FreeBSD Turn On Process Accounting – Track System Resources Used By Users

Posted on in Categories FreeBSD, Howto, Monitoring, Security, Sys admin, Tips, Troubleshooting, Tuning last updated January 8, 2009

I’ve already written about Linux process accounting under Linux ( see how to keep a detailed audit trail of what’s being done on your Linux systems). You can easily setup process accounting under FreeBSD. This tutorial expalins how to enable and utilizing FreeBSD process accounting including many other useful options are explained to keep track of system resources used, and their allocation among users.

Nagios: System and Network Monitoring Book

Posted on in Categories Book Review, Linux, Monitoring, RedHat/Fedora Linux, Suse Linux, Sys admin, Troubleshooting, Ubuntu Linux, UNIX, Windows server last updated October 18, 2008

The convenience and reliability that monitoring programs offer system administrators is astounding. Whether at home, commuting, or on vacation, admins can continuously monitor their networks, learning of issues long before they become catastrophes.

Nagios, the most popular open source solution for system and network monitoring, is extremely robust, but it’s also intensely complex.

Ubuntu / Debian Linux Find Weak OpenSSL keys

Posted on in Categories Debian Linux, Howto, Linux, Linux desktop, Monitoring, Networking, package management, Security, Security Alert, Windows, windows vista last updated June 16, 2008

Luciano Bello discovered that the random number generator in Debian’s openssl package is predictable. This is caused by an incorrect Debian-specific change to the openssl package (CVE-2008-0166). As a result, cryptographic key material may be guessable.

ktrace – FreeBSD / Mac OS X Process Tracing and Reporting Tool

Posted on in Categories FreeBSD, Howto, Monitoring, OpenBSD, OS X, programming, Sys admin, Troubleshooting last updated April 16, 2008

Under Linux you can use strace or valgrind tool for reporting and finding a bug. However, under *BSD / Mac OS X you need to use ktrace as replacement for strace tool.

kreace runs on the following platforms:
=> FreeBSD
=> OpenBSD
=> Mac OS X
=> NetBSD

The ktrace utility enables kernel trace logging for the specified processes. Kernel trace data is logged to the file ktrace.out. The kernel operations that are traced include system calls, namei translations, sig nal processing, and I/O. Once tracing is enabled on a process, trace data will be logged until either the process exits or the trace point is cleared. A traced process can generate enormous amounts of log data quickly; It is strongly suggested that users memorize how to disable tracing before attempting to trace a process.

To trace all kernel operations for process id # 2546, enter:
$ ktrace -p 2546
To disable all tracing of process # 2546, enter:
$ ktrace -cp 2546
To disable tracing on all user-owned processes, and, if executed by root, all processes in the system:
# ktrace -C
Attach to process id # 123 and log trace records to myapp.dbg.log instead of ktrace.out.
$ ktrace -p 123 -f myapp.dbg.log
To enable tracing of I/O on process # 123
$ ktrace -ti -p 123
The -t option is very useful to trace various kernel trace points, one per letter. The following table equates the letters with the trace points:

  • c : trace system calls
  • n : trace namei translations
  • i : trace I/O
  • s : trace signal processing
  • u : userland traces
  • w : context switches
  • + : trace the default set of trace points – c, n, i, s, u

Run the command called myapp and track only system calls, enter:
$ ktrace -tc ./myapp
Please note that the output of ktrace is not as informative as strace, but it does help to solve many problems.

truss: trace system calls

FreeBSD has another tool called truss. It traces the system calls called by the specified process or program. Output is to the specified output file, or standard error by default.
Attach to an already-running process # 123, enter
$ truss -p 123
Follow the system calls used myapp
$ truss ./myapp -d /tmp -f 120
Same as above, but put the output into a file called /tmp/myapp.dbg
$ truss -o /tmp/truss.out ./myapp -d /tmp -f 120

strace under FreeBSD

You can install strace under FreeBSD and other *BSD like oses.

Further readings:

  • ktrace man page
  • truss man page