The tnfxtract utility collects kernel trace output from an in-core buffer in the Solaris kernel, or from the memory image of a crashed system, and generates a binary TNF trace file like those produced directly by user programs being traced.
Either both or neither of the -d and -n options must be specified. If neither is specified, trace output is extracted from the running kernel. If both are specified,
the -d argument names the file containing the (crashed) system memory image, and the -n argument names the file containing the symbol table for the system memory image.
The TNF trace file tnf_file produced is exactly the same size as the in-core buffer; it is essentially a snapshot of that buffer. It is
legal to run tnfxtract while kernel tracing is active, i.e., while the in-core buffer is being written. tnfxtract insures that the output file it generates is low-level
consistent, i.e., that only whole probes are written out, and that internal data structures in the buffer are not corrupted because the buffer is being concurrently written.
The TNF trace file generated is suitable as input to tnfdump(1),
which will generate an ASCII file.