Unix Admin Corner: Second dtrace script

Update: I updated the link to the script, I haven't tested it, it may not work because it relizes on non-public kernel interfaces, that aren't guaranteed to remain stable. It is over a 1.5 years old.

Okay it was going to be my first but, it turned out more complicated than I ever imagined, but with the help of a couple friends on the Solaris kernel team, and a peek at the source I figured out how to do it, hint don’t start with networking stuff in dtrace if you have never done any socket programming.

This program is like top but monitors sockets, and displays them based on Bytes transferred per PID, and also shows direction and UID that the application is running the sample output is showing the activity from a pair of ssh logins plus 7 copies of wget running grabbing 7 different files from my web/fileserver box, it’s the last second then I hit ctrl-c, to show grand totals. The script is called sock_top.d click the link to download a copy if you have any comments please feel free to leave them, it makes me feel better knowing that someone reads this.

Sample output: ( it looks better on screen )

walltime : 2017 Jan 22 08:36:56
Stats for the active last Second
UID PID diretion Bytes
1000 7723 rcv'd 260
1000 6168 rcv'd 312
1000 7723 sent 660
1000 6168 sent 780
1000 8011 rcv'd 4380
1000 8001 rcv'd 7300
1000 8009 rcv'd 8760
1000 8003 rcv'd 11680
Totals for this second
Data Rcv'd ==23620 Data Sent == 1124 TOTAL 24744
TOTALS
Data Rcv'd == 335672 Data Sent ==33620 Total TRANSFERRED == 369292

Grand Totals
UID PID diretion Bytes
1000 8013 sent 120
1000 8003 sent 120
1000 8005 sent 120
1000 8011 sent 120
1000 8009 sent 120
1000 8001 sent 120
1000 8007 sent 120
1000 6168 rcv'd 3848
1000 7723 rcv'd 4888
1000 7723 sent 11436
1000 8005 rcv'd 17520
1000 8003 rcv'd 20440
1000 6168 sent 21396
1000 8013 rcv'd 21900
1000 8009 rcv'd 23360
1000 8001 rcv'd 64240
1000 8007 rcv'd 67160
1000 8011 rcv'd 112420
TOTALS
Data Rcv'd == 335672 Data Sent ==33620 Total TRANSFERRED == 369292