Le 27/10/15 19:05, Richard PALO a écrit :
> Le 27/10/15 18:22, Robert Mustacchi a écrit :
>>> probably things under /var but any straight forward way
>>> on how to find out who?
>>
>> A simple rough way to do this is something like (but could likely miss
>> things done via other means:
>>
>> dtrace -n 'syscall::write:entry/strstr(fds[arg0].fi_pathname, "/var") !=
>> NULL/{ @[execname] = count(); }' -n 'tick-1s{ printa(@); trunc(@); }'
>>
>> Robert
>>
>
> nice, it does see poold every now and then (I have a postit to add a some
> tailoring
> to the smf service)... but nothing else.
>
> Gave a shot with "/" :)
> only really saw in addition dtrace, thunderbird and gnome-terminal.
>
> But looking at zpool iostat rpool show similar activity...
>
> Kernel space writers not picked up?
>
I noticed also that if I have a bulkbuild going on in a NG zone, these
are also picked up, even though the /var in my dev zone is already in dpool.
sort of strange, really.
I looked in the dtrace toolkit and found iosnoop:
> richard@omnis:/opt/DTT$ pfexec ./iosnoop -d sd4 -v
> STRTIME UID PID D BLOCK SIZE COMM PATHNAME
> 2015 Oct 28 12:31:17 0 6 W 44832272 3584 zpool-rpool <none>
> 2015 Oct 28 12:31:17 0 6 W 44832279 22016 zpool-rpool <none>
> 2015 Oct 28 12:31:17 0 6 W 44832329 10752 zpool-rpool <none>
> 2015 Oct 28 12:31:17 0 6 W 44832350 4096 zpool-rpool <none>
> 2015 Oct 28 12:31:17 0 6 W 44832363 5120 zpool-rpool <none>
> 2015 Oct 28 12:31:17 0 6 W 44832388 8192 zpool-rpool <none>
> 2015 Oct 28 12:31:17 0 6 W 44832404 2560 zpool-rpool <none>
> 2015 Oct 28 12:31:17 0 6 W 17928237 8192 zpool-rpool <none>
> 2015 Oct 28 12:31:17 0 6 W 17959557 2048 zpool-rpool <none>
> 2015 Oct 28 12:31:17 0 6 W 17960553 24576 zpool-rpool <none>
> 2015 Oct 28 12:31:17 0 6 W 17960611 5120 zpool-rpool <none>
> 2015 Oct 28 12:31:17 0 6 W 17960657 16384 zpool-rpool <none>
> 2015 Oct 28 12:31:17 0 6 W 17960706 8704 zpool-rpool <none>
> 2015 Oct 28 12:31:17 0 6 W 44792282 8192 zpool-rpool <none>
> 2015 Oct 28 12:31:17 0 6 W 44832322 3584 zpool-rpool <none>
> 2015 Oct 28 12:31:17 0 6 W 44832358 2560 zpool-rpool <none>
> 2015 Oct 28 12:31:17 0 6 W 44832373 7680 zpool-rpool <none>
> 2015 Oct 28 12:31:17 0 6 W 44832409 512 zpool-rpool <none>
> 2015 Oct 28 12:31:17 0 6 W 44832410 1024 zpool-rpool <none>
> 2015 Oct 28 12:31:17 0 6 W 17960723 1536 zpool-rpool <none>
> 2015 Oct 28 12:31:17 0 6 W 44832412 4096 zpool-rpool <none>
> 2015 Oct 28 12:31:17 0 6 W 44832420 7168 zpool-rpool <none>
> 2015 Oct 28 12:31:17 0 6 W 44832434 6144 zpool-rpool <none>
> 2015 Oct 28 12:31:17 0 6 W 62434663 2048 zpool-rpool <none>
> 2015 Oct 28 12:31:17 0 6 W 62781055 3072 zpool-rpool <none>
> 2015 Oct 28 12:31:17 0 6 W 62864159 12288 zpool-rpool <none>
> 2015 Oct 28 12:31:17 0 6 W 17960726 17408 zpool-rpool <none>
> 2015 Oct 28 12:31:17 0 6 W 44832428 3072 zpool-rpool <none>
> 2015 Oct 28 12:31:17 0 6 W 44832451 4096 zpool-rpool <none>
> 2015 Oct 28 12:31:17 0 6 W 44832459 9216 zpool-rpool <none>
> 2015 Oct 28 12:31:17 0 6 W 62434663 2048 zpool-rpool <none>
> 2015 Oct 28 12:31:17 0 6 W 62781055 6144 zpool-rpool <none>
> 2015 Oct 28 12:31:17 0 6 W 62864159 4096 zpool-rpool <none>
