forked from bpftrace/bpftrace
-
Notifications
You must be signed in to change notification settings - Fork 0
/
statsnoop_example.txt
58 lines (50 loc) · 2.67 KB
/
statsnoop_example.txt
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
Demonstrations of statsnoop, the Linux bpftrace/eBPF version.
statsnoop traces different stat() syscalls system-wide, and prints details.
Example output:
# ./statsnoop.bt
Attaching 9 probes...
Tracing stat syscalls... Hit Ctrl-C to end.
PID COMM ERR PATH
27835 bash 0 .
27835 bash 2 /usr/local/sbin/iconfig
27835 bash 2 /usr/local/bin/iconfig
27835 bash 2 /usr/sbin/iconfig
27835 bash 2 /usr/bin/iconfig
27835 bash 2 /sbin/iconfig
27835 bash 2 /bin/iconfig
27835 bash 2 /usr/games/iconfig
27835 bash 2 /usr/local/games/iconfig
27835 bash 2 /snap/bin/iconfig
27835 bash 2 /apps/python/bin/iconfig
30573 command-not-fou 2 /usr/bin/Modules/Setup
30573 command-not-fou 2 /usr/bin/lib/python3.5/os.py
30573 command-not-fou 2 /usr/bin/lib/python3.5/os.pyc
30573 command-not-fou 0 /usr/lib/python3.5/os.py
30573 command-not-fou 2 /usr/bin/pybuilddir.txt
30573 command-not-fou 2 /usr/bin/lib/python3.5/lib-dynload
30573 command-not-fou 0 /usr/lib/python3.5/lib-dynload
30573 command-not-fou 2 /usr/lib/python35.zip
30573 command-not-fou 0 /usr/lib
30573 command-not-fou 2 /usr/lib/python35.zip
30573 command-not-fou 0 /usr/lib/python3.5/
30573 command-not-fou 0 /usr/lib/python3.5/
30573 command-not-fou 0 /usr/lib/python3.5/
30573 command-not-fou 2 /usr/lib/python3.5/encodings/__init__.cpython-35m-x86_64-linux-
30573 command-not-fou 2 /usr/lib/python3.5/encodings/__init__.abi3.so
30573 command-not-fou 2 /usr/lib/python3.5/encodings/__init__.so
30573 command-not-fou 0 /usr/lib/python3.5/encodings/__init__.py
30573 command-not-fou 0 /usr/lib/python3.5/encodings/__init__.py
This output has caught me mistyping a command in another shell, "iconfig"
instead of "ifconfig". The first several lines show the bash shell searching
the $PATH (why is games in my $PATH??), and failing to find it (ERR == 2 is
file not found). Then, a "command-not-found" program executes (the name is
truncated to 16 characters in the COMM field, including the NULL), which
begins the process of searching for and suggesting a package. ie, this:
# iconfig
The program 'iconfig' is currently not installed. You can install it by typing:
apt install ipmiutil
statsnoop can be used for general debugging, to see what file information has
been requested, and whether those files exist. It can be used as a companion
to opensnoop, which shows what files were actually opened.
There is another version of this tool in bcc: https://github.com/iovisor/bcc
The bcc version provides options to customize the output.