Deleted Added
sdiff udiff text old ( 235455 ) new ( 239972 )
full compact
execsnoop (235455) execsnoop (239972)
1#!/bin/sh
2#
3# execsnoop - snoop process execution as it occurs.
4# Written using DTrace (Solaris 10 3/05).
5#
6# $Id: execsnoop 3 2007-08-01 10:50:08Z brendan $
7#
1#!/bin/sh
2#
3# execsnoop - snoop process execution as it occurs.
4# Written using DTrace (Solaris 10 3/05).
5#
6# $Id: execsnoop 3 2007-08-01 10:50:08Z brendan $
7#
8# USAGE: execsnoop [-a|-A|-ehjsvZ] [-c command]
8# USAGE: execsnoop [-a|-A|-ehsvJ] [-c command]
9#
10# execsnoop # default output
11#
12# -a # print all data
13# -A # dump all data, space delimited
14# -e # safe output - parseable
9#
10# execsnoop # default output
11#
12# -a # print all data
13# -A # dump all data, space delimited
14# -e # safe output - parseable
15# -j # print project ID
16# -s # print start time, us
17# -v # print start time, string
15# -s # print start time, us
16# -v # print start time, string
18# -Z # print zonename
17# -J # print jail ID
19# -c command # command name to snoop
20# eg,
21# execsnoop -v # human readable timestamps
18# -c command # command name to snoop
19# eg,
20# execsnoop -v # human readable timestamps
22# execsnoop -Z # print zonename
21# execsnoop -J # print jail ID
23# execsnoop -c ls # snoop ls commands only
24#
25# The parseable output ensures that the ARGS field doesn't contain
26# any "\n"s, which normally sometimes can - and would wreck postprocessing.
27#
28# FIELDS:
29# UID User ID
30# PID Process ID
31# PPID Parent Process ID
32# COMM command name for the process
33# ARGS argument listing for the process
22# execsnoop -c ls # snoop ls commands only
23#
24# The parseable output ensures that the ARGS field doesn't contain
25# any "\n"s, which normally sometimes can - and would wreck postprocessing.
26#
27# FIELDS:
28# UID User ID
29# PID Process ID
30# PPID Parent Process ID
31# COMM command name for the process
32# ARGS argument listing for the process
34# ZONE zonename
35# PROJ project ID
33# JAIL ID Jail ID
36# TIME timestamp for the command, us
37# STRTIME timestamp for the command, string
38#
39# SEE ALSO: BSM auditing.
40#
41# COPYRIGHT: Copyright (c) 2005 Brendan Gregg.
42#
43# CDDL HEADER START

--- 23 unchanged lines hidden (view full) ---

67
68
69##############################
70# --- Process Arguments ---
71#
72
73### default variables
74opt_dump=0; opt_cmd=0; opt_time=0; opt_timestr=0; filter=0; command=.
34# TIME timestamp for the command, us
35# STRTIME timestamp for the command, string
36#
37# SEE ALSO: BSM auditing.
38#
39# COPYRIGHT: Copyright (c) 2005 Brendan Gregg.
40#
41# CDDL HEADER START

