opensnoop revision 1
ead1f93ee620d7580f7e53350fe5a884fc4f158aLiane Praza# opensnoop - snoop file opens as they occur.
ead1f93ee620d7580f7e53350fe5a884fc4f158aLiane Praza# Written using DTrace (Solaris 10 3/05).
ead1f93ee620d7580f7e53350fe5a884fc4f158aLiane Praza# $Id: opensnoop 3 2007-08-01 10:50:08Z brendan $
ead1f93ee620d7580f7e53350fe5a884fc4f158aLiane Praza# USAGE: opensnoop [-a|-A|-ceghsvxZ] [-f pathname] [-n name] [-p PID]
ead1f93ee620d7580f7e53350fe5a884fc4f158aLiane Praza# opensnoop # default output
ead1f93ee620d7580f7e53350fe5a884fc4f158aLiane Praza# -a # print most data
ead1f93ee620d7580f7e53350fe5a884fc4f158aLiane Praza# -A # dump all data, space delimited
ead1f93ee620d7580f7e53350fe5a884fc4f158aLiane Praza# -c # print cwd of process
ead1f93ee620d7580f7e53350fe5a884fc4f158aLiane Praza# -e # print errno value
ead1f93ee620d7580f7e53350fe5a884fc4f158aLiane Praza# -g # print command arguments
ead1f93ee620d7580f7e53350fe5a884fc4f158aLiane Praza# -s # print start time, us
ead1f93ee620d7580f7e53350fe5a884fc4f158aLiane Praza# -v # print start time, string
ead1f93ee620d7580f7e53350fe5a884fc4f158aLiane Praza# -x # only print failed opens
ead1f93ee620d7580f7e53350fe5a884fc4f158aLiane Praza# -Z # print zonename
ead1f93ee620d7580f7e53350fe5a884fc4f158aLiane Praza# -f pathname # file pathname to snoop
ead1f93ee620d7580f7e53350fe5a884fc4f158aLiane Praza# -n name # command name to snoop
3e14f97f673e8a630f076077de35afdd43dc1587Roger A. Faulkner# -p PID # process ID to snoop
ead1f93ee620d7580f7e53350fe5a884fc4f158aLiane Praza# opensnoop -v # human readable timestamps
ead1f93ee620d7580f7e53350fe5a884fc4f158aLiane Praza# opensnoop -e # see error codes
ead1f93ee620d7580f7e53350fe5a884fc4f158aLiane Praza# opensnoop -f /etc/passwd # snoop this file only
ead1f93ee620d7580f7e53350fe5a884fc4f158aLiane Praza# ZONE Zone name
ead1f93ee620d7580f7e53350fe5a884fc4f158aLiane Praza# UID User ID
ead1f93ee620d7580f7e53350fe5a884fc4f158aLiane Praza# PID Process ID
ead1f93ee620d7580f7e53350fe5a884fc4f158aLiane Praza# PPID Parent Process ID
ead1f93ee620d7580f7e53350fe5a884fc4f158aLiane Praza# FD file descriptor (-1 for error)
ead1f93ee620d7580f7e53350fe5a884fc4f158aLiane Praza# ERR errno value (see /usr/include/sys/errno.h)
ead1f93ee620d7580f7e53350fe5a884fc4f158aLiane Praza# CWD print current working directory of process
ead1f93ee620d7580f7e53350fe5a884fc4f158aLiane Praza# PATH pathname for file open
ead1f93ee620d7580f7e53350fe5a884fc4f158aLiane Praza# COMM command name for the process
ead1f93ee620d7580f7e53350fe5a884fc4f158aLiane Praza# ARGS argument listing for the process
ead1f93ee620d7580f7e53350fe5a884fc4f158aLiane Praza# TIME timestamp for the open event, us
ead1f93ee620d7580f7e53350fe5a884fc4f158aLiane Praza# STRTIME timestamp for the open event, string
ead1f93ee620d7580f7e53350fe5a884fc4f158aLiane Praza# SEE ALSO: truss, BSM auditing.
