Solaris System Level Debugging using truss

What is truss?

From the Solaris man pages, "the truss utility executes the specified command and produces a trace of the system calls it performs, the signals it receives, and the machine faults it incurs. Each line of the trace output reports either the fault or signal name or the system call name with its arguments and return value(s)".

We will use truss with the following switches

• -o produces an output file
• -f follows all children created by fork() and vfork() and includes their signals,faults and system calls in the trace output. Normally, only the first level command or process is traced. When -f is specified, the process-id is included with each line of the trace output to indicate which process executed the system call or received the signal
• -p indicates the pid which is being traced
  

To trace a PID issue the following command
bash#truss -vall -fall -p $pid -o /tmp/mailcheck.out

To trace a command issue the following command
bash#truss -vall -fall -o /tmp/commandtrace.out telnet


In the truss output the code ENOENT is shown very frequently; its meaning can be found in the system include file errno.h

bash#grep ENOENT /usr/include/sys/*
/usr/include/sys/errno.h:#define ENOENT 2 /* No such file or directory */

We therefore know that in the output of truss the ENOENT means "no such file or directory"