| execsnoop (235380) | execsnoop (235455) |
|---|---|
| 1#!/usr/bin/sh | 1#!/bin/sh |
| 2# 3# execsnoop - snoop process execution as it occurs. 4# Written using DTrace (Solaris 10 3/05). 5# 6# $Id: execsnoop 3 2007-08-01 10:50:08Z brendan $ 7# 8# USAGE: execsnoop [-a|-A|-ehjsvZ] [-c command] 9# --- 140 unchanged lines hidden (view full) --- 150 OPT_dump ? printf("%s %s %s %s %s %s %s %s\n", 151 "TIME", "ZONE", "PROJ", "UID", "PID", "PPID", "COMM", "ARGS") : 152 printf("%5s %6s %6s %s\n", "UID", "PID", "PPID", "ARGS"); 153 } 154 155 /* 156 * Print exec event 157 */ | 2# 3# execsnoop - snoop process execution as it occurs. 4# Written using DTrace (Solaris 10 3/05). 5# 6# $Id: execsnoop 3 2007-08-01 10:50:08Z brendan $ 7# 8# USAGE: execsnoop [-a|-A|-ehjsvZ] [-c command] 9# --- 140 unchanged lines hidden (view full) --- 150 OPT_dump ? printf("%s %s %s %s %s %s %s %s\n", 151 "TIME", "ZONE", "PROJ", "UID", "PID", "PPID", "COMM", "ARGS") : 152 printf("%5s %6s %6s %s\n", "UID", "PID", "PPID", "ARGS"); 153 } 154 155 /* 156 * Print exec event 157 */ |
| 158 syscall::exec:return, syscall::exece:return | 158 syscall::execve:return |
| 159 /(FILTER == 0) || (OPT_cmd == 1 && COMMAND == execname)/ 160 { 161 /* print optional fields */ 162 OPT_time ? printf("%-14d ", timestamp/1000) : 1; 163 OPT_timestr ? printf("%-20Y ", walltimestamp) : 1; 164 OPT_zone ? printf("%-10s ", zonename) : 1; 165 OPT_proj ? printf("%5d ", curpsinfo->pr_projid) : 1; 166 167 /* print main data */ 168 OPT_dump ? printf("%d %s %d %d %d %d %s ", timestamp/1000, 169 zonename, curpsinfo->pr_projid, uid, pid, ppid, execname) : 170 printf("%5d %6d %6d ", uid, pid, ppid); 171 OPT_safe ? printf("%S\n", curpsinfo->pr_psargs) : 172 printf("%s\n", curpsinfo->pr_psargs); 173 } 174' | 159 /(FILTER == 0) || (OPT_cmd == 1 && COMMAND == execname)/ 160 { 161 /* print optional fields */ 162 OPT_time ? printf("%-14d ", timestamp/1000) : 1; 163 OPT_timestr ? printf("%-20Y ", walltimestamp) : 1; 164 OPT_zone ? printf("%-10s ", zonename) : 1; 165 OPT_proj ? printf("%5d ", curpsinfo->pr_projid) : 1; 166 167 /* print main data */ 168 OPT_dump ? printf("%d %s %d %d %d %d %s ", timestamp/1000, 169 zonename, curpsinfo->pr_projid, uid, pid, ppid, execname) : 170 printf("%5d %6d %6d ", uid, pid, ppid); 171 OPT_safe ? printf("%S\n", curpsinfo->pr_psargs) : 172 printf("%s\n", curpsinfo->pr_psargs); 173 } 174' |