+.Rv -std
+.Sh ERRORS
+.Fn ktrace
+will fail if:
+.Bl -tag -width EINVALAA
+.It Bq Er EINVAL
+No trace points were selected.
+.It Bq Er EPERM
+The tracing process is not the superuser and either its effective
+user ID does not match the real user ID of the receiving process,
+its effective group ID does not match the real group ID of the
+receiving process,
+the receiving process is currently being traced by the superuser,
+or the receiving process has changed its UIDs or GIDs.
+When tracing multiple processes,
+this error is returned if none of the targeted processes could be traced.
+When clearing a trace file with
+.Dv KTROP_CLEARFILE ,
+this error is returned if it could not stop tracing any of the processes
+tracing to the file.
+.It Bq Er ESRCH
+No process can be found corresponding to that specified by
+.Fa pid .
+.It Bq Er EACCES
+The named file is a device or FIFO.
+.It Bq Er EIO
+An I/O error occurred while reading from or writing to the file system.
+.El
+.Pp
+Additionally,
+.Fn ktrace
+will fail if:
+.Bl -tag -width ENAMETOOLONGAA
+.It Bq Er ENOTDIR
+A component of the path prefix is not a directory.
+.It Bq Er ENAMETOOLONG
+A component of a pathname exceeded
+.Dv NAME_MAX
+characters, or an entire pathname (including the terminating NUL)
+exceeded
+.Dv PATH_MAX
+bytes.
+.It Bq Er ENOENT
+The named tracefile does not exist.
+.It Bq Er EACCES
+Search permission is denied for a component of the path prefix or the
+path refers to a symbolic link.
+.It Bq Er ELOOP
+Too many symbolic links were encountered in translating the pathname.
+.It Bq Er EFAULT
+.Fa tracefile
+points outside the process's allocated address space.
+.El
+.Sh SEE ALSO
+.Xr kdump 1 ,
+.Xr ktrace 1 ,
+.Xr utrace 2
+.Sh HISTORY
+A
+.Fn ktrace
+function call first appeared in
+.Bx 4.3 Reno .