|
| 1 | +.TH TRACE 1 "1 October 1994" |
| 2 | +.\" (C) Copyright 1991, 1994 Diomidis Spinellis. All rights reserved. |
| 3 | +.\" |
| 4 | +.\" Permission to use, copy, and distribute this software and its |
| 5 | +.\" documentation for any purpose and without fee is hereby granted, |
| 6 | +.\" provided that the above copyright notice appear in all copies and that |
| 7 | +.\" both that copyright notice and this permission notice appear in |
| 8 | +.\" supporting documentation. |
| 9 | +.\" |
| 10 | +.\" THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR IMPLIED |
| 11 | +.\" WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF |
| 12 | +.\" MERCHANTIBILITY AND FITNESS FOR A PARTICULAR PURPOSE. |
| 13 | +.\" |
| 14 | +.SH NAME |
| 15 | +trace \- trace system calls made by a process |
| 16 | +.SH SYNOPSIS |
| 17 | +\fBtrace\fP |
| 18 | +[\fB\-help\fP] |
| 19 | +[\fB\-o\fP \fIfname\fP] |
| 20 | +[\fB\-l\fP \fIlen\fP] |
| 21 | +[\fB\-p\fP \fIpsp\fP] |
| 22 | +[\fB\-abcefinrstvwxy\fP] |
| 23 | +[ \fIcommand options\fP\| .\|.\|. ] |
| 24 | +.SH DESCRIPTION |
| 25 | +\fITrace\fP is a system utility that produces a listing of the MS-DOS requests |
| 26 | +made by a process. It is a useful debugging tool that can be used on any |
| 27 | +executable program. \fITrace\fP can also be used to provide a better |
| 28 | +understanding of the internal workings of many programs. A utility |
| 29 | +with the same name and similar functionality is provided with SunOS. |
| 30 | +.LP |
| 31 | +Trace can monitor either a command passed as an argument, all the |
| 32 | +resident processes in the system or a process with a given program |
| 33 | +segment prefix (PSP). In all cases it creates a file (\fItrace.log\fP |
| 34 | +by default) where each system call and its arguments made by |
| 35 | +the process(es) monitored are printed. A number of options control |
| 36 | +the detail of information printed. |
| 37 | +.SH OPTIONS |
| 38 | +.IP \fB\-a\fP |
| 39 | +Monitor all system calls. By default the following functions are traced: |
| 40 | +\fIdisp_out\fP (0x02), |
| 41 | +\fIdirect_out\fP (0x06), |
| 42 | +\fIdisp_string\fP (0x09), |
| 43 | +\fIflush\fP (0x0d), |
| 44 | +\fIset_current_disk\fP (0x0e), |
| 45 | +\fIget_current_disk\fP (0x19), |
| 46 | +\fIset_dta\fP (0x1a), |
| 47 | +\fIdrive_info\fP (0x1c), |
| 48 | +\fIset_vector\fP (0x25), |
| 49 | +\fIparse_name\fP (0x29), |
| 50 | +\fIget_date\fP (0x2a), |
| 51 | +\fIget_time\fP (0x2c), |
| 52 | +\fIset_time\fP (0x2d), |
| 53 | +\fIget_dta\fP (0x2f), |
| 54 | +\fIget_version\fP (0x30), |
| 55 | +\fIcntrl_brk\fP (0x33), |
| 56 | +\fIget_flag\fP (0x34), |
| 57 | +\fIget_vector\fP (0x35), |
| 58 | +\fImkdir\fP (0x39), |
| 59 | +\fIrmdir\fP (0x3a), |
| 60 | +\fIchdir\fP (0x3b), |
| 61 | +\fIcreat\fP (0x3c), |
| 62 | +\fIopen\fP (0x3d), |
| 63 | +\fIclose\fP (0x3e), |
| 64 | +\fIread\fP (0x3f), |
| 65 | +\fIwrite\fP (0x40), |
| 66 | +\fIunlink\fP (0x41), |
| 67 | +\fIlseek\fP (0x42), |
| 68 | +\fIchmod\fP (0x43), |
| 69 | +\fIioctl\fP (0x44), |
| 70 | +\fIdup\fP (0x45), |
| 71 | +\fIdup2\fP (0x46), |
| 72 | +\fIgetcwd\fP (0x47), |
| 73 | +\fIalloc\fP (0x48), |
| 74 | +\fIfree\fP (0x49), |
| 75 | +\fIrealloc\fP (0x4a), |
| 76 | +\fIexec\fP (0x4b), |
| 77 | +\fIexit\fP (0x4c), |
| 78 | +\fIget_code\fP (0x4d), |
| 79 | +\fIfindfirst\fP (0x4e), |
| 80 | +\fIfindnext\fP (0x4f), |
| 81 | +\fIset_psp\fP (0x50), |
| 82 | +\fIget_psp\fP (0x51), |
| 83 | +\fIsysvars\fP (0x52), |
| 84 | +\fIchild_psp\fP (0x55), |
| 85 | +\fIget/set_time\fP (0x57), |
| 86 | +\fIget/set_alloc_str\fP (0x58), |
| 87 | +\fItmpfile\fP (0x5a). |
| 88 | +\fIcreate_new\fP (0x5b). |
| 89 | +\fIget_psp\fP (0x62), |
| 90 | +\fIopen\fP (0x6c), |
| 91 | +Functions not included in |
| 92 | +the above list are printed by default using their function number |
| 93 | +without their arguments. |
| 94 | +.IP \fB\-b\fP |
| 95 | +Print the interrupt branch address. Each line is preceded by the address |
| 96 | +on which the MS-DOS interrupt was generated. |
| 97 | +.IP \fB\-c\fP |
| 98 | +Only a summary count of all calls is produced at the end of the program run. |
| 99 | +No detailed information is given. One line is produced for each function used. |
| 100 | +The line contains the function number in hexadecimal, the symbolic function |
| 101 | +name and the number of times the function was called. |
| 102 | +.IP \fB\-e\fP |
| 103 | +Trace between \fIexec\fP calls. Unless this option is given, |
| 104 | +monitoring is disabled until the child process terminates, |
| 105 | +when a program performes an \fIexec\fP call . |
