1#!/bin/sh 2# #!/usr/bin/sh 3# 4# execsnoop - snoop process execution as it occurs. 5# Written using DTrace (Solaris 10 3/05). 6# 7# 11-Sep-2005, ver 1.25 8# 9# USAGE: execsnoop [-a|-A|-ehjsvZ] [-c command] 10# 11# execsnoop # default output 12# 13# -a # print all data 14# -A # dump all data, space delimited 15# -e # safe output - parseable 16# -j # print project ID 17# -s # print start time, us 18# -v # print start time, string 19# -Z # print zonename 20# -c command # command name to snoop 21# eg, 22# execsnoop -v # human readable timestamps 23# execsnoop -Z # print zonename 24# execsnoop -c ls # snoop ls commands only 25# 26# The parseable output ensures that the ARGS field doesn't contain 27# any "\n"s, which normally sometimes can - and would wreck postprocessing. 28# 29# FIELDS: 30# UID User ID 31# PID Process ID 32# PPID Parent Process ID 33# COMM command name for the process 34# ARGS argument listing for the process 35# ZONE zonename 36# PROJ project ID 37# TIME timestamp for the command, us 38# STRTIME timestamp for the command, string 39# 40# SEE ALSO: BSM auditing. 41# 42# COPYRIGHT: Copyright (c) 2005 Brendan Gregg. 43# 44# CDDL HEADER START 45# 46# The contents of this file are subject to the terms of the 47# Common Development and Distribution License, Version 1.0 only 48# (the "License"). You may not use this file except in compliance 49# with the License. 50# 51# You can obtain a copy of the license at Docs/cddl1.txt 52# or http://www.opensolaris.org/os/licensing. 53# See the License for the specific language governing permissions 54# and limitations under the License. 55# 56# CDDL HEADER END 57# 58# Author: Brendan Gregg [Sydney, Australia] 59# 60# 27-Mar-2004 Brendan Gregg Created this. 61# 21-Jan-2005 " " Wrapped in sh to provide options. 62# 08-May-2005 " " Rewritten for performance. 63# 14-May-2005 " " Added zonename. 64# 02-Jul-2005 " " Added projid, safe printing. 65# 11-Sep-2005 " " Increased switchrate. 66# 67 68 69############################## 70# --- Process Arguments --- 71# 72 73### default variables 74opt_dump=0; opt_cmd=0; opt_time=0; opt_timestr=0; filter=0; command=. 75opt_zone=0; opt_safe=0; opt_proj=0 76 77### process options 78while getopts aAc:ehjsvZ name 79do 80 case $name in 81 a) opt_time=1; opt_timestr=1; opt_zone=0; opt_proj=1 ;; 82 A) opt_dump=1 ;; 83 c) opt_cmd=1; command=$OPTARG ;; 84 e) opt_safe=1 ;; 85 j) opt_proj=1 ;; 86 s) opt_time=1 ;; 87 v) opt_timestr=1 ;; 88# Z) opt_zone=1 ;; 89 h|?) cat <<-END >&2 90 USAGE: execsnoop [-a|-A|-ehjsvZ] [-c command] 91 execsnoop # default output 92 -a # print all data 93 -A # dump all data, space delimited 94 -e # safe output, parseable 95 -j # print project ID 96 -s # print start time, us 97 -v # print start time, string 98 -c command # command name to snoop 99 eg, 100 execsnoop -v # human readable timestamps 101 execsnoop -c ls # snoop ls commands only 102 END 103 exit 1 104 esac 105done 106 107### option logic 108if [ $opt_dump -eq 1 ]; then 109 opt_time=0; opt_timestr=0; opt_zone=0; opt_proj=0 110fi 111if [ $opt_cmd -eq 1 ]; then 112 filter=1 113fi 114 115 116################################# 117# --- Main Program, DTrace --- 118# 119/usr/sbin/dtrace -n ' 120 /* 121 * Command line arguments 122 */ 123 inline int OPT_dump = '$opt_dump'; 124 inline int OPT_cmd = '$opt_cmd'; 125 inline int OPT_time = '$opt_time'; 126 inline int OPT_timestr = '$opt_timestr'; 127 inline int OPT_zone = '$opt_zone'; 128 inline int OPT_safe = '$opt_safe'; 129 inline int OPT_proj = '$opt_proj'; 130 inline int FILTER = '$filter'; 131 inline string COMMAND = "'$command'"; 132 133 #pragma D option quiet 134 #pragma D option switchrate=10hz 135 136 /* 137 * Print header 138 */ 139 dtrace:::BEGIN 140 { 141 /* print optional headers */ 142 OPT_time ? printf("%-14s ", "TIME") : 1; 143 OPT_timestr ? printf("%-20s ", "STRTIME") : 1; 144 OPT_zone ? printf("%-10s ", "ZONE") : 1; 145 OPT_proj ? printf("%5s ", "PROJ") : 1; 146 147 /* print main headers */ 148 /* APPLE: Removed "ZONE" header, it has no meaning in darwin */ 149 OPT_dump ? printf("%s %s %s %s %s %s %s\n", 150 "TIME", "PROJ", "UID", "PID", "PPID", "COMM", "ARGS") : 151 printf("%5s %6s %6s %s\n", "UID", "PID", "PPID", "ARGS"); 152 } 153 154 /* 155 * Print exec event 156 */ 157 /* SOLARIS: syscall::exec:return, syscall::exece:return */ 158 syscall::execve:return, 159 syscall::posix_spawn:return 160 /(FILTER == 0) || (OPT_cmd == 1 && COMMAND == strstr(COMMAND, execname)) || (OPT_cmd == 1 && execname == strstr(execname, COMMAND))/ 161 { 162 /* print optional fields */ 163 OPT_time ? printf("%-14d ", timestamp/1000) : 1; 164 OPT_timestr ? printf("%-20Y ", walltimestamp) : 1; 165 OPT_zone ? printf("%-10s ", zonename) : 1; 166 OPT_proj ? printf("%5d ", curpsinfo->pr_projid) : 1; 167 168 /* print main data */ 169 /* APPLE: Removed the zonename output, it has no meaning in darwin */ 170 OPT_dump ? printf("%d %d %d %d %d %s ", timestamp/1000, 171 curpsinfo->pr_projid, uid, pid, ppid, execname) : 172 printf("%5d %6d %6d ", uid, pid, ppid); 173 OPT_safe ? printf("%S\n", curpsinfo->pr_psargs) : 174 printf("%s\n", curpsinfo->pr_psargs); 175 } 176' 177