286N/A# execsnoop - snoop process execution as it occurs. 286N/A# Written using DTrace (Solaris 10 3/05). 286N/A# $Id: execsnoop 3 2007-08-01 10:50:08Z brendan $ 286N/A# USAGE: execsnoop [-a|-A|-ehjsvZ] [-c command] 286N/A# execsnoop # default output 286N/A# -A # dump all data, space delimited 286N/A# -e # safe output - parseable 286N/A# -s # print start time, us 286N/A# -v # print start time, string 286N/A# -c command # command name to snoop 286N/A# execsnoop -v # human readable timestamps 286N/A# execsnoop -Z # print zonename 286N/A# execsnoop -c ls # snoop ls commands only 286N/A# The parseable output ensures that the ARGS field doesn't contain 286N/A# any "\n"s, which normally sometimes can - and would wreck postprocessing. 286N/A# PPID Parent Process ID 286N/A# COMM command name for the process 286N/A# ARGS argument listing for the process 286N/A# TIME timestamp for the command, us 286N/A# STRTIME timestamp for the command, string 286N/A# SEE ALSO: BSM auditing. 286N/A# COPYRIGHT: Copyright (c) 2005 Brendan Gregg. 286N/A# The contents of this file are subject to the terms of the 286N/A# Common Development and Distribution License, Version 1.0 only 286N/A# (the "License"). You may not use this file except in compliance 286N/A# See the License for the specific language governing permissions 286N/A# and limitations under the License. 286N/A# Author: Brendan Gregg [Sydney, Australia] 286N/A# 27-Mar-2004 Brendan Gregg Created this. 286N/A# 21-Jan-2005 " " Wrapped in sh to provide options. 286N/A# 08-May-2005 " " Rewritten for performance. 286N/A# 14-May-2005 " " Added zonename. 286N/A# 02-Jul-2005 " " Added projid, safe printing. 286N/A# 11-Sep-2005 " " Increased switchrate. 286N/A# 11-Sep-2005 " " Last update. 286N/A############################## 286N/A# --- Process Arguments --- 286N/A USAGE: execsnoop [-a|-A|-ehjsvZ] [-c command] 286N/A execsnoop # default output 286N/A -A # dump all data, space delimited 286N/A -e # safe output, parseable 286N/A -s # print start time, us 286N/A -v # print start time, string 286N/A -c command # command name to snoop 286N/A execsnoop -v # human readable timestamps 286N/A execsnoop -Z # print zonename 286N/A execsnoop -c ls # snoop ls commands only 286N/Aif [ $opt_dump -eq 1 ]; then 286N/A opt_time=0; opt_timestr=0; opt_zone=0; opt_proj=0 286N/Aif [ $opt_cmd -eq 1 ]; then 286N/A################################# 286N/A# --- Main Program, DTrace --- 286N/A * Command line arguments 286N/A inline int OPT_dump = '$opt_dump'; inline int OPT_cmd = '$opt_cmd'; inline int OPT_time = '$opt_time'; inline int OPT_timestr = '$opt_timestr'; inline int OPT_zone = '$opt_zone'; inline int OPT_safe = '$opt_safe'; inline int OPT_proj = '$opt_proj'; inline int FILTER = '$filter'; inline string COMMAND = "'$command'"; #pragma D option switchrate=10hz /* print optional headers */ OPT_time ? printf("%-14s ", "TIME") : 1; OPT_timestr ? printf("%-20s ", "STRTIME") : 1; OPT_zone ? printf("%-10s ", "ZONE") : 1; OPT_proj ? printf("%5s ", "PROJ") : 1; OPT_dump ? printf("%s %s %s %s %s %s %s %s\n", "TIME", "ZONE", "PROJ", "UID", "PID", "PPID", "COMM", "ARGS") : printf("%5s %6s %6s %s\n", "UID", "PID", "PPID", "ARGS"); /(FILTER == 0) || (OPT_cmd == 1 && COMMAND == execname)/ /* print optional fields */ OPT_time ? printf("%-14d ", timestamp/1000) : 1; OPT_timestr ? printf("%-20Y ", walltimestamp) : 1; OPT_zone ? printf("%-10s ", zonename) : 1; OPT_proj ? printf("%5d ", curpsinfo->pr_projid) : 1; OPT_dump ? printf("%d %s %d %d %d %d %s ", timestamp/1000, zonename, curpsinfo->pr_projid, uid, pid, ppid, execname) : printf("%5d %6d %6d ", uid, pid, ppid); OPT_safe ? printf("%S\n", curpsinfo->pr_psargs) : printf("%s\n", curpsinfo->pr_psargs);