1#@!#!123s

: / usr / share / systemtap / examples / process /
Filename : procmod_watcher.stp
back
#!/usr/bin/stap

/*
 * Copyright (C) 2014, 2016 Red Hat Inc.
 *
 * This copyrighted material is made available to anyone wishing to use,
 * modify, copy, or redistribute it subject to the terms and conditions
 * of the GNU General Public License v.2.
 *
 * You should have received a copy of the GNU General Public License
 * along with this program.  If not, see <http://www.gnu.org/licenses/>.
 *
 * Print out all calls to fork(), exec(), exit(), init_module(), and
 * delete_module(). This script does not require debuginfo.
 *
 * Format is:
 * timestamp: EVENT: ( pid) <event details>
 *
 * 2.843626: FORK: ( 410) firewalld: pid 868
 * 2.843831: EXEC: ( 868) firewalld: file /sbin/iptables
 * 2.844514: EXIT: ( 868) iptables: exit code 0
 * 2.844829: FORK: ( 410) firewalld: pid 869
 * 2.845034: EXEC: ( 869) firewalld: file /sbin/iptables
 * 2.845722: EXIT: ( 869) iptables: exit code 0
 * 2.846036: FORK: ( 410) firewalld: pid 870
 * 2.846240: EXEC: ( 870) firewalld: file /sbin/iptables
 *
 */

function print_time() {
   timer = read_stopwatch_us("timer")
   printf("%4d.%.6d: ", timer/1000000, timer%1000000)
}

probe begin {
   start_stopwatch("timer")
   printf("   0.000000: Started procmod_watcher on %s\n",
          ctime(gettimeofday_s()))
}

probe nd_syscall.execve {
   print_time()
   printf("EXEC: (%4d) %s: file %s\n",
          pid(), execname(), argstr)
}

probe nd_syscall.fork.return ?, nd_syscall.clone.return ? {
   print_time()
   printf("FORK: (%4d) %s: pid %s\n",
          pid(), execname(), retstr)
}

probe nd_syscall.exit, nd_syscall.exit_group {
   print_time()
   sig = status & 0x7F
   code = sig ? sig : status >> 8
   printf("EXIT: (%4d) %s: %s %d\n",
          pid(), execname(),
          sig ? "signal" : "exit code", code)
}

probe kernel.trace("module_load") {
   print_time()
   printf("LOAD: (%4d) %s: module %s",
          pid(), execname(),
          kernel_string(@cast($mod, "struct module", "kernel<linux/module.h>")->name))
   args = kernel_string(@cast($mod, "struct module", "kernel<linux/module.h>")->args)
   if (args != "")
      printf(" with args \"%s\"", args)
   println("")
}

probe nd_syscall.delete_module {
   print_time()
   printf("UNLD: (%4d) %s: module %s with flags 0x%x\n",
          pid(), execname(), name_user, flags);
}

probe end {
   print_time()
   printf("Exiting procmod_watcher on %s\n",
          ctime(gettimeofday_s()))
}