--- 23 unchanged lines hidden (view full) ---

65
66
67##############################
68# --- Process Arguments ---
69#
70
71### default variables
72opt_dump=0; opt_cmd=0; opt_time=0; opt_timestr=0; filter=0; command=.
75opt_zone=0; opt_safe=0; opt_proj=0
73opt_jailid=0; opt_safe=0
76
77### process options
74
75### process options
78while getopts aAc:ehjsvZ name
76while getopts aAc:ehsvJ name
79do
80 case $name in
77do
78 case $name in
81 a) opt_time=1; opt_timestr=1; opt_zone=1; opt_proj=1 ;;
79 a) opt_time=1; opt_timestr=1; opt_jailid=1 ;;
82 A) opt_dump=1 ;;
83 c) opt_cmd=1; command=$OPTARG ;;
84 e) opt_safe=1 ;;
80 A) opt_dump=1 ;;
81 c) opt_cmd=1; command=$OPTARG ;;
82 e) opt_safe=1 ;;
85 j) opt_proj=1 ;;
86 s) opt_time=1 ;;
87 v) opt_timestr=1 ;;
83 s) opt_time=1 ;;
84 v) opt_timestr=1 ;;
88 Z) opt_zone=1 ;;
85 J) opt_jailid=1 ;;
89 h|?) cat <<-END >&2
86 h|?) cat <<-END >&2
90 USAGE: execsnoop [-a|-A|-ehjsvZ] [-c command]
87 USAGE: execsnoop [-a|-A|-ehjsvJ] [-c command]
91 execsnoop # default output
92 -a # print all data
93 -A # dump all data, space delimited
94 -e # safe output, parseable
88 execsnoop # default output
89 -a # print all data
90 -A # dump all data, space delimited
91 -e # safe output, parseable
95 -j # print project ID
96 -s # print start time, us
97 -v # print start time, string
92 -s # print start time, us
93 -v # print start time, string
98 -Z # print zonename
94 -J # print jail ID
99 -c command # command name to snoop
100 eg,
101 execsnoop -v # human readable timestamps
95 -c command # command name to snoop
96 eg,
97 execsnoop -v # human readable timestamps
102 execsnoop -Z # print zonename
98 execsnoop -J # print jail ID
103 execsnoop -c ls # snoop ls commands only
104 END
105 exit 1
106 esac
107done
108
109### option logic
110if [ $opt_dump -eq 1 ]; then
99 execsnoop -c ls # snoop ls commands only
100 END
101 exit 1
102 esac
103done
104
105### option logic
106if [ $opt_dump -eq 1 ]; then
111 opt_time=0; opt_timestr=0; opt_zone=0; opt_proj=0
107 opt_time=0; opt_timestr=0; opt_jailid=0
112fi
113if [ $opt_cmd -eq 1 ]; then
114 filter=1
115fi
116
117
118#################################
119# --- Main Program, DTrace ---
120#
121/usr/sbin/dtrace -n '
122 /*
123 * Command line arguments
124 */
125 inline int OPT_dump = '$opt_dump';
126 inline int OPT_cmd = '$opt_cmd';
127 inline int OPT_time = '$opt_time';
128 inline int OPT_timestr = '$opt_timestr';
108fi
109if [ $opt_cmd -eq 1 ]; then
110 filter=1
111fi
112
113
114#################################
115# --- Main Program, DTrace ---
116#
117/usr/sbin/dtrace -n '
118 /*
119 * Command line arguments
120 */
121 inline int OPT_dump = '$opt_dump';
122 inline int OPT_cmd = '$opt_cmd';
123 inline int OPT_time = '$opt_time';
124 inline int OPT_timestr = '$opt_timestr';
129 inline int OPT_zone = '$opt_zone';
125 inline int OPT_jailid = '$opt_jailid';
130 inline int OPT_safe = '$opt_safe';
126 inline int OPT_safe = '$opt_safe';
131 inline int OPT_proj = '$opt_proj';
132 inline int FILTER = '$filter';
133 inline string COMMAND = "'$command'";
134
135 #pragma D option quiet
136 #pragma D option switchrate=10hz
137
138 /*
139 * Print header
140 */
141 dtrace:::BEGIN
142 {
143 /* print optional headers */
144 OPT_time ? printf("%-14s ", "TIME") : 1;
145 OPT_timestr ? printf("%-20s ", "STRTIME") : 1;
127 inline int FILTER = '$filter';
128 inline string COMMAND = "'$command'";
129
130 #pragma D option quiet
131 #pragma D option switchrate=10hz
132
133 /*
134 * Print header
135 */
136 dtrace:::BEGIN
137 {
138 /* print optional headers */
139 OPT_time ? printf("%-14s ", "TIME") : 1;
140 OPT_timestr ? printf("%-20s ", "STRTIME") : 1;
146 OPT_zone ? printf("%-10s ", "ZONE") : 1;
147 OPT_proj ? printf("%5s ", "PROJ") : 1;
141 OPT_jailid ? printf("%-10s ", "JAIL ID") : 1;
148
149 /* print main headers */
142
143 /* print main headers */
150 OPT_dump ? printf("%s %s %s %s %s %s %s %s\n",
151 "TIME", "ZONE", "PROJ", "UID", "PID", "PPID", "COMM", "ARGS") :
144 OPT_dump ? printf("%s %s %s %s %s %s %s\n",
145 "TIME", "JAIL ID", "UID", "PID", "PPID", "COMM", "ARGS") :
152 printf("%5s %6s %6s %s\n", "UID", "PID", "PPID", "ARGS");
153 }
154
155 /*
156 * Print exec event
157 */
158 syscall::execve:return
159 /(FILTER == 0) || (OPT_cmd == 1 && COMMAND == execname)/
160 {
161 /* print optional fields */
162 OPT_time ? printf("%-14d ", timestamp/1000) : 1;
163 OPT_timestr ? printf("%-20Y ", walltimestamp) : 1;
146 printf("%5s %6s %6s %s\n", "UID", "PID", "PPID", "ARGS");
147 }
148
149 /*
150 * Print exec event
151 */
152 syscall::execve:return
153 /(FILTER == 0) || (OPT_cmd == 1 && COMMAND == execname)/
154 {
155 /* print optional fields */
156 OPT_time ? printf("%-14d ", timestamp/1000) : 1;
157 OPT_timestr ? printf("%-20Y ", walltimestamp) : 1;
164 OPT_zone ? printf("%-10s ", zonename) : 1;
165 OPT_proj ? printf("%5d ", curpsinfo->pr_projid) : 1;
158 OPT_jailid ? printf("%-10d ", curpsinfo->pr_jailid) : 1;
166
167 /* print main data */
159
160 /* print main data */
168 OPT_dump ? printf("%d %s %d %d %d %d %s ", timestamp/1000,
169 zonename, curpsinfo->pr_projid, uid, pid, ppid, execname) :
161 OPT_dump ? printf("%d %d %d %d %d %s ", timestamp/1000,
162 curpsinfo->pr_jailid, uid, pid, ppid, execname) :
170 printf("%5d %6d %6d ", uid, pid, ppid);
171 OPT_safe ? printf("%S\n", curpsinfo->pr_psargs) :
172 printf("%s\n", curpsinfo->pr_psargs);
173 }
174'
163 printf("%5d %6d %6d ", uid, pid, ppid);
164 OPT_safe ? printf("%S\n", curpsinfo->pr_psargs) :
165 printf("%s\n", curpsinfo->pr_psargs);
166 }
167'