Brendan Gregg | d9e578b | 2015-09-21 11:59:42 -0700 | [diff] [blame] | 1 | #!/usr/bin/python |
Alexei Starovoitov | bdf0773 | 2016-01-14 10:09:20 -0800 | [diff] [blame] | 2 | # @lint-avoid-python-3-compatibility-imports |
Brendan Gregg | d9e578b | 2015-09-21 11:59:42 -0700 | [diff] [blame] | 3 | # |
Alexei Starovoitov | bdf0773 | 2016-01-14 10:09:20 -0800 | [diff] [blame] | 4 | # killsnoop Trace signals issued by the kill() syscall. |
| 5 | # For Linux, uses BCC, eBPF. Embedded C. |
Brendan Gregg | d9e578b | 2015-09-21 11:59:42 -0700 | [diff] [blame] | 6 | # |
| 7 | # USAGE: killsnoop [-h] [-t] [-x] [-p PID] |
| 8 | # |
| 9 | # Copyright (c) 2015 Brendan Gregg. |
| 10 | # Licensed under the Apache License, Version 2.0 (the "License") |
| 11 | # |
Alexei Starovoitov | bdf0773 | 2016-01-14 10:09:20 -0800 | [diff] [blame] | 12 | # 20-Sep-2015 Brendan Gregg Created this. |
mcaleavya | f5c40cb | 2016-02-19 23:02:39 +0000 | [diff] [blame] | 13 | # 19-Feb-2016 Allan McAleavy migrated to BPF_PERF_OUTPUT |
Brendan Gregg | d9e578b | 2015-09-21 11:59:42 -0700 | [diff] [blame] | 14 | |
| 15 | from __future__ import print_function |
| 16 | from bcc import BPF |
| 17 | import argparse |
mcaleavya | f5c40cb | 2016-02-19 23:02:39 +0000 | [diff] [blame] | 18 | import ctypes as ct |
Brendan Gregg | d9e578b | 2015-09-21 11:59:42 -0700 | [diff] [blame] | 19 | |
| 20 | # arguments |
| 21 | examples = """examples: |
| 22 | ./killsnoop # trace all kill() signals |
| 23 | ./killsnoop -t # include timestamps |
| 24 | ./killsnoop -x # only show failed kills |
| 25 | ./killsnoop -p 181 # only trace PID 181 |
| 26 | """ |
| 27 | parser = argparse.ArgumentParser( |
Alexei Starovoitov | bdf0773 | 2016-01-14 10:09:20 -0800 | [diff] [blame] | 28 | description="Trace signals issued by the kill() syscall", |
| 29 | formatter_class=argparse.RawDescriptionHelpFormatter, |
| 30 | epilog=examples) |
Brendan Gregg | d9e578b | 2015-09-21 11:59:42 -0700 | [diff] [blame] | 31 | parser.add_argument("-t", "--timestamp", action="store_true", |
Alexei Starovoitov | bdf0773 | 2016-01-14 10:09:20 -0800 | [diff] [blame] | 32 | help="include timestamp on output") |
Brendan Gregg | d9e578b | 2015-09-21 11:59:42 -0700 | [diff] [blame] | 33 | parser.add_argument("-x", "--failed", action="store_true", |
Alexei Starovoitov | bdf0773 | 2016-01-14 10:09:20 -0800 | [diff] [blame] | 34 | help="only show failed opens") |
Brendan Gregg | d9e578b | 2015-09-21 11:59:42 -0700 | [diff] [blame] | 35 | parser.add_argument("-p", "--pid", |
Alexei Starovoitov | bdf0773 | 2016-01-14 10:09:20 -0800 | [diff] [blame] | 36 | help="trace this PID only") |
Brendan Gregg | d9e578b | 2015-09-21 11:59:42 -0700 | [diff] [blame] | 37 | args = parser.parse_args() |
| 38 | debug = 0 |
| 39 | |
| 40 | # define BPF program |
| 41 | bpf_text = """ |
| 42 | #include <uapi/linux/ptrace.h> |
mcaleavya | f5c40cb | 2016-02-19 23:02:39 +0000 | [diff] [blame] | 43 | #include <linux/sched.h> |
| 44 | |
| 45 | struct val_t { |
| 46 | u64 pid; |
| 47 | u64 ts; |
mcaleavya | 6262f5d | 2016-02-19 23:48:20 +0000 | [diff] [blame^] | 48 | int sig; |
| 49 | int tpid; |
mcaleavya | f5c40cb | 2016-02-19 23:02:39 +0000 | [diff] [blame] | 50 | char comm[TASK_COMM_LEN]; |
