|-a||Append to the trace file instead of recreating it.|
|-C||Disable tracing on all user-owned processes, and, if executed by root, all processes in the system.|
|-c||Clear the specified trace points associated with the given file or processes.|
|-d||Descendants; perform the operation for all current children of the designated processes.|
|Log trace records to trfile instead of ktrace.out.|
|Enable (disable) tracing on all processes in the process group (only one -g flag is permitted).|
|-i||Inherit; pass the trace flags to all future children of the designated processes.|
|-p pid||Enable (disable) tracing on the indicated process id (only one -p flag is permitted).|
Specify the list of trace points to enable or disable, one per letter.
If an explicit list is not specified, the default set of trace points is used.
The following trace points are supported:
|c||trace system calls|
|f||trace page faults|
|n||trace namei translations|
|p||trace capability check failures|
|s||trace signal processing|
|t||trace various structures|
|y||trace sysctl(3) requests|
|+||trace the default set of trace points - c, i, n, p, s, t, u, y|
|Execute command with the specified trace flags.|
The -p , -g , and command options are mutually exclusive.
# trace all kernel operations of process id 34
$ ktrace -p 34
# trace all kernel operations of processes in process group 15 and # pass the trace flags to all current and future children
$ ktrace -idg 15
# disable all tracing of process 65
$ ktrace -cp 65
# disable tracing signals on process 70 and all current children
$ ktrace -t s -cdp 70
# enable tracing of I/O on process 67
$ ktrace -ti -p 67
# run the command "w", tracing only system calls
$ ktrace -tc w
# disable all tracing to the file "tracedata"
$ ktrace -c -f tracedata
# disable tracing of all user-owned processes
$ ktrace -C
The ktrace command appeared in BSD 4.4 .
Only works if trfile is a regular file.