Correlating truss sys# entries to system call names


While trussing a process today, I came across several lines similar to the following:

$ truss -r all -w all -x all -v all -leaf -p 1234

[ ..... ]
sys#208(0x0000000F, 0x10009E050, 0x00000000, 0x00000000, 0x00000000) =
0x00000000 [0x10009E050]

This line doesn’t contain the system call name, but contains a “sys#” block to indicate which system call was invoked (in this case system call #208). To get a text description for system call #208, the grep utility can be used (you could also look through the source code):

$ grep 208 /usr/include/sys/syscall.h

#define SYS_sparc_utrap_install 208

If you have never poked around syscall.h, I highly recommend doing so.

This article was posted by Matty on 2006-01-23 19:09:00 -0400 -0400