truss reports every system call a process makes, which for anything
larger than a toy program buries the calls of interest. Add -t, taking
a comma-separated expression naming the system calls to report.
Each term is either an fnmatch(3) pattern matched against the system
call name, or "@group" naming a group of related system calls. A term
prefixed with '!' excludes what it matches rather than including it.
An expression whose terms are all negated subtracts from the set of
every system call; any other expression selects from an empty one.
Terms apply in order and the last one to match a system call decides
whether it is reported.
truss -t @file,@net fetch https://www.freebsd.org/ truss -t '!@memory' make buildworld truss -t '@desc,!@read,!@write' -p 34 truss -c -t 'readlink*' /bin/ls
Twelve groups are provided to start with: @all, @creds, @desc, @file,
@ipc, @memory, @net, @proc, @read, @signal, @time and @write. These
were derived by working through sys/kern/syscalls.master; the audit
event in that file is too sparse to drive the grouping by itself (316
distinct events over 509 live system calls, 111 of them AUE_NULL), so
the groups are curated, but they are curated as fnmatch patterns rather
than as name lists. A family sharing a naming convention is written as
one pattern -- "extattr_*_file", "__acl_*_fd", "sctp_*" -- so system
calls added later join the right group without further change here.
A group may also name another group as a member, which is how @desc is
built from @read and @write without repeating them. Adding a group is
a member list plus one entry in syscall_groups[].
"truss -t" with no expression prints the groups and exits.
Matching is done against the name truss displays and against that name
with any compatibility or ABI prefix removed, so @file selects
compat11.stat, freebsd32_stat and linux_newstat as well as stat.
A system call excluded by -t is not decoded at all, only counted out,
so the filter also removes the cost of formatting arguments that would
never be printed.
The option letter follows truss on System V Release 4 and SunOS, which
spell this same feature "-t [!]syscall,...", and which truss(1) already
names as its model.
Without -t the behaviour is unchanged.
MFC after: 2 weeks