| 106 | +.IP \fB\-f\fP |
| 107 | +Calls are prefixed with the MS-DOS function call number. |
| 108 | +.IP \fB\-h\fP |
| 109 | +A short help list on the program options is displayed on the standard output. |
| 110 | +.IP \fB\-i\fP |
| 111 | +Calls are prefixed with the process-id of the process that performed them. This |
| 112 | +is the PSP address of the program under MS-DOS. |
| 113 | +.IP "\fB\-l\fP \fIL\fP" |
| 114 | +Specify the number of bytes printed for input / output calls. |
| 115 | +Up to \fIL\fP bytes of data will be printed. The default number is 15. |
| 116 | +.IP \fB\-n\fP |
| 117 | +Functions that are not normally printed are printed by a short descriptive |
| 118 | +name rather than their function number. |
| 119 | +.IP "\fB\-o\fP \fIF\fP" |
| 120 | +The output file for tracing information is \fIF\fP instead of the default |
| 121 | +\fItrace.log\fP. Note that \fIF\fP can also be a device name such as \fIcon\fP |
| 122 | +or \fIprn\fP. |
| 123 | +.IP "\fB\-p\fP \fIP\fP" |
| 124 | +Trace a process with process-id (PSP address) \fIP\fP. This is usually |
| 125 | +a terminate and stay resident (TSR) utility. To obtain the PSP address |
| 126 | +of the program use a memory display utility such as \fIdosmem\fP or |
| 127 | +\fImi\fP or run \fItrace\fP with the \fB-i\fP option. |
| 128 | +.IP \fB\-r\fP |
| 129 | +Produce a register dump on functions that do not have their arguments |
| 130 | +printed. |
| 131 | +.IP \fB\-s\fP |
| 132 | +Print strings on various functions. The functions affected are: |
| 133 | +.RS |
| 134 | +.IP \(bu 2 |
| 135 | +For all input/output functions |
| 136 | +follow the function call with the string that was read or written. The |
| 137 | +maximum length of the string is specified with the \fB-l\fP option. |
| 138 | +The string is followed by an ellipsis (...) if it contains more characters |
| 139 | +than the maximum length. The default length is 15 characters. Non ASCII |
| 140 | +data is not printed unless the \fB-x\fP option is given. |
| 141 | +.IP \(bu |
| 142 | +The \fIioctl\fP calls that get the device mode have it printed as symbolic |
| 143 | +constants. |
| 144 | +.IP \(bu |
| 145 | +The get and set filemode functions have the file mode printed |
| 146 | +as a string similar to that produced by the Unix \fIls -l\fP command. |
| 147 | +.IP \(bu |
| 148 | +The directory name returned by the \fIget current directory\fP function |
| 149 | +is printed. |
| 150 | +.IP \(bu |
| 151 | +The files returned by the \fIfind first\fP / \fIfind next\fP functions |
| 152 | +are printed together with their associated information. |
| 153 | +.RE |
| 154 | +.IP \fB\-t\fP |
| 155 | +Prefix all system calls with time in the form of hh:mm:ss. |
| 156 | +.IP \fB\-v\fP |
| 157 | +Verbose option. This option will produce the highest amount of |
| 158 | +data. It is equivalent to specifying the -\fBaefinrstwx\fP options. |
| 159 | +A trace line printed using these options will resemble the following: |
| 160 | +.br |
| 161 | +22:11:56 2c40 40 2C50:4B26 write(1, 3200:923E, 1) = 1 "r" |
| 162 | +.br |
| 163 | +The contents of the line are: the time, PSP address of the calling process, |
| 164 | +function call number, address that generated the function call, |
| 165 | +the function, its arguments, the return value and the string written. |
| 166 | +.IP \fB\-w\fP |
| 167 | +Errors from MS-DOS functions |
| 168 | +are printed in word form (i.e. symbolically) rather than as |
| 169 | +error codes. |
| 170 | +.IP \fB\-x\fP |
| 171 | +Data printed under the -s option will be printed even if it is not ASCII |
| 172 | +in hexadecimal form. |
| 173 | +.IP \fB\-y\fP |
| 174 | +Close log file after every write. |
| 175 | +Useful for debugging programs that crash. |
| 176 | +.SH "SEE ALSO" |
| 177 | +D. Spinellis. Trace: A tool for logging operating system call transactions. |
| 178 | +\fIOperating Systems Review\fP, 28(4):56-63, October 1994. |
| 179 | +.br |
| 180 | +Ralf Brown and Jim Kyle. \fIThe PC Interrupt List.\fP Addison-Wesley, 1991. |
| 181 | +.SH AUTHOR |
| 182 | +(C) Copyright 1991, 1994 Diomidis Spinellis. All rights reserved. |
| 183 | +.br |
| 184 | +e-mail: dspin@leon.nrcps.ariadne-t.gr |
| 185 | +.br |
| 186 | +snail mail: SENA S.A., Kyprou 27, GR-152 37 Filothei, Greece. |
| 187 | +.SH BUGS |
| 188 | +Most FCB calls and a number of ioctl requests are not decoded. |
| 189 | +.LP |
| 190 | +There should be an option to merge consequentive write(2) requests. |
| 191 | +.LP |
| 192 | +The system call used by \fItrace\fP to get the exit code of the |
| 193 | +process run is also traced. |
0 commit comments