ead1f93ee620d7580f7e53350fe5a884fc4f158aLiane Praza# COPYRIGHT: Copyright (c) 2006 Brendan Gregg.
ead1f93ee620d7580f7e53350fe5a884fc4f158aLiane Praza# CDDL HEADER START
ead1f93ee620d7580f7e53350fe5a884fc4f158aLiane Praza# The contents of this file are subject to the terms of the
ead1f93ee620d7580f7e53350fe5a884fc4f158aLiane Praza# Common Development and Distribution License, Version 1.0 only
20c1c3551cb3b3117591ae38463d16aada597c48Rod Evans# (the "License"). You may not use this file except in compliance
d2aad38f82a2b5085cc6ee00170dcd255c2b5ef7Mark J. Nelson# with the License.
ead1f93ee620d7580f7e53350fe5a884fc4f158aLiane Praza# You can obtain a copy of the license at Docs/cddl1.txt
ead1f93ee620d7580f7e53350fe5a884fc4f158aLiane Praza# See the License for the specific language governing permissions
ead1f93ee620d7580f7e53350fe5a884fc4f158aLiane Praza# and limitations under the License.
ead1f93ee620d7580f7e53350fe5a884fc4f158aLiane Praza# CDDL HEADER END
ead1f93ee620d7580f7e53350fe5a884fc4f158aLiane Praza# Author: Brendan Gregg [Sydney, Australia]
ead1f93ee620d7580f7e53350fe5a884fc4f158aLiane Praza# 09-May-2004 Brendan Gregg Created this.
ead1f93ee620d7580f7e53350fe5a884fc4f158aLiane Praza# 21-Jan-2005 " " Wrapped in sh to provide options.
ead1f93ee620d7580f7e53350fe5a884fc4f158aLiane Praza# 08-May-2005 " " Rewritten for performance.
ead1f93ee620d7580f7e53350fe5a884fc4f158aLiane Praza# 14-May-2005 " " Added errno.
ead1f93ee620d7580f7e53350fe5a884fc4f158aLiane Praza# 28-Jun-2005 " " Added cwd, zonename.
ead1f93ee620d7580f7e53350fe5a884fc4f158aLiane Praza# 17-Sep-2005 " " Increased switchrate, fixed page fault bug.
ead1f93ee620d7580f7e53350fe5a884fc4f158aLiane Praza# 16-Jan-2006 " " Added -n, -p.
ead1f93ee620d7580f7e53350fe5a884fc4f158aLiane Praza# 16-Jan-2006 " " Last update.
ead1f93ee620d7580f7e53350fe5a884fc4f158aLiane Praza##############################
ead1f93ee620d7580f7e53350fe5a884fc4f158aLiane Praza# --- Process Arguments ---
ead1f93ee620d7580f7e53350fe5a884fc4f158aLiane Praza### Default variables
ead1f93ee620d7580f7e53350fe5a884fc4f158aLiane Prazaopt_dump=0; opt_file=0; opt_time=0; opt_timestr=0; opt_args=0
ead1f93ee620d7580f7e53350fe5a884fc4f158aLiane Prazaopt_zone=0; opt_cwd=0; opt_failonly=0; opt_err=0; filter=0; pathname=.
