Skip to content
Projects
Groups
Snippets
Help
Loading...
Help
Support
Keyboard shortcuts
?
Submit feedback
Contribute to GitLab
Sign in / Register
Toggle navigation
B
bcc
Project overview
Project overview
Details
Activity
Releases
Repository
Repository
Files
Commits
Branches
Tags
Contributors
Graph
Compare
Issues
0
Issues
0
List
Boards
Labels
Milestones
Merge Requests
0
Merge Requests
0
Analytics
Analytics
Repository
Value Stream
Wiki
Wiki
Snippets
Snippets
Members
Members
Collapse sidebar
Close sidebar
Activity
Graph
Create a new issue
Commits
Issue Boards
Open sidebar
Kirill Smelkov
bcc
Commits
5eee5ffa
Commit
5eee5ffa
authored
8 years ago
by
Junli Ou
Browse files
Options
Browse Files
Download
Email Patches
Plain Diff
killsnoop: use current time replace timestamp and default output
parent
c6009c55
Changes
3
Hide whitespace changes
Inline
Side-by-side
Showing
3 changed files
with
17 additions
and
61 deletions
+17
-61
man/man8/killsnoop.8
man/man8/killsnoop.8
+3
-10
tools/killsnoop.py
tools/killsnoop.py
+7
-42
tools/killsnoop_example.txt
tools/killsnoop_example.txt
+7
-9
No files found.
man/man8/killsnoop.8
View file @
5eee5ffa
...
...
@@ -2,7 +2,7 @@
.SH NAME
killsnoop \- Trace signals issued by the kill() syscall. Uses Linux eBPF/bcc.
.SH SYNOPSIS
.B killsnoop [\-h] [\-
t] [\-
x] [-p PID]
.B killsnoop [\-h] [\-x] [-p PID]
.SH DESCRIPTION
killsnoop traces the kill() syscall, to show signals sent via this method. This
may be useful to troubleshoot failing applications, where an unknown mechanism
...
...
@@ -23,9 +23,6 @@ CONFIG_BPF and bcc.
\-h
Print usage message.
.TP
\-t
Include a timestamp column.
.TP
\-x
Only print failed kill() syscalls.
.TP
...
...
@@ -37,10 +34,6 @@ Trace all kill() syscalls:
#
.B killsnoop
.TP
Trace all kill() syscalls, and include timestamps:
#
.B killsnoop \-t
.TP
Trace only kill() syscalls that failed:
#
.B killsnoop \-x
...
...
@@ -50,8 +43,8 @@ Trace PID 181 only:
.B killsnoop \-p 181
.SH FIELDS
.TP
TIME
(s)
Time of the
call, in seconds
.
TIME
Time of the
kill call
.
.TP
PID
Source process ID
...
...
This diff is collapsed.
Click to expand it.
tools/killsnoop.py
View file @
5eee5ffa
...
...
@@ -4,7 +4,7 @@
# killsnoop Trace signals issued by the kill() syscall.
# For Linux, uses BCC, eBPF. Embedded C.
#
# USAGE: killsnoop [-h] [-
t] [-
x] [-p PID]
# USAGE: killsnoop [-h] [-x] [-p PID]
#
# Copyright (c) 2015 Brendan Gregg.
# Licensed under the Apache License, Version 2.0 (the "License")
...
...
@@ -15,12 +15,12 @@
from
__future__
import
print_function
from
bcc
import
BPF
import
argparse
from
time
import
strftime
import
ctypes
as
ct
# arguments
examples
=
"""examples:
./killsnoop # trace all kill() signals
./killsnoop -t # include timestamps
./killsnoop -x # only show failed kills
./killsnoop -p 181 # only trace PID 181
"""
...
...
@@ -28,8 +28,6 @@ parser = argparse.ArgumentParser(
description
=
"Trace signals issued by the kill() syscall"
,
formatter_class
=
argparse
.
RawDescriptionHelpFormatter
,
epilog
=
examples
)
parser
.
add_argument
(
"-t"
,
"--timestamp"
,
action
=
"store_true"
,
help
=
"include timestamp on output"
)
parser
.
add_argument
(
"-x"
,
"--failed"
,
action
=
"store_true"
,
help
=
"only show failed kill syscalls"
)
parser
.
add_argument
(
"-p"
,
"--pid"
,
...
...
@@ -44,7 +42,6 @@ bpf_text = """
struct val_t {
u64 pid;
u64 ts;
int sig;
int tpid;
char comm[TASK_COMM_LEN];
...
...
@@ -55,8 +52,6 @@ struct data_t {
u64 tpid;
int sig;
int ret;
u64 ts;
u64 delta;
char comm[TASK_COMM_LEN];
};
...
...
@@ -71,7 +66,6 @@ int kprobe__sys_kill(struct pt_regs *ctx, int tpid, int sig)
FILTER
if (bpf_get_current_comm(&val.comm, sizeof(val.comm)) == 0) {
val.pid = bpf_get_current_pid_tgid();
val.ts = bpf_ktime_get_ns();
val.tpid = tpid;
val.sig = sig;
infotmp.update(&pid, &val);
...
...
