The tnfxtract utility collects kernel trace output from an in-core buffer in the Solaris kernel, or from the memory image of a crashed system, and generates a binary TNF trace file like those produced directly by user programs being traced.

Either both or neither of the -d and -n options must be specified. If neither is specified, trace output is extracted from the running kernel. If both are specified, the -d argument names the file containing the (crashed) system memory image, and the -n argument names the file containing the symbol table for the system memory image.

The TNF trace file tnf_file produced is exactly the same size as the in-core buffer; it is essentially a snapshot of that buffer. It is legal to run tnfxtract while kernel tracing is active, i.e., while the in-core buffer is being written. tnfxtract insures that the output file it generates is low-level consistent, i.e., that only whole probes are written out, and that internal data structures in the buffer are not corrupted because the buffer is being concurrently written.

The TNF trace file generated is suitable as input to tnfdump(1), which will generate an ASCII file.

The following options are supported:

-d dumpfile

Use dumpfile as the system memory image, instead of the running kernel. The dumpfile is normally the path name of a file generated by the savecore utility.

-n namelist

Use namelist as the file containing the symbol table information for the given dumpfile.

The following operand is supported:

tnf_file

output file generated by tnfxtract based on kernel trace output from an in-core buffer in the Solaris kernel.

The following exit values are returned:

0

Successful completion.

>0

An error occurred.

See attributes(5) for descriptions of the following attributes:

prex(1), tnfdump(1), savecore(1M), tnf_kernel_probes(4), attributes(5)