ead1f93ee620d7580f7e53350fe5a884fc4f158aLiane Praza### Process options
ead1f93ee620d7580f7e53350fe5a884fc4f158aLiane Praza a) opt_time=1; opt_timestr=1; opt_args=1; opt_err=1 ;;
ead1f93ee620d7580f7e53350fe5a884fc4f158aLiane Praza USAGE: opensnoop [-a|-A|-ceghsvxZ] [-f pathname]
ead1f93ee620d7580f7e53350fe5a884fc4f158aLiane Praza [-n name] [-p PID]
ead1f93ee620d7580f7e53350fe5a884fc4f158aLiane Praza opensnoop # default output
ead1f93ee620d7580f7e53350fe5a884fc4f158aLiane Praza -a # print most data
ead1f93ee620d7580f7e53350fe5a884fc4f158aLiane Praza -A # dump all data, space delimited
ead1f93ee620d7580f7e53350fe5a884fc4f158aLiane Praza -c # print cwd of process
ead1f93ee620d7580f7e53350fe5a884fc4f158aLiane Praza -e # print errno value
ead1f93ee620d7580f7e53350fe5a884fc4f158aLiane Praza -g # print command arguments
ead1f93ee620d7580f7e53350fe5a884fc4f158aLiane Praza -s # print start time, us
ead1f93ee620d7580f7e53350fe5a884fc4f158aLiane Praza -v # print start time, string
ead1f93ee620d7580f7e53350fe5a884fc4f158aLiane Praza -x # only print failed opens
ead1f93ee620d7580f7e53350fe5a884fc4f158aLiane Praza -Z # print zonename
ead1f93ee620d7580f7e53350fe5a884fc4f158aLiane Praza -f pathname # pathname name to snoop
ead1f93ee620d7580f7e53350fe5a884fc4f158aLiane Praza -n name # process name to snoop
ead1f93ee620d7580f7e53350fe5a884fc4f158aLiane Praza -p PID # process ID to snoop
ead1f93ee620d7580f7e53350fe5a884fc4f158aLiane Praza opensnoop -v # human readable timestamps
ead1f93ee620d7580f7e53350fe5a884fc4f158aLiane Praza opensnoop -e # see error codes
ead1f93ee620d7580f7e53350fe5a884fc4f158aLiane Praza opensnoop -f /etc/motd # snoop this file only
ead1f93ee620d7580f7e53350fe5a884fc4f158aLiane Praza### Option logic
ead1f93ee620d7580f7e53350fe5a884fc4f158aLiane Prazaif [ $opt_dump -eq 1 ]; then
ead1f93ee620d7580f7e53350fe5a884fc4f158aLiane Praza opt_zone=0; opt_cwd=0; opt_time=0; opt_timestr=0; opt_args=2
ead1f93ee620d7580f7e53350fe5a884fc4f158aLiane Prazaif [ $opt_name -eq 1 -o $opt_pid -eq 1 ]; then
ead1f93ee620d7580f7e53350fe5a884fc4f158aLiane Praza#################################
ead1f93ee620d7580f7e53350fe5a884fc4f158aLiane Praza# --- Main Program, DTrace ---
ead1f93ee620d7580f7e53350fe5a884fc4f158aLiane Praza/usr/sbin/dtrace -n '
ead1f93ee620d7580f7e53350fe5a884fc4f158aLiane Praza * Command line arguments
ead1f93ee620d7580f7e53350fe5a884fc4f158aLiane Praza inline int OPT_dump = '$opt_dump';
ead1f93ee620d7580f7e53350fe5a884fc4f158aLiane Praza inline int OPT_file = '$opt_file';
ead1f93ee620d7580f7e53350fe5a884fc4f158aLiane Praza inline int OPT_args = '$opt_args';
ead1f93ee620d7580f7e53350fe5a884fc4f158aLiane Praza inline int OPT_cwd = '$opt_cwd';
ead1f93ee620d7580f7e53350fe5a884fc4f158aLiane Praza inline int OPT_err = '$opt_err';
ead1f93ee620d7580f7e53350fe5a884fc4f158aLiane Praza inline int OPT_zone = '$opt_zone';
ead1f93ee620d7580f7e53350fe5a884fc4f158aLiane Praza inline int OPT_time = '$opt_time';
ead1f93ee620d7580f7e53350fe5a884fc4f158aLiane Praza inline int OPT_timestr = '$opt_timestr';
ead1f93ee620d7580f7e53350fe5a884fc4f158aLiane Praza inline int OPT_failonly = '$opt_failonly';
ead1f93ee620d7580f7e53350fe5a884fc4f158aLiane Praza inline int OPT_pid = '$opt_pid';
ead1f93ee620d7580f7e53350fe5a884fc4f158aLiane Praza inline int OPT_name = '$opt_name';
ead1f93ee620d7580f7e53350fe5a884fc4f158aLiane Praza inline int FILTER = '$filter';
ead1f93ee620d7580f7e53350fe5a884fc4f158aLiane Praza inline int PID = '$pid';
3e14f97f673e8a630f076077de35afdd43dc1587Roger A. Faulkner inline string PATHNAME = "'$pathname'";
ebbab6bbae913efeadfa3c6a1b082664a125f95bDan Price inline string NAME = "'$pname'";
ead1f93ee620d7580f7e53350fe5a884fc4f158aLiane Praza #pragma D option quiet
ead1f93ee620d7580f7e53350fe5a884fc4f158aLiane Praza #pragma D option switchrate=10hz
ead1f93ee620d7580f7e53350fe5a884fc4f158aLiane Praza * Print header
ead1f93ee620d7580f7e53350fe5a884fc4f158aLiane Praza dtrace:::BEGIN
ead1f93ee620d7580f7e53350fe5a884fc4f158aLiane Praza * ternary operators are used to improve performance.
