Brendan Gregg | 0030d34 | 2016-01-28 22:39:23 -0800 | [diff] [blame] | 1 | #!/usr/bin/python |
| 2 | # |
| 3 | # strlen_snoop Trace strlen() library function for a given PID. |
| 4 | # For Linux, uses BCC, eBPF. Embedded C. |
| 5 | # |
| 6 | # USAGE: strlensnoop PID |
| 7 | # |
| 8 | # Try running this on a separate bash shell. |
| 9 | # |
| 10 | # Written as a basic example of BCC and uprobes. |
| 11 | # |
| 12 | # Copyright 2016 Netflix, Inc. |
| 13 | # Licensed under the Apache License, Version 2.0 (the "License") |
| 14 | |
| 15 | from __future__ import print_function |
| 16 | from bcc import BPF |
| 17 | from os import getpid |
| 18 | import sys |
| 19 | |
| 20 | if len(sys.argv) < 2: |
| 21 | print("USAGE: strlensnoop PID") |
| 22 | exit() |
| 23 | pid = sys.argv[1] |
| 24 | |
| 25 | # load BPF program |
| 26 | bpf_text = """ |
| 27 | #include <uapi/linux/ptrace.h> |
| 28 | int printarg(struct pt_regs *ctx) { |
Brendan Gregg | eb1b70d | 2016-07-25 16:13:35 -0700 | [diff] [blame] | 29 | if (!PT_REGS_PARM1(ctx)) |
Brendan Gregg | 0030d34 | 2016-01-28 22:39:23 -0800 | [diff] [blame] | 30 | return 0; |
| 31 | |
| 32 | u32 pid = bpf_get_current_pid_tgid(); |
| 33 | if (pid != PID) |
| 34 | return 0; |
| 35 | |
| 36 | char str[80] = {}; |
Brendan Gregg | eb1b70d | 2016-07-25 16:13:35 -0700 | [diff] [blame] | 37 | bpf_probe_read(&str, sizeof(str), (void *)PT_REGS_PARM1(ctx)); |
Brendan Gregg | 0030d34 | 2016-01-28 22:39:23 -0800 | [diff] [blame] | 38 | bpf_trace_printk("%s\\n", &str); |
| 39 | |
| 40 | return 0; |
| 41 | }; |
| 42 | """ |
| 43 | bpf_text = bpf_text.replace('PID', pid) |
| 44 | b = BPF(text=bpf_text) |
| 45 | b.attach_uprobe(name="c", sym="strlen", fn_name="printarg") |
| 46 | |
| 47 | # header |
| 48 | print("%-18s %-16s %-6s %s" % ("TIME(s)", "COMM", "PID", "STRLEN")) |
| 49 | |
| 50 | # format output |
| 51 | me = getpid() |
| 52 | while 1: |
| 53 | try: |
| 54 | (task, pid, cpu, flags, ts, msg) = b.trace_fields() |
| 55 | except ValueError: |
| 56 | continue |
| 57 | if pid == me or msg == "": |
| 58 | continue |
| 59 | print("%-18.9f %-16s %-6d %s" % (ts, task, pid, msg)) |