1N/A#!/usr/bin/sh
1N/A#
1N/A# execsnoop - snoop process execution as it occurs.
1N/A# Written using DTrace (Solaris 10 3/05).
1N/A#
1N/A# $Id: execsnoop 3 2007-08-01 10:50:08Z brendan $
1N/A#
1N/A# USAGE: execsnoop [-a|-A|-ehjsvZ] [-c command]
1N/A#
1N/A# execsnoop # default output
1N/A#
1N/A# -a # print all data
1N/A# -A # dump all data, space delimited
1N/A# -e # safe output - parseable
1N/A# -j # print project ID
1N/A# -s # print start time, us
1N/A# -v # print start time, string
1N/A# -Z # print zonename
1N/A# -c command # command name to snoop
1N/A# eg,
1N/A# execsnoop -v # human readable timestamps
1N/A# execsnoop -Z # print zonename
1N/A# execsnoop -c ls # snoop ls commands only
1N/A#
1N/A# The parseable output ensures that the ARGS field doesn't contain
1N/A# any "\n"s, which normally sometimes can - and would wreck postprocessing.
1N/A#
1N/A# FIELDS:
1N/A# UID User ID
1N/A# PID Process ID
1N/A# PPID Parent Process ID
1N/A# COMM command name for the process
1N/A# ARGS argument listing for the process
1N/A# ZONE zonename
1N/A# PROJ project ID
1N/A# TIME timestamp for the command, us
1N/A# STRTIME timestamp for the command, string
1N/A#
1N/A# SEE ALSO: BSM auditing.
1N/A#
1N/A# COPYRIGHT: Copyright (c) 2005 Brendan Gregg.
1N/A#
1N/A# CDDL HEADER START
1N/A#
1N/A# The contents of this file are subject to the terms of the
1N/A# Common Development and Distribution License, Version 1.0 only
1N/A# (the "License"). You may not use this file except in compliance
1N/A# with the License.
1N/A#
1N/A# You can obtain a copy of the license at Docs/cddl1.txt
1N/A# or http://www.opensolaris.org/os/licensing.
1N/A# See the License for the specific language governing permissions
1N/A# and limitations under the License.
1N/A#
1N/A# CDDL HEADER END
1N/A#
1N/A# Author: Brendan Gregg [Sydney, Australia]
1N/A#
1N/A# 27-Mar-2004 Brendan Gregg Created this.
1N/A# 21-Jan-2005 " " Wrapped in sh to provide options.
1N/A# 08-May-2005 " " Rewritten for performance.
1N/A# 14-May-2005 " " Added zonename.
1N/A# 02-Jul-2005 " " Added projid, safe printing.
1N/A# 11-Sep-2005 " " Increased switchrate.
1N/A# 11-Sep-2005 " " Last update.
1N/A#
1N/A
1N/A
1N/A##############################
1N/A# --- Process Arguments ---
1N/A#
1N/A
1N/A### default variables
1N/Aopt_dump=0; opt_cmd=0; opt_time=0; opt_timestr=0; filter=0; command=.
1N/Aopt_zone=0; opt_safe=0; opt_proj=0
1N/A
1N/A### process options
1N/Awhile getopts aAc:ehjsvZ name
1N/Ado
1N/A case $name in
1N/A a) opt_time=1; opt_timestr=1; opt_zone=1; opt_proj=1 ;;
1N/A A) opt_dump=1 ;;
1N/A c) opt_cmd=1; command=$OPTARG ;;
1N/A e) opt_safe=1 ;;
1N/A j) opt_proj=1 ;;
1N/A s) opt_time=1 ;;
1N/A v) opt_timestr=1 ;;
1N/A Z) opt_zone=1 ;;
1N/A h|?) cat <<-END >&2
1N/A USAGE: execsnoop [-a|-A|-ehjsvZ] [-c command]
1N/A execsnoop # default output
1N/A -a # print all data
1N/A -A # dump all data, space delimited
1N/A -e # safe output, parseable
1N/A -j # print project ID
1N/A -s # print start time, us
1N/A -v # print start time, string
1N/A -Z # print zonename
1N/A -c command # command name to snoop
1N/A eg,
1N/A execsnoop -v # human readable timestamps
1N/A execsnoop -Z # print zonename
1N/A execsnoop -c ls # snoop ls commands only
1N/A END
1N/A exit 1
1N/A esac
1N/Adone
1N/A
1N/A### option logic
1N/Aif [ $opt_dump -eq 1 ]; then
1N/A opt_time=0; opt_timestr=0; opt_zone=0; opt_proj=0
1N/Afi
1N/Aif [ $opt_cmd -eq 1 ]; then
1N/A filter=1
1N/Afi
1N/A
1N/A
1N/A#################################
1N/A# --- Main Program, DTrace ---
1N/A#
1N/A/usr/sbin/dtrace -n '
1N/A /*
1N/A * Command line arguments
1N/A */
1N/A inline int OPT_dump = '$opt_dump';
1N/A inline int OPT_cmd = '$opt_cmd';
1N/A inline int OPT_time = '$opt_time';
1N/A inline int OPT_timestr = '$opt_timestr';
1N/A inline int OPT_zone = '$opt_zone';
1N/A inline int OPT_safe = '$opt_safe';
1N/A inline int OPT_proj = '$opt_proj';
1N/A inline int FILTER = '$filter';
1N/A inline string COMMAND = "'$command'";
1N/A
1N/A #pragma D option quiet
1N/A #pragma D option switchrate=10hz
1N/A
1N/A /*
1N/A * Print header
1N/A */
1N/A dtrace:::BEGIN
1N/A {
1N/A /* print optional headers */
1N/A OPT_time ? printf("%-14s ", "TIME") : 1;
1N/A OPT_timestr ? printf("%-20s ", "STRTIME") : 1;
1N/A OPT_zone ? printf("%-10s ", "ZONE") : 1;
1N/A OPT_proj ? printf("%5s ", "PROJ") : 1;
1N/A
1N/A /* print main headers */
1N/A OPT_dump ? printf("%s %s %s %s %s %s %s %s\n",
1N/A "TIME", "ZONE", "PROJ", "UID", "PID", "PPID", "COMM", "ARGS") :
1N/A printf("%5s %6s %6s %s\n", "UID", "PID", "PPID", "ARGS");
1N/A }
1N/A
1N/A /*
1N/A * Print exec event
1N/A */
1N/A syscall::exece:return
1N/A /(FILTER == 0) || (OPT_cmd == 1 && COMMAND == execname)/
1N/A {
1N/A /* print optional fields */
1N/A OPT_time ? printf("%-14d ", timestamp/1000) : 1;
1N/A OPT_timestr ? printf("%-20Y ", walltimestamp) : 1;
1N/A OPT_zone ? printf("%-10s ", zonename) : 1;
1N/A OPT_proj ? printf("%5d ", curpsinfo->pr_projid) : 1;
1N/A
1N/A /* print main data */
1N/A OPT_dump ? printf("%d %s %d %d %d %d %s ", timestamp/1000,
1N/A zonename, curpsinfo->pr_projid, uid, pid, ppid, execname) :
1N/A printf("%5d %6d %6d ", uid, pid, ppid);
1N/A OPT_safe ? printf("%S\n", curpsinfo->pr_psargs) :
1N/A printf("%s\n", curpsinfo->pr_psargs);
1N/A }
1N/A'