> 2015 Oct 28 12:31:17 0 6 W 62864182 13312 zpool-rpool <none>
> 2015 Oct 28 12:31:17 0 6 W 17960726 4096 zpool-rpool <none>
> 2015 Oct 28 12:31:17 0 6 W 17960742 3072 zpool-rpool <none>
> 2015 Oct 28 12:31:17 0 6 W 17960755 18432 zpool-rpool <none>
> 2015 Oct 28 12:31:17 0 6 W 44832412 4096 zpool-rpool <none>
> 2015 Oct 28 12:31:17 0 6 W 44832441 5120 zpool-rpool <none>
> 2015 Oct 28 12:31:17 0 6 W 44832454 1536 zpool-rpool <none>
> 2015 Oct 28 12:31:17 0 6 W 44832457 3072 zpool-rpool <none>
> 2015 Oct 28 12:31:17 0 6 W 44832470 5120 zpool-rpool <none>
> 2015 Oct 28 12:31:17 0 6 W 62434663 2048 zpool-rpool <none>
> 2015 Oct 28 12:31:17 0 6 W 62781055 6144 zpool-rpool <none>
> 2015 Oct 28 12:31:17 0 6 W 62864159 4096 zpool-rpool <none>
> 2015 Oct 28 12:31:17 0 6 W 62864182 2048 zpool-rpool <none>
> 2015 Oct 28 12:31:17 0 6 W 62864191 10240 zpool-rpool <none>
> 2015 Oct 28 12:31:17 0 6 W 17960726 4096 zpool-rpool <none>
> 2015 Oct 28 12:31:17 0 6 W 17960742 3072 zpool-rpool <none>
> 2015 Oct 28 12:31:17 0 6 W 17960755 4096 zpool-rpool <none>
> 2015 Oct 28 12:31:17 0 6 W 17960768 13312 zpool-rpool <none>
> 2015 Oct 28 12:31:17 0 6 W 44832412 4096 zpool-rpool <none>
> 2015 Oct 28 12:31:17 0 6 W 44832428 3072 zpool-rpool <none>
> 2015 Oct 28 12:31:17 0 6 W 44832441 2560 zpool-rpool <none>
> 2015 Oct 28 12:31:17 0 6 W 44832451 1536 zpool-rpool <none>
> 2015 Oct 28 12:31:17 0 6 W 44832463 3584 zpool-rpool <none>
> 2015 Oct 28 12:31:17 0 6 W 44832428 3072 zpool-rpool <none>
> 2015 Oct 28 12:31:17 0 6 W 44832459 1024 zpool-rpool <none>
> 2015 Oct 28 12:31:17 0 6 W 44832470 4096 zpool-rpool <none>
> 2015 Oct 28 12:31:17 0 6 W 62434663 2048 zpool-rpool <none>
> 2015 Oct 28 12:31:17 0 6 W 62781055 6144 zpool-rpool <none>
> 2015 Oct 28 12:31:17 0 6 W 62864159 4096 zpool-rpool <none>
> 2015 Oct 28 12:31:17 0 6 W 62864182 2048 zpool-rpool <none>
> 2015 Oct 28 12:31:17 0 6 W 62864191 9216 zpool-rpool <none>
> 2015 Oct 28 12:31:17 0 6 W 17960726 4096 zpool-rpool <none>
> 2015 Oct 28 12:31:17 0 6 W 17960742 3072 zpool-rpool <none>
> 2015 Oct 28 12:31:17 0 6 W 17960755 4096 zpool-rpool <none>
> 2015 Oct 28 12:31:17 0 6 W 17960768 12288 zpool-rpool <none>
> 2015 Oct 28 12:31:17 0 6 W 44832412 4096 zpool-rpool <none>
> 2015 Oct 28 12:31:17 0 6 W 44832441 2560 zpool-rpool <none>
> 2015 Oct 28 12:31:17 0 6 W 44832451 4096 zpool-rpool <none>
> 2015 Oct 28 12:31:17 0 6 W 44832461 4608 zpool-rpool <none>
> 2015 Oct 28 12:31:17 0 6 W 262 1024 zpool-rpool <none>
> 2015 Oct 28 12:31:17 0 6 W 774 1024 zpool-rpool <none>
> 2015 Oct 28 12:31:17 0 6 W 77512966 1024 zpool-rpool <none>
> 2015 Oct 28 12:31:17 0 6 W 77512454 1024 zpool-rpool <none>
Poking a guess here, but is it remotely possible that these are updated
access times or something like that being written out?
--
Richard PALO
-------------------------------------------
illumos-discuss
Archives: https://www.listbox.com/member/archive/182180/=now
RSS Feed: https://www.listbox.com/member/archive/rss/182180/21175430-2e6923be
Modify Your Subscription:
https://www.listbox.com/member/?member_id=21175430&id_secret=21175430-6a77cda4
Powered by Listbox: http://www.listbox.com
