Man page or keyword search:   man All Sections 1 - General Commands 2 - System Calls 3 - Subroutines, Functions 4 - Special Files 5 - File Formats 6 - Games and Screensavers 7 - Macros and Conventions 8 - Maintenence Commands 9 - Kernel Interface New Commands Server 4.4BSD AIX Alpinelinux Archlinux Aros BSDOS BSDi Bifrost CentOS Cygwin Darwin Debian DigitalUNIX DragonFly ElementaryOS Fedora FreeBSD Gentoo GhostBSD HP-UX Haiku Hurd IRIX Inferno JazzOS Kali Knoppix LinuxMint MacOSX Mageia Mandriva Manjaro Minix MirBSD NeXTSTEP NetBSD OPENSTEP OSF1 OpenBSD OpenDarwin OpenIndiana OpenMandriva OpenServer OpenSuSE OpenVMS Oracle PC-BSD Peanut Pidora Plan9 QNX Raspbian RedHat Scientific Slackware SmartOS Solaris SuSE SunOS Syllable Tru64 UNIXv7 Ubuntu Ultrix UnixWare Xenix YellowDog aLinux   23457 pages apropos Keyword Search (all sections) Output format html ascii pdf view pdf save postscript

rwsnoop(1m)			 USER COMMANDS			   rwsnoop(1m)

NAME
       rwsnoop - snoop read/write events. Uses DTrace.

SYNOPSIS
       rwsnoop [-jPtvZ] [-n name] [-p PID]

DESCRIPTION
       This  is	 measuring  reads  and	writes	at the application level. This
       matches the syscalls read, write, pread and pwrite.

       Since this uses DTrace, only users with root privileges	can  run  this
       command.

OPTIONS
       -j     print project ID

       -P     print parent process ID

       -t     print timestamp, us

       -v     print time, string

       -Z     print zone ID

       -n name
	      process name to track

       -p PID PID to track

EXAMPLES
       Default output,
	      # rwsnoop

       Print zone ID,
	      # rwsnoop -.Monitor processes named "bash", # rwsnoop -n bash

FIELDS
       TIME   timestamp, us

       TIMESTR
	      time, string

       ZONE   zone ID

       PROJ   project ID

       UID    user ID

       PID    process ID

       PPID   parent process ID

       CMD    command name for the process

       D      direction, Read or Write

       BYTES  total bytes during sample

       FILE   filename,	 if  file  based.   Reads and writes that are not file
	      based, for example with sockets, will print "<unknown>"  as  the
	      filename.

DOCUMENTATION
       See  the	 DTraceToolkit for further documentation under the Docs direc‐
       tory. The DTraceToolkit docs may include full worked examples with ver‐
       bose descriptions explaining the output.

EXIT
       rwsnoop will run forever until Ctrl-C is hit.

AUTHOR
       Brendan Gregg [Sydney, Australia]

SEE ALSO
       rwtop(1M), dtrace(1M)

version 0.70			 Jul 24, 2005			   rwsnoop(1m)

Vote for polarhome