1N/A#!/usr/bin/sh
1N/A#
1N/A# opensnoop - snoop file opens as they occur.
1N/A# Written using DTrace (Solaris 10 3/05).
1N/A#
1N/A# $Id: opensnoop 3 2007-08-01 10:50:08Z brendan $
1N/A#
1N/A# USAGE: opensnoop [-a|-A|-ceghsvxZ] [-f pathname] [-n name] [-p PID]
1N/A#
1N/A# opensnoop # default output
1N/A#
1N/A# -a # print most data
1N/A# -A # dump all data, space delimited
1N/A# -c # print cwd of process
1N/A# -e # print errno value
1N/A# -g # print command arguments
1N/A# -s # print start time, us
1N/A# -v # print start time, string
1N/A# -x # only print failed opens
1N/A# -Z # print zonename
1N/A# -f pathname # file pathname to snoop
1N/A# -n name # command name to snoop
1N/A# -p PID # process ID to snoop
1N/A# eg,
1N/A# opensnoop -v # human readable timestamps
1N/A# opensnoop -e # see error codes
1N/A# opensnoop -f /etc/passwd # snoop this file only
1N/A#
1N/A# FIELDS:
1N/A# ZONE Zone name
1N/A# UID User ID
1N/A# PID Process ID
1N/A# PPID Parent Process ID
1N/A# FD file descriptor (-1 for error)
1N/A# ERR errno value (see /usr/include/sys/errno.h)
1N/A# CWD print current working directory of process
1N/A# PATH pathname for file open
1N/A# COMM command name for the process
1N/A# ARGS argument listing for the process
1N/A# TIME timestamp for the open event, us
1N/A# STRTIME timestamp for the open event, string
1N/A#
1N/A# SEE ALSO: truss, BSM auditing.
1N/A#
1N/A# COPYRIGHT: Copyright (c) 2006 Brendan Gregg.
1N/A#
1N/A# CDDL HEADER START
1N/A#
1N/A# The contents of this file are subject to the terms of the
1N/A# Common Development and Distribution License, Version 1.0 only
1N/A# (the "License"). You may not use this file except in compliance
1N/A# with the License.
1N/A#
1N/A# You can obtain a copy of the license at Docs/cddl1.txt
1N/A# or http://www.opensolaris.org/os/licensing.
1N/A# See the License for the specific language governing permissions
1N/A# and limitations under the License.
1N/A#
1N/A# CDDL HEADER END
1N/A#
1N/A# Author: Brendan Gregg [Sydney, Australia]
1N/A#
1N/A# 09-May-2004 Brendan Gregg Created this.
1N/A# 21-Jan-2005 " " Wrapped in sh to provide options.
1N/A# 08-May-2005 " " Rewritten for performance.
1N/A# 14-May-2005 " " Added errno.
1N/A# 28-Jun-2005 " " Added cwd, zonename.
1N/A# 17-Sep-2005 " " Increased switchrate, fixed page fault bug.
1N/A# 16-Jan-2006 " " Added -n, -p.
1N/A# 16-Jan-2006 " " Last update.
1N/A#
1N/A
1N/A
1N/A##############################
1N/A# --- Process Arguments ---
1N/A#
1N/A
1N/A### Default variables
1N/Aopt_dump=0; opt_file=0; opt_time=0; opt_timestr=0; opt_args=0
1N/Aopt_zone=0; opt_cwd=0; opt_failonly=0; opt_err=0; filter=0; pathname=.
1N/Aopt_name=0; opt_pid=0; pname=.; pid=0
1N/A
1N/A### Process options
1N/Awhile getopts aAcef:ghn:p:svxZ name
1N/Ado
1N/A case $name in
1N/A a) opt_time=1; opt_timestr=1; opt_args=1; opt_err=1 ;;
1N/A A) opt_dump=1 ;;
1N/A c) opt_cwd=1 ;;
1N/A e) opt_err=1 ;;
1N/A g) opt_args=1 ;;
1N/A f) opt_file=1; pathname=$OPTARG ;;
1N/A n) opt_name=1; pname=$OPTARG ;;
1N/A p) opt_pid=1; pid=$OPTARG ;;
1N/A s) opt_time=1 ;;
1N/A v) opt_timestr=1 ;;
1N/A x) opt_failonly=1 ;;
1N/A Z) opt_zone=1 ;;
1N/A h|?) cat <<-END >&2
1N/A USAGE: opensnoop [-a|-A|-ceghsvxZ] [-f pathname]
1N/A [-n name] [-p PID]
1N/A opensnoop # default output
1N/A -a # print most data
1N/A -A # dump all data, space delimited
1N/A -c # print cwd of process
1N/A -e # print errno value
1N/A -g # print command arguments
1N/A -s # print start time, us
1N/A -v # print start time, string
1N/A -x # only print failed opens
1N/A -Z # print zonename
1N/A -f pathname # pathname name to snoop
1N/A -n name # process name to snoop
1N/A -p PID # process ID to snoop
1N/A eg,
1N/A opensnoop -v # human readable timestamps
1N/A opensnoop -e # see error codes
1N/A opensnoop -f /etc/motd # snoop this file only
1N/A END
1N/A exit 1
1N/A esac
1N/Adone
1N/A
1N/A### Option logic
1N/Aif [ $opt_dump -eq 1 ]; then
1N/A opt_zone=0; opt_cwd=0; opt_time=0; opt_timestr=0; opt_args=2
1N/Afi
1N/Aif [ $opt_name -eq 1 -o $opt_pid -eq 1 ]; then
1N/A filter=1
1N/Afi
1N/A
1N/A
1N/A#################################
1N/A# --- Main Program, DTrace ---
1N/A#
1N/A/usr/sbin/dtrace -n '
1N/A /*
1N/A * Command line arguments
1N/A */
1N/A inline int OPT_dump = '$opt_dump';
1N/A inline int OPT_file = '$opt_file';
1N/A inline int OPT_args = '$opt_args';
1N/A inline int OPT_cwd = '$opt_cwd';
1N/A inline int OPT_err = '$opt_err';
1N/A inline int OPT_zone = '$opt_zone';
1N/A inline int OPT_time = '$opt_time';
1N/A inline int OPT_timestr = '$opt_timestr';
1N/A inline int OPT_failonly = '$opt_failonly';
1N/A inline int OPT_pid = '$opt_pid';
1N/A inline int OPT_name = '$opt_name';
1N/A inline int FILTER = '$filter';
1N/A inline int PID = '$pid';
1N/A inline string PATHNAME = "'$pathname'";
1N/A inline string NAME = "'$pname'";
1N/A
1N/A #pragma D option quiet
1N/A #pragma D option switchrate=10hz
1N/A
1N/A /*
1N/A * Print header
1N/A */
1N/A dtrace:::BEGIN
1N/A {
1N/A /*
1N/A * ternary operators are used to improve performance.