| 51 | }; |
| 52 | |
| 53 | struct data_t { |
| 54 | u64 pid; |
| 55 | u64 tpid; |
| 56 | int sig; |
| 57 | int ret; |
| 58 | u64 ts; |
| 59 | u64 delta; |
| 60 | char comm[TASK_COMM_LEN]; |
| 61 | }; |
Brendan Gregg | d9e578b | 2015-09-21 11:59:42 -0700 | [diff] [blame] | 62 | |
mcaleavya | f5c40cb | 2016-02-19 23:02:39 +0000 | [diff] [blame] | 63 | BPF_HASH(infotmp, u32, struct val_t); |
| 64 | BPF_PERF_OUTPUT(events); |
Brendan Gregg | d9e578b | 2015-09-21 11:59:42 -0700 | [diff] [blame] | 65 | |
| 66 | int kprobe__sys_kill(struct pt_regs *ctx, int tpid, int sig) |
| 67 | { |
mcaleavya | f5c40cb | 2016-02-19 23:02:39 +0000 | [diff] [blame] | 68 | struct val_t val = {}; |
Alexei Starovoitov | bdf0773 | 2016-01-14 10:09:20 -0800 | [diff] [blame] | 69 | u32 pid = bpf_get_current_pid_tgid(); |
Brendan Gregg | d9e578b | 2015-09-21 11:59:42 -0700 | [diff] [blame] | 70 | |
Alexei Starovoitov | bdf0773 | 2016-01-14 10:09:20 -0800 | [diff] [blame] | 71 | FILTER |
mcaleavya | f5c40cb | 2016-02-19 23:02:39 +0000 | [diff] [blame] | 72 | if (bpf_get_current_comm(&val.comm, sizeof(val.comm)) == 0) { |
| 73 | val.pid = bpf_get_current_pid_tgid(); |
| 74 | val.ts = bpf_ktime_get_ns(); |
mcaleavya | 6262f5d | 2016-02-19 23:48:20 +0000 | [diff] [blame^] | 75 | val.tpid = tpid; |
| 76 | val.sig = sig; |
mcaleavya | f5c40cb | 2016-02-19 23:02:39 +0000 | [diff] [blame] | 77 | infotmp.update(&pid, &val); |
| 78 | } |
Brendan Gregg | d9e578b | 2015-09-21 11:59:42 -0700 | [diff] [blame] | 79 | |
Alexei Starovoitov | bdf0773 | 2016-01-14 10:09:20 -0800 | [diff] [blame] | 80 | return 0; |
Brendan Gregg | d9e578b | 2015-09-21 11:59:42 -0700 | [diff] [blame] | 81 | }; |
| 82 | |
| 83 | int kretprobe__sys_kill(struct pt_regs *ctx) |
| 84 | { |
mcaleavya | f5c40cb | 2016-02-19 23:02:39 +0000 | [diff] [blame] | 85 | struct data_t data = {}; |
| 86 | struct val_t *valp; |
Alexei Starovoitov | bdf0773 | 2016-01-14 10:09:20 -0800 | [diff] [blame] | 87 | u32 pid = bpf_get_current_pid_tgid(); |
mcaleavya | f5c40cb | 2016-02-19 23:02:39 +0000 | [diff] [blame] | 88 | u64 tsp = bpf_ktime_get_ns(); |
Brendan Gregg | d9e578b | 2015-09-21 11:59:42 -0700 | [diff] [blame] | 89 | |
mcaleavya | f5c40cb | 2016-02-19 23:02:39 +0000 | [diff] [blame] | 90 | valp = infotmp.lookup(&pid); |
| 91 | if (valp == 0) { |
| 92 | // missed entry |
| 93 | return 0; |
| 94 | } |
| 95 | |
| 96 | bpf_probe_read(&data.comm, sizeof(data.comm), valp->comm); |
| 97 | data.pid = pid; |
| 98 | data.delta = tsp - valp->ts; |
| 99 | data.ts = tsp / 1000; |
mcaleavya | 6262f5d | 2016-02-19 23:48:20 +0000 | [diff] [blame^] | 100 | data.tpid = valp->tpid; |
mcaleavya | f5c40cb | 2016-02-19 23:02:39 +0000 | [diff] [blame] | 101 | data.ret = ctx->ax; |
mcaleavya | 6262f5d | 2016-02-19 23:48:20 +0000 | [diff] [blame^] | 102 | data.sig = valp->sig; |
mcaleavya | f5c40cb | 2016-02-19 23:02:39 +0000 | [diff] [blame] | 103 | |
| 104 | events.perf_submit(ctx, &data, sizeof(data)); |
| 105 | infotmp.delete(&pid); |
Brendan Gregg | d9e578b | 2015-09-21 11:59:42 -0700 | [diff] [blame] | 106 | |
Alexei Starovoitov | bdf0773 | 2016-01-14 10:09:20 -0800 | [diff] [blame] | 107 | return 0; |