ead1f93ee620d7580f7e53350fe5a884fc4f158aLiane Praza * OPT_args is unusual in that it can have one of three values.
ead1f93ee620d7580f7e53350fe5a884fc4f158aLiane Praza /* print optional headers */
ead1f93ee620d7580f7e53350fe5a884fc4f158aLiane Praza OPT_time ? printf("%-14s ", "TIME") : 1;
ead1f93ee620d7580f7e53350fe5a884fc4f158aLiane Praza OPT_timestr ? printf("%-20s ", "STRTIME") : 1;
ebbab6bbae913efeadfa3c6a1b082664a125f95bDan Price OPT_zone ? printf("%-10s ", "ZONE") : 1;
ead1f93ee620d7580f7e53350fe5a884fc4f158aLiane Praza /* print dump headers */
ead1f93ee620d7580f7e53350fe5a884fc4f158aLiane Praza OPT_dump ? printf("%s %s %s %s %s %s %s %s %s %s %s", "ZONE",
ead1f93ee620d7580f7e53350fe5a884fc4f158aLiane Praza "TIME", "UID", "PID", "PPID", "COMM", "FD", "ERR", "CWD",
ead1f93ee620d7580f7e53350fe5a884fc4f158aLiane Praza "PATH", "ARGS") : printf("%5s %6s ","UID","PID");
ead1f93ee620d7580f7e53350fe5a884fc4f158aLiane Praza /* print main headers */
ead1f93ee620d7580f7e53350fe5a884fc4f158aLiane Praza OPT_args == 0 ? printf("%-12s ", "COMM") : 1;
ead1f93ee620d7580f7e53350fe5a884fc4f158aLiane Praza OPT_dump == 0 ? printf("%3s ", "FD") : 1;
ead1f93ee620d7580f7e53350fe5a884fc4f158aLiane Praza OPT_err ? printf("%3s ", "ERR") : 1;
ead1f93ee620d7580f7e53350fe5a884fc4f158aLiane Praza OPT_cwd ? printf("%-20s ", "CWD") : 1;
ead1f93ee620d7580f7e53350fe5a884fc4f158aLiane Praza OPT_dump == 0 ? printf("%-20s ", "PATH") : 1;
ead1f93ee620d7580f7e53350fe5a884fc4f158aLiane Praza OPT_args == 1 ? printf("%s", "ARGS") : 1;
ead1f93ee620d7580f7e53350fe5a884fc4f158aLiane Praza printf("\n");
ead1f93ee620d7580f7e53350fe5a884fc4f158aLiane Praza * Print open event
3e14f97f673e8a630f076077de35afdd43dc1587Roger A. Faulkner syscall::openat:entry, syscall::openat64:entry
3e14f97f673e8a630f076077de35afdd43dc1587Roger A. Faulkner /* save pathname */
3e14f97f673e8a630f076077de35afdd43dc1587Roger A. Faulkner self->pathp = arg1;
3e14f97f673e8a630f076077de35afdd43dc1587Roger A. Faulkner /* default is to trace unless filtering */
3e14f97f673e8a630f076077de35afdd43dc1587Roger A. Faulkner self->ok = FILTER ? 0 : 1;
3e14f97f673e8a630f076077de35afdd43dc1587Roger A. Faulkner /* check each filter */
3e14f97f673e8a630f076077de35afdd43dc1587Roger A. Faulkner (OPT_name == 1 && NAME == execname) ? self->ok = 1 : 1;
ead1f93ee620d7580f7e53350fe5a884fc4f158aLiane Praza (OPT_pid == 1 && PID == pid) ? self->ok = 1 : 1;