1N/A * OPT_args is unusual in that it can have one of three values.
1N/A */
1N/A
1N/A /* print optional headers */
1N/A OPT_time ? printf("%-14s ", "TIME") : 1;
1N/A OPT_timestr ? printf("%-20s ", "STRTIME") : 1;
1N/A OPT_zone ? printf("%-10s ", "ZONE") : 1;
1N/A
1N/A /* print dump headers */
1N/A OPT_dump ? printf("%s %s %s %s %s %s %s %s %s %s %s", "ZONE",
1N/A "TIME", "UID", "PID", "PPID", "COMM", "FD", "ERR", "CWD",
1N/A "PATH", "ARGS") : printf("%5s %6s ","UID","PID");
1N/A
1N/A /* print main headers */
1N/A OPT_args == 0 ? printf("%-12s ", "COMM") : 1;
1N/A OPT_dump == 0 ? printf("%3s ", "FD") : 1;
1N/A OPT_err ? printf("%3s ", "ERR") : 1;
1N/A OPT_cwd ? printf("%-20s ", "CWD") : 1;
1N/A OPT_dump == 0 ? printf("%-20s ", "PATH") : 1;
1N/A OPT_args == 1 ? printf("%s", "ARGS") : 1;
1N/A printf("\n");
1N/A }
1N/A
1N/A /*
1N/A * Print open event
1N/A */
1N/A syscall::openat:entry, syscall::openat64:entry
1N/A {
1N/A /* save pathname */
1N/A self->pathp = arg1;
1N/A
1N/A /* default is to trace unless filtering */
1N/A self->ok = FILTER ? 0 : 1;
1N/A
1N/A /* check each filter */
1N/A (OPT_name == 1 && NAME == execname) ? self->ok = 1 : 1;
1N/A (OPT_pid == 1 && PID == pid) ? self->ok = 1 : 1;
1N/A /* OPT_file is checked on return to ensure pathp is mapped */
1N/A }
1N/A
1N/A syscall::openat:return, syscall::openat64:return
1N/A /self->ok && (! OPT_failonly || (int)arg0 < 0) &&
1N/A ((OPT_file == 0) || (OPT_file == 1 && PATHNAME == copyinstr(self->pathp)))/
1N/A {
1N/A /* print optional fields */
1N/A OPT_time ? printf("%-14d ", timestamp/1000) : 1;
1N/A OPT_timestr ? printf("%-20Y ", walltimestamp) : 1;
1N/A OPT_zone ? printf("%-10s ", zonename) : 1;
1N/A
1N/A /* print dump fields */
1N/A OPT_dump ? printf("%s %d %d %d %d %s %d %d %s %s %S", zonename,
1N/A timestamp/1000, uid, pid, ppid, execname, (int)arg0, errno,
1N/A cwd, copyinstr(self->pathp), curpsinfo->pr_psargs) :
1N/A printf("%5d %6d ", uid, pid);
1N/A
1N/A /* print main fields */
1N/A OPT_args == 0 ? printf("%-12s ", execname) : 1;
1N/A OPT_dump == 0 ? printf("%3d ", (int)arg0) : 1;
1N/A OPT_err ? printf("%3d ", errno) : 1;
1N/A OPT_cwd ? printf("%-20s ", cwd) : 1;
1N/A OPT_dump == 0 ? printf("%-20s ", copyinstr(self->pathp)) : 1;
1N/A OPT_args == 1 ? printf("%S", curpsinfo->pr_psargs) : 1;
1N/A printf("\n");
1N/A
1N/A /* cleanup */
1N/A self->pathp = 0;
1N/A self->ok = 0;
1N/A }
1N/A
1N/A /*
1N/A * Cleanup
1N/A */
1N/A syscall::openat:return, syscall::openat64:return
1N/A /self->ok/
1N/A {
1N/A self->pathp = 0;
1N/A self->ok = 0;
1N/A }
1N/A'