Either both or neither of the -d and -n options must be specified. If neither is specified, trace output is extracted from the running kernel. If both are specified, the -d argument names the file containing the (crashed) system memory image, and the -n argument names the file containing the symbol table for the system memory image.
The TNF trace file tnf_file produced is exactly the same size as the in-core buffer; it is essentially a snapshot of that buffer. It is legal to run tnfxtract while kernel tracing is active, i.e., while the in-core buffer is being written. tnfxtract insures that the output file it generates is low-level consistent, i.e., that only whole probes are written out, and that internal data structures in the buffer are not corrupted because the buffer is being concurrently written.
The TNF trace file generated is suitable as input to tnfdump(1) , which will generate an ASCII file.
# Extract probes from the running kernel into ktrace.out. example% tnfxtract ktrace.out # Extract probes from a kernel crash dump into ktrace.out. example% tnfxtract -d /var/crash/‘uname -n‘/vmcore.0 \ -n /var/crash/‘uname -n‘/unix.0 ktrace.out