Correlating truss sys# entries to system call names

While trussing a process today, I came across several lines similar to the following:

$ truss -r all -w all -x all -v all -leaf -p 1234
[ ….. ]
sys#208(0x0000000F, 0x10009E050, 0x00000000, 0x00000000, 0x00000000) = 0x00000000 [0x10009E050]

This line doesn’t contain the system call name, but contains a “sys#” block to indicate which system call was invoked (in this case system call #208). To get a text description for system call #208, the grep utility can be used (you could also look through the source code):

$ grep 208 /usr/include/sys/syscall.h
#define SYS_sparc_utrap_install 208

If you have never poked around syscall.h, I highly recommend doing so.

Leave a Reply

Your email address will not be published. Required fields are marked *