diff options
Diffstat (limited to 'execsnoop')
| -rwxr-xr-x | execsnoop | 174 |
1 files changed, 174 insertions, 0 deletions
diff --git a/execsnoop b/execsnoop new file mode 100755 index 000000000000..96e647c2482c --- /dev/null +++ b/execsnoop @@ -0,0 +1,174 @@ +#!/usr/bin/sh +# +# execsnoop - snoop process execution as it occurs. +# Written using DTrace (Solaris 10 3/05). +# +# $Id: execsnoop 3 2007-08-01 10:50:08Z brendan $ +# +# USAGE: execsnoop [-a|-A|-ehjsvZ] [-c command] +# +# execsnoop # default output +# +# -a # print all data +# -A # dump all data, space delimited +# -e # safe output - parseable +# -j # print project ID +# -s # print start time, us +# -v # print start time, string +# -Z # print zonename +# -c command # command name to snoop +# eg, +# execsnoop -v # human readable timestamps +# execsnoop -Z # print zonename +# execsnoop -c ls # snoop ls commands only +# +# The parseable output ensures that the ARGS field doesn't contain +# any "\n"s, which normally sometimes can - and would wreck postprocessing. +# +# FIELDS: +# UID User ID +# PID Process ID +# PPID Parent Process ID +# COMM command name for the process +# ARGS argument listing for the process +# ZONE zonename +# PROJ project ID +# TIME timestamp for the command, us +# STRTIME timestamp for the command, string +# +# SEE ALSO: BSM auditing. +# +# COPYRIGHT: Copyright (c) 2005 Brendan Gregg. +# +# CDDL HEADER START +# +# The contents of this file are subject to the terms of the +# Common Development and Distribution License, Version 1.0 only +# (the "License"). You may not use this file except in compliance +# with the License. +# +# You can obtain a copy of the license at Docs/cddl1.txt +# or http://www.opensolaris.org/os/licensing. +# See the License for the specific language governing permissions +# and limitations under the License. +# +# CDDL HEADER END +# +# Author: Brendan Gregg [Sydney, Australia] +# +# 27-Mar-2004 Brendan Gregg Created this. +# 21-Jan-2005 " " Wrapped in sh to provide options. +# 08-May-2005 " " Rewritten for performance. +# 14-May-2005 " " Added zonename. +# 02-Jul-2005 " " Added projid, safe printing. +# 11-Sep-2005 " " Increased switchrate. +# 11-Sep-2005 " " Last update. +# + + +############################## +# --- Process Arguments --- +# + +### default variables +opt_dump=0; opt_cmd=0; opt_time=0; opt_timestr=0; filter=0; command=. +opt_zone=0; opt_safe=0; opt_proj=0 + +### process options +while getopts aAc:ehjsvZ name +do + case $name in + a) opt_time=1; opt_timestr=1; opt_zone=1; opt_proj=1 ;; + A) opt_dump=1 ;; + c) opt_cmd=1; command=$OPTARG ;; + e) opt_safe=1 ;; + j) opt_proj=1 ;; + s) opt_time=1 ;; + v) opt_timestr=1 ;; + Z) opt_zone=1 ;; + h|?) cat <<-END >&2 + USAGE: execsnoop [-a|-A|-ehjsvZ] [-c command] + execsnoop # default output + -a # print all data + -A # dump all data, space delimited + -e # safe output, parseable + -j # print project ID + -s # print start time, us + -v # print start time, string + -Z # print zonename + -c command # command name to snoop + eg, + execsnoop -v # human readable timestamps + execsnoop -Z # print zonename + execsnoop -c ls # snoop ls commands only + END + exit 1 + esac +done + +### option logic +if [ $opt_dump -eq 1 ]; then + opt_time=0; opt_timestr=0; opt_zone=0; opt_proj=0 +fi +if [ $opt_cmd -eq 1 ]; then + filter=1 +fi + + +################################# +# --- Main Program, DTrace --- +# +/usr/sbin/dtrace -n ' + /* + * Command line arguments + */ + inline int OPT_dump = '$opt_dump'; + inline int OPT_cmd = '$opt_cmd'; + inline int OPT_time = '$opt_time'; + inline int OPT_timestr = '$opt_timestr'; + inline int OPT_zone = '$opt_zone'; + inline int OPT_safe = '$opt_safe'; + inline int OPT_proj = '$opt_proj'; + inline int FILTER = '$filter'; + inline string COMMAND = "'$command'"; + + #pragma D option quiet + #pragma D option switchrate=10hz + + /* + * Print header + */ + dtrace:::BEGIN + { + /* print optional headers */ + OPT_time ? printf("%-14s ", "TIME") : 1; + OPT_timestr ? printf("%-20s ", "STRTIME") : 1; + OPT_zone ? printf("%-10s ", "ZONE") : 1; + OPT_proj ? printf("%5s ", "PROJ") : 1; + + /* print main headers */ + OPT_dump ? printf("%s %s %s %s %s %s %s %s\n", + "TIME", "ZONE", "PROJ", "UID", "PID", "PPID", "COMM", "ARGS") : + printf("%5s %6s %6s %s\n", "UID", "PID", "PPID", "ARGS"); + } + + /* + * Print exec event + */ + syscall::exec:return, syscall::exece:return + /(FILTER == 0) || (OPT_cmd == 1 && COMMAND == execname)/ + { + /* print optional fields */ + OPT_time ? printf("%-14d ", timestamp/1000) : 1; + OPT_timestr ? printf("%-20Y ", walltimestamp) : 1; + OPT_zone ? printf("%-10s ", zonename) : 1; + OPT_proj ? printf("%5d ", curpsinfo->pr_projid) : 1; + + /* print main data */ + OPT_dump ? printf("%d %s %d %d %d %d %s ", timestamp/1000, + zonename, curpsinfo->pr_projid, uid, pid, ppid, execname) : + printf("%5d %6d %6d ", uid, pid, ppid); + OPT_safe ? printf("%S\n", curpsinfo->pr_psargs) : + printf("%s\n", curpsinfo->pr_psargs); + } +' |