ead1f93ee620d7580f7e53350fe5a884fc4f158aLiane Praza /* OPT_file is checked on return to ensure pathp is mapped */
ead1f93ee620d7580f7e53350fe5a884fc4f158aLiane Praza syscall::openat:return, syscall::openat64:return
ead1f93ee620d7580f7e53350fe5a884fc4f158aLiane Praza /self->ok && (! OPT_failonly || (int)arg0 < 0) &&
ead1f93ee620d7580f7e53350fe5a884fc4f158aLiane Praza ((OPT_file == 0) || (OPT_file == 1 && PATHNAME == copyinstr(self->pathp)))/
ead1f93ee620d7580f7e53350fe5a884fc4f158aLiane Praza /* print optional fields */
ead1f93ee620d7580f7e53350fe5a884fc4f158aLiane Praza OPT_time ? printf("%-14d ", timestamp/1000) : 1;
ead1f93ee620d7580f7e53350fe5a884fc4f158aLiane Praza OPT_timestr ? printf("%-20Y ", walltimestamp) : 1;
ead1f93ee620d7580f7e53350fe5a884fc4f158aLiane Praza OPT_zone ? printf("%-10s ", zonename) : 1;
ead1f93ee620d7580f7e53350fe5a884fc4f158aLiane Praza /* print dump fields */
ead1f93ee620d7580f7e53350fe5a884fc4f158aLiane Praza OPT_dump ? printf("%s %d %d %d %d %s %d %d %s %s %S", zonename,
ead1f93ee620d7580f7e53350fe5a884fc4f158aLiane Praza timestamp/1000, uid, pid, ppid, execname, (int)arg0, errno,
ead1f93ee620d7580f7e53350fe5a884fc4f158aLiane Praza cwd, copyinstr(self->pathp), curpsinfo->pr_psargs) :
ead1f93ee620d7580f7e53350fe5a884fc4f158aLiane Praza printf("%5d %6d ", uid, pid);
ead1f93ee620d7580f7e53350fe5a884fc4f158aLiane Praza /* print main fields */
ead1f93ee620d7580f7e53350fe5a884fc4f158aLiane Praza OPT_args == 0 ? printf("%-12s ", execname) : 1;
ead1f93ee620d7580f7e53350fe5a884fc4f158aLiane Praza OPT_dump == 0 ? printf("%3d ", (int)arg0) : 1;
ead1f93ee620d7580f7e53350fe5a884fc4f158aLiane Praza OPT_err ? printf("%3d ", errno) : 1;
ead1f93ee620d7580f7e53350fe5a884fc4f158aLiane Praza OPT_cwd ? printf("%-20s ", cwd) : 1;
ead1f93ee620d7580f7e53350fe5a884fc4f158aLiane Praza OPT_dump == 0 ? printf("%-20s ", copyinstr(self->pathp)) : 1;
ead1f93ee620d7580f7e53350fe5a884fc4f158aLiane Praza OPT_args == 1 ? printf("%S", curpsinfo->pr_psargs) : 1;
ead1f93ee620d7580f7e53350fe5a884fc4f158aLiane Praza printf("\n");
ead1f93ee620d7580f7e53350fe5a884fc4f158aLiane Praza /* cleanup */
ead1f93ee620d7580f7e53350fe5a884fc4f158aLiane Praza self->pathp = 0;
ead1f93ee620d7580f7e53350fe5a884fc4f158aLiane Praza self->ok = 0;
ead1f93ee620d7580f7e53350fe5a884fc4f158aLiane Praza syscall::openat:return, syscall::openat64:return
ead1f93ee620d7580f7e53350fe5a884fc4f158aLiane Praza self->pathp = 0;
ead1f93ee620d7580f7e53350fe5a884fc4f158aLiane Praza self->ok = 0;