通過truss命令trace問題

truss這個工具可以幫助大家通過trace來發現和解決很多程式的問題,使用方法很簡單，使用man truss我們就可以獲得很多使用這個命令的幫助. 之前轉帖過一位網友如何更改before login banner, 那麼如何修改檔案是怎麼發現的呢？

首先需要了解一個引數-t，表示呼叫程式syscall的方式。如果瞭解-t後面接那些syscall引數呢？

# truss -c ls > /dev/null
syscall               seconds   calls  errors
execve                    .00       1
getuidx                   .00      19
getgidx                   .00      18
_exit                     .00       1
close                     .00       3
kwrite                    .00      46
klseek                    .00       2
_getpid                   .00       1
getdirent64               .00       4
kioctl                    .00       2      2
open                      .00       2
statx                     .00       3
loadquery                 .00       2
__libc_sbrk               .00       2
sbrk                      .00       3
vmgetinfo                 .00       1
access                    .00       1
kfcntl                    .00      11
__loadx                   .00      29
                         ----     ---    ---
sys totals:               .00     151      2
usr time:                 .00
elapsed:                  .00

這個我們在一個視窗通過telnet登陸到主機，執行相應的命令:truss -fa -t open -p `ps -ef | grep inetd | grep -v grep | awk '{print $2}'`

在另外一個視窗進行telnet,我們會發現執行truss命令的視窗會產生相應資訊的

# truss -fa -t open -p `ps -ef | grep inetd | grep -v grep | awk '{print $2}'`
200842: psargs: /usr/sbin/inetd
221276: open("/usr/lib/security/methods.cfg", O_RDONLY) = 3
221276: open("/etc/passwd", O_RDONLY)                   = 3
221276: open("/etc/security/passwd", O_RDONLY)          = 4
221276: open("/etc/security/login.cfg.idx", O_RDONLY)   Err#2  ENOENT
221276: open("/etc/security/login.cfg", O_RDONLY)       = 5
221276: open("/etc/security/login.cfg", O_RDONLY)       = 5
221276: open("/etc/security/login.cfg", O_RDONLY)       = 5
221276: open("/etc/passwd.nm.idx", O_RDONLY)            Err#2  ENOENT
221276: open("/etc/passwd", O_RDONLY)                   = 5
221276: open("/etc/passwd.id.idx", O_RDWR)              Err#2  ENOENT
221276: open("/etc/passwd", O_RDONLY)                   = 5
221276: open("/usr/lib/security/methods.cfg", O_RDONLY) = 3
221276: open("/etc/passwd.nm.idx", O_RDONLY)            Err#2  ENOENT
221276: open("/etc/passwd", O_RDONLY)                   = 3
221276: open("/etc/passwd.id.idx", O_RDWR)              Err#2  ENOENT
221276: open("/etc/passwd", O_RDONLY)                   = 3
221276: open("/etc/security/login.cfg.idx", O_RDONLY)   Err#2  ENOENT
221276: open("/etc/security/login.cfg", O_RDONLY)       = 3
221276: open("/etc/security/login.cfg", O_RDONLY)       = 3
221276: open("/etc/security/login.cfg", O_RDONLY)       = 3
221276: open("/etc/group", O_RDONLY)                    = 3
221276: open("/etc/security/limits.idx", O_RDONLY)      Err#2  ENOENT
221276: open("/etc/security/limits", O_RDONLY)          = 3
221276: open("/etc/security/limits", O_RDONLY)          = 3
221276: open("/etc/security/limits", O_RDONLY)          = 3
221276: open("/etc/security/user.idx", O_RDONLY)        Err#2  ENOENT
221276: open("/etc/security/user", O_RDONLY)            = 3
221276: open("/etc/security/user", O_RDONLY)            = 3
221276: open("/etc/security/user", O_RDONLY)            = 3
221276: open("/etc/security/audit/config.idx", O_RDONLY) Err#2  ENOENT
221276: open("/etc/security/audit/config", O_RDONLY)    = 3
221276: open("/etc/security/audit/config", O_RDONLY)    = 3
221276: open("/etc/security/group.idx", O_RDONLY)       Err#2  ENOENT
221276: open("/etc/security/group", O_RDONLY)           = 3
221276: open("/etc/security/group", O_RDONLY)           = 3
221276: open("/etc/security/group", O_RDONLY)           = 3
221276: open("/etc/passwd", O_RDONLY)                   = 3
221276: open("/etc/security/passwd", O_RDONLY)          = 4
221276: open("/etc/security/passwd.idx", O_RDONLY)      Err#2  ENOENT
221276: open("/etc/security/passwd", O_RDONLY)          = 5
221276: open("/etc/security/passwd", O_RDONLY)          = 5
221276: open("/etc/objrepos/CuAt", O_RDONLY)            = 3
221276: open("/etc/objrepos/CuAt.vc", O_RDONLY)         = 3
221276: open("/etc/objrepos/CuAt", O_RDWR)              = 3
221276: open("/etc/objrepos/CuAt.vc", O_RDWR)           = 4
221276: open("/etc/objrepos/CuDv", O_RDONLY)            = 3
221276: open("/etc/objrepos/PdDv", O_RDONLY)            = 3
221276: open("/etc/objrepos/PdDv.vc", O_RDONLY)         = 3
221276: open("/etc/objrepos/CuDv", O_RDWR)              = 3
221276: open("/etc/objrepos/PdAt", O_RDONLY)            = 3
221276: open("/etc/objrepos/PdAt.vc", O_RDONLY)         = 3
221276: open("/etc/objrepos/PdAt", O_RDWR)              = 3
221276: open("/etc/objrepos/PdAt.vc", O_RDWR)           = 4
221276: open("/etc/resolv.conf", O_RDONLY)              Err#2  ENOENT
221276: open("/dev/ptc", O_RDWR)                        = 3
221276: open("/etc/netsvc.conf", O_RDONLY)              = 4
221276: open("/etc/hesiod.conf", O_RDONLY)              Err#2  ENOENT
221276: open("/etc/irs.conf", O_RDONLY)                 Err#2  ENOENT
221276: open("/etc/hosts", O_RDONLY)                    = 4
221276: open("/etc/objrepos/config_lock", O_RDONLY|O_CREAT) = 4
221276: open("/etc/objrepos/OCSvhost", O_RDONLY)        Err#2  ENOENT
221276: open("/dev/pts/5", O_RDWR|O_NOCTTY)             = 4
221276: open("/etc/telnet.conf", O_RDONLY)              = 5
221276: open("/etc/security/login.cfg", O_RDONLY)       = 4
221276: open("/usr/lib/nls/msg/en_US/telnetd.cat", O_RDONLY) = 4
200842:                                 (sleeping...)
221276:                                 (sleeping...)

我們看到了其中/etc/security/login.cfg檔案

對於程式的跟蹤基本上就是這樣，非常簡單。在實際工作中，可以舉一反三。

來自 “ ITPUB部落格 ” ，連結：http://blog.itpub.net/12361284/viewspace-365975/，如需轉載，請註明出處，否則將追究法律責任。