On 09/02/08 08:07, Blake Sawyer wrote:
> To All (This is mainly for the Mac DTrace 3, Adam Leventhal, Bryan
> Cantrill, Mike Shapiro),
>
> My name is Blake Sawyer and I am currently doing some research at
> Virginia Tech. One of the goals of this project is to track
> meaningful user interactions such as viewing any file, webpage, or
> mail document. I love developing for the Mac and knew that
> AppleScript would do this easily, but also knew that DTrace has been
> ported to the Mac. To move away from AppleScript, I started to learn
> DTrace. As I am fairly new to DTrace, both on the Mac and any Solaris
> environment, I have a few questions about DTrace's capabilities on Mac
> OS X. What I want to know is if DTrace _can_ do this, not _how_ to do
> it. I need to decide if I should spend time learning DTrace for this
> research project.
>
> From what I have learned from DTrace is that you can monitor the
> system calls of either the OS probes or individual processes. Also,
> on the Mac you are able to monitor Objective-C calls by specifying an
> individual Cocoa application. For my particular project I need to
> track 3 tasks: when any arbitrary application accesses a file, when
> any web page is accessed, and when any mail client assesses an email.
> My knowledge of DTrace tells me that I need to create probes for every
> application that can do these three types of tasks. Is there another
> approach that does not need to know every type of application or
> process that can do these 3 tasks?
I don't have (any) Mac-OS specific knowledge, but I were to try this on
Solaris, I'd start with the syscall and/or fbt provider(s) (they're not
specific to any process, unlike the pid provider) and try to identify the
probes that fire for the events you're looking at; once that's done, you
can, if you still wish, run a secondary probe on the application(s) of
interest the first set of probes identified ... like this:
syscall::open*:entry
/ set of condition(s) /
{
system(app-specific probe);
}
it's probably going to be a little more complicated for what you want to
do, and it may look different on the Mac, but you get the idea, I hope.
HTH
Michael
--
Michael Schuster http://blogs.sun.com/recursion
Recursion, n.: see 'Recursion'
_______________________________________________
dtrace-discuss mailing list
dtrace-discuss@opensolaris.org
