1#!/bin/sh
2# #!/usr/bin/sh
3#
4# execsnoop - snoop process execution as it occurs.
5#             Written using DTrace (Solaris 10 3/05).
6#
7# 11-Sep-2005, ver 1.25
8#
9# USAGE:	execsnoop [-a|-A|-ehjsvZ] [-c command]
10#
11#		execsnoop	# default output
12#
13#		-a		# print all data
14#		-A		# dump all data, space delimited
15#		-e		# safe output - parseable
16#		-j		# print project ID
17#		-s		# print start time, us
18#		-v		# print start time, string
19#		-Z		# print zonename
20#		-c command	# command name to snoop
21#	eg,
22#		execsnoop -v		# human readable timestamps
23#		execsnoop -Z		# print zonename
24#		execsnoop -c ls		# snoop ls commands only
25#
26# The parseable output ensures that the ARGS field doesn't contain
27# any "\n"s, which normally sometimes can - and would wreck postprocessing.
28#
29# FIELDS:
30#		UID		User ID
31#		PID		Process ID
32#		PPID		Parent Process ID
33#		COMM		command name for the process
34#		ARGS		argument listing for the process
35#		ZONE		zonename
36#		PROJ		project ID
37#		TIME		timestamp for the command, us
38#		STRTIME		timestamp for the command, string
39#
40# SEE ALSO: BSM auditing.
41#
42# COPYRIGHT: Copyright (c) 2005 Brendan Gregg.
43#
44# CDDL HEADER START
45#
46#  The contents of this file are subject to the terms of the
47#  Common Development and Distribution License, Version 1.0 only
48#  (the "License").  You may not use this file except in compliance
49#  with the License.
50#
51#  You can obtain a copy of the license at Docs/cddl1.txt
52#  or http://www.opensolaris.org/os/licensing.
53#  See the License for the specific language governing permissions
54#  and limitations under the License.
55#
56# CDDL HEADER END
57#
58# Author: Brendan Gregg  [Sydney, Australia]
59#
60# 27-Mar-2004	Brendan Gregg	Created this.
61# 21-Jan-2005	   "	  "	Wrapped in sh to provide options.
62# 08-May-2005 	   "      "	Rewritten for performance.
63# 14-May-2005 	   "      "	Added zonename.
64# 02-Jul-2005 	   "      "	Added projid, safe printing.
65# 11-Sep-2005	   "      "	Increased switchrate.
66# 
67
68
69##############################
70# --- Process Arguments ---
71#
72
73### default variables
74opt_dump=0; opt_cmd=0; opt_time=0; opt_timestr=0; filter=0; command=.
75opt_zone=0; opt_safe=0; opt_proj=0
76
77### process options
78while getopts aAc:ehjsvZ name
79do
80	case $name in
81	a)	opt_time=1; opt_timestr=1; opt_zone=0; opt_proj=1 ;;
82	A)	opt_dump=1 ;;
83	c)	opt_cmd=1; command=$OPTARG ;;
84	e)	opt_safe=1 ;;
85	j)	opt_proj=1 ;;
86	s)	opt_time=1 ;;
87	v)	opt_timestr=1 ;;
88#	Z)	opt_zone=1 ;;
89	h|?)	cat <<-END >&2
90		USAGE: execsnoop [-a|-A|-ehjsvZ] [-c command]
91		       execsnoop                # default output
92		                -a              # print all data
93		                -A              # dump all data, space delimited
94		                -e              # safe output, parseable
95		                -j              # print project ID
96		                -s              # print start time, us
97		                -v              # print start time, string
98		                -c command      # command name to snoop
99		  eg,
100		        execsnoop -v            # human readable timestamps
101		        execsnoop -c ls         # snoop ls commands only
102		END
103		exit 1
104	esac
105done
106
107### option logic
108if [ $opt_dump -eq 1 ]; then
109	opt_time=0; opt_timestr=0; opt_zone=0; opt_proj=0
110fi
111if [ $opt_cmd -eq 1 ]; then
112	filter=1
113fi
114
115
116#################################
117# --- Main Program, DTrace ---
118#
119/usr/sbin/dtrace -n '
120 /*
121  * Command line arguments
122  */
123 inline int OPT_dump 	= '$opt_dump';
124 inline int OPT_cmd 	= '$opt_cmd';
125 inline int OPT_time 	= '$opt_time';
126 inline int OPT_timestr	= '$opt_timestr';
127 inline int OPT_zone 	= '$opt_zone';
128 inline int OPT_safe 	= '$opt_safe';
129 inline int OPT_proj 	= '$opt_proj';
130 inline int FILTER 	= '$filter';
131 inline string COMMAND 	= "'$command'";
132 
133 #pragma D option quiet
134 #pragma D option switchrate=10hz
135 
136 /*
137  * Print header
138  */
139 dtrace:::BEGIN 
140 {
141	/* print optional headers */
142 	OPT_time    ? printf("%-14s ", "TIME") : 1;
143 	OPT_timestr ? printf("%-20s ", "STRTIME") : 1;
144 	OPT_zone    ? printf("%-10s ", "ZONE") : 1;
145 	OPT_proj    ? printf("%5s ", "PROJ") : 1;
146
147	/* print main headers */
148	/* APPLE: Removed "ZONE" header, it has no meaning in darwin */
149	OPT_dump    ? printf("%s %s %s %s %s %s %s\n",
150	    "TIME", "PROJ", "UID", "PID", "PPID", "COMM", "ARGS") :
151	    printf("%5s %6s %6s %s\n", "UID", "PID", "PPID", "ARGS");
152 }
153
154 /*
155  * Print exec event
156  */
157 /* SOLARIS: syscall::exec:return, syscall::exece:return */
158 syscall::execve:return,
159 syscall::posix_spawn:return
160 /(FILTER == 0) || (OPT_cmd == 1 && COMMAND == strstr(COMMAND, execname)) || (OPT_cmd == 1 && execname == strstr(execname, COMMAND))/ 
161 {
162	/* print optional fields */
163 	OPT_time ? printf("%-14d ", timestamp/1000) : 1;
164	OPT_timestr ? printf("%-20Y ", walltimestamp) : 1;
165 	OPT_zone ? printf("%-10s ", zonename) : 1;
166 	OPT_proj ? printf("%5d ", curpsinfo->pr_projid) : 1;
167
168	/* print main data */
169	/* APPLE: Removed the zonename output, it has no meaning in darwin */
170	OPT_dump ? printf("%d %d %d %d %d %s ", timestamp/1000,
171	    curpsinfo->pr_projid, uid, pid, ppid, execname) :
172	    printf("%5d %6d %6d ", uid, pid, ppid);
173	OPT_safe ? printf("%S\n", curpsinfo->pr_psargs) :
174	    printf("%s\n", curpsinfo->pr_psargs);
175 }
176'
177