How to collect macOS traces on customer machines with symbols for OS libs?

Question

Created 1w

Replies 2

Boosts 1

Participants 2

Our customers are large enterprises and we need to be able to collect traces on our customers' endpoints in support cases. Especially critical are performance problems. So far we've instructed our customers to use ktrace:

sudo ktrace artrace -p appname --type=profile

We would then open this trace in Instruments with the CPU profile and load our own symbols. The problem is, that symbols for system libraries are missing. In one instance we see that all of the high load is coming from a syscall made by libpcap. But all symbols other than our own are missing. How can we collect traces which include those symbols?

I tried to use

ktrace symbolicate

in tests where I recorded a trace and then used ktrace symbolicate to collect system lib symbols, but it fails for most libraries, including libpcap and the syscalls. This is somewhat surprising, because dyld_info -exports /usr/lib/libpcap.A.dylib is able to print the symbols including offsets.

So what is the recommended workflow for this scenario? Installing Xcode is of course not an option on a customer machine, especially not in an enterprise scenario.

Boost

Answer 1

Developer Tools Engineer OP

Apple

4d

Hi there,

Could you please try capturing a trace using trace command line tool instead? Command is the following:

trace record --plan profile trace_name All of the OS libraries should come with symbols already if they're not stripped and this trace should open with Instruments just like a a trace captured with ktrace artrace.

0

Answer 2

wriker OP

4d

Thanks, that works. However, this records traces for all processes. Is there a way to limit the recording to a particular process? That's a benefit with ktrace. I couldn't find this in the man page of trace.

0