Brendan Gregg | d9e578b | 2015-09-21 11:59:42 -0700 | [diff] [blame] | 108 | } |
| 109 | """ |
| 110 | if args.pid: |
Alexei Starovoitov | bdf0773 | 2016-01-14 10:09:20 -0800 | [diff] [blame] | 111 | bpf_text = bpf_text.replace('FILTER', |
| 112 | 'if (pid != %s) { return 0; }' % args.pid) |
Brendan Gregg | d9e578b | 2015-09-21 11:59:42 -0700 | [diff] [blame] | 113 | else: |
Alexei Starovoitov | bdf0773 | 2016-01-14 10:09:20 -0800 | [diff] [blame] | 114 | bpf_text = bpf_text.replace('FILTER', '') |
Brendan Gregg | d9e578b | 2015-09-21 11:59:42 -0700 | [diff] [blame] | 115 | if debug: |
Alexei Starovoitov | bdf0773 | 2016-01-14 10:09:20 -0800 | [diff] [blame] | 116 | print(bpf_text) |
Brendan Gregg | d9e578b | 2015-09-21 11:59:42 -0700 | [diff] [blame] | 117 | |
| 118 | # initialize BPF |
| 119 | b = BPF(text=bpf_text) |
| 120 | |
mcaleavya | f5c40cb | 2016-02-19 23:02:39 +0000 | [diff] [blame] | 121 | TASK_COMM_LEN = 16 # linux/sched.h |
| 122 | |
| 123 | class Data(ct.Structure): |
| 124 | _fields_ = [ |
| 125 | ("pid", ct.c_ulonglong), |
| 126 | ("tpid", ct.c_ulonglong), |
| 127 | ("sig", ct.c_int), |
| 128 | ("ret", ct.c_int), |
| 129 | ("ts", ct.c_ulonglong), |
| 130 | ("delta", ct.c_ulonglong), |
| 131 | ("comm", ct.c_char * TASK_COMM_LEN) |
| 132 | ] |
| 133 | |
| 134 | start_ts = 0 |
| 135 | prev_ts = 0 |
| 136 | delta = 0 |
| 137 | |
Brendan Gregg | d9e578b | 2015-09-21 11:59:42 -0700 | [diff] [blame] | 138 | # header |
| 139 | if args.timestamp: |
Alexei Starovoitov | bdf0773 | 2016-01-14 10:09:20 -0800 | [diff] [blame] | 140 | print("%-14s" % ("TIME(s)"), end="") |
Brendan Gregg | d9e578b | 2015-09-21 11:59:42 -0700 | [diff] [blame] | 141 | print("%-6s %-16s %-4s %-6s %s" % ("PID", "COMM", "SIG", "TPID", "RESULT")) |
| 142 | |
mcaleavya | f5c40cb | 2016-02-19 23:02:39 +0000 | [diff] [blame] | 143 | # process event |
| 144 | def print_event(cpu, data, size): |
| 145 | event = ct.cast(data, ct.POINTER(Data)).contents |
| 146 | global start_ts |
| 147 | global prev_ts |
| 148 | global delta |
Brendan Gregg | d9e578b | 2015-09-21 11:59:42 -0700 | [diff] [blame] | 149 | |
mcaleavya | f5c40cb | 2016-02-19 23:02:39 +0000 | [diff] [blame] | 150 | if start_ts == 0: |
| 151 | prev_ts = start_ts |
Brendan Gregg | d9e578b | 2015-09-21 11:59:42 -0700 | [diff] [blame] | 152 | |
mcaleavya | f5c40cb | 2016-02-19 23:02:39 +0000 | [diff] [blame] | 153 | if start_ts == 1: |
| 154 | delta = float(delta) + (event.ts - prev_ts) |
| 155 | |
| 156 | if (args.failed and (event.ret >= 0)): |
| 157 | start_ts = 1 |
| 158 | prev_ts = event.ts |
| 159 | return |
Brendan Gregg | d9e578b | 2015-09-21 11:59:42 -0700 | [diff] [blame] | 160 | |
Alexei Starovoitov | bdf0773 | 2016-01-14 10:09:20 -0800 | [diff] [blame] | 161 | # print columns |
| 162 | if args.timestamp: |
mcaleavya | f5c40cb | 2016-02-19 23:02:39 +0000 | [diff] [blame] | 163 | print("%-14.9f" % (delta / 1000000), end="") |
| 164 | |
| 165 | print("%-6d %-16s %-4d %-6d %d" % (event.pid, event.comm, event.sig, |
| 166 | event.tpid, event.ret)) |
| 167 | |
| 168 | prev_ts = event.ts |
| 169 | start_ts = 1 |
| 170 | |
| 171 | # loop with callback to print_event |
| 172 | b["events"].open_perf_buffer(print_event) |
| 173 | while 1: |
| 174 | b.kprobe_poll() |