Trace control by commands

There are several commands that can be used to control the trace routine.

If the trace routine is configured to run asynchronously (trace -a), trace can be controlled by the following commands:

trcon

Starts or resumes collection of event data

trcoff

Suspends collection of event data

trcstop

Stops collection of event data and terminates the trace routine

# trace -a -n -L 2000000 -T 1000000 -d -o trace.out
# trcon
# cp /a20kfile /b
# trcstop

By specifying the -d (defer tracing until the trcon subcommand is entered) option, you can limit how much tracing is done on the trace command itself. If the -d option is not specified, then tracing begins immediately and can log events for the trace command initializing its own memory buffers. Typically, we want to trace everything but the trace command itself.

By default, the kernel buffer size (-T option) can be at most one half of the log buffer size (-L option). If you use the -f flag, the buffer sizes can be the same.

The -n option is useful if there are kernel extension system calls that need to be traced.