@@ -85,7 +79,6 @@ int kretprobe__sys_kill(struct pt_regs *ctx)
struct data_t data = {};
struct val_t *valp;
u32 pid = bpf_get_current_pid_tgid();
u64 tsp = bpf_ktime_get_ns();
valp = infotmp.lookup(&pid);
if (valp == 0) {
...
...
@@ -95,8 +88,6 @@ int kretprobe__sys_kill(struct pt_regs *ctx)
bpf_probe_read(&data.comm, sizeof(data.comm), valp->comm);
data.pid = pid;
data.delta = tsp - valp->ts;
data.ts = tsp / 1000;
data.tpid = valp->tpid;
data.ret = PT_REGS_RC(ctx);
data.sig = valp->sig;
...
...
@@ -126,47 +117,21 @@ class Data(ct.Structure):
(
"tpid"
,
ct
.
c_ulonglong
),
(
"sig"
,
ct
.
c_int
),
(
"ret"
,
ct
.
c_int
),
(
"ts"
,
ct
.
c_ulonglong
),
(
"delta"
,
ct
.
c_ulonglong
),
(
"comm"
,
ct
.
c_char
*
TASK_COMM_LEN
)
]
start_ts
=
0
prev_ts
=
0
delta
=
0
# header
if
args
.
timestamp
:
print
(
"%-14s"
%
(
"TIME(s)"
),
end
=
""
)
print
(
"%-6s %-16s %-4s %-6s %s"
%
(
"PID"
,
"COMM"
,
"SIG"
,
"TPID"
,
"RESULT"
))
print
(
"%-9s %-6s %-16s %-4s %-6s %s"
%
(
"TIME"
,
"PID"
,
"COMM"
,
"SIG"
,
"TPID"
,
"RESULT"
))
# process event
def
print_event
(
cpu
,
data
,
size
):
event
=
ct
.
cast
(
data
,
ct
.
POINTER
(
Data
)).
contents
global
start_ts
global
prev_ts
global
delta
if
start_ts
==
0
:
prev_ts
=
start_ts
if
start_ts
==
1
:
delta
=
float
(
delta
)
+
(
event
.
ts
-
prev_ts
)
if
(
args
.
failed
and
(
event
.
ret
>=
0
)):
start_ts
=
1
prev_ts
=
event
.
ts
return
# print columns
if
args
.
timestamp
:
print
(
"%-14.9f"
%
(
delta
/
1000000
),
end
=
""
)
print
(
"%-6d %-16s %-4d %-6d %d"
%
(
event
.
pid
,
event
.
comm
,
event
.
sig
,
event
.
tpid
,
event
.
ret
))
if
(
args
.
failed
and
(
event
.
ret
>=
0
)):
return
pr
ev_ts
=
event
.
ts
start_ts
=
1
pr
int
(
"%-9s %-6d %-16s %-4d %-6d %d"
%
(
strftime
(
"%H:%M:%S"
),
event
.
pid
,
event
.
comm
,
event
.
sig
,
event
.
tpid
,
event
.
ret
))
# loop with callback to print_event
b
[
"events"
].
open_perf_buffer
(
print_event
)
...
...
This diff is collapsed.
Click to expand it.
tools/killsnoop_example.txt
View file @
5eee5ffa
...
...
@@ -4,13 +4,13 @@ Demonstrations of killsnoop, the Linux eBPF/bcc version.
This traces signals sent via the kill() syscall. For example:
# ./killsnoop
PID COMM SIG TPID RESULT
1
7064 bash 9 27682
0
1
7064 bash 9 27682
-3
1
7064 bash 0 17064
0
TIME
PID COMM SIG TPID RESULT
1
2:10:51 13967 bash 9 13885
0
1
2:11:34 13967 bash 9 1024
-3
1
2:11:41 815 systemd-udevd 15 14076
0
The first line showed a SIGKILL (9) sent from PID 1
7064
(a bash shell) to
PID
27682
. The result, 0, means success.
The first line showed a SIGKILL (9) sent from PID 1
3967
(a bash shell) to
PID
13885
. The result, 0, means success.
The second line showed the same signal sent, this time resulting in a -3
(ESRCH: no such process).
...
...
@@ -19,18 +19,16 @@ The second line showed the same signal sent, this time resulting in a -3
USAGE message:
# ./killsnoop -h
usage: killsnoop [-h] [-
t] [-
x] [-p PID]
usage: killsnoop [-h] [-x] [-p PID]
Trace signals issued by the kill() syscall
optional arguments:
-h, --help show this help message and exit
-t, --timestamp include timestamp on output
-x, --failed only show failed kill syscalls
-p PID, --pid PID trace this PID only
examples:
./killsnoop # trace all kill() signals
./killsnoop -t # include timestamps
./killsnoop -x # only show failed kills
./killsnoop -p 181 # only trace PID 181
This diff is collapsed.
Click to expand it.
Write
Preview
Markdown
is supported
0%
Try again
or
attach a new file
Attach a file
Cancel
You are about to add
0
people
to the discussion. Proceed with caution.
Finish editing this message first!
Cancel
Please
register
or
sign in
to comment