Brendan Gregg | aa87997 | 2016-01-28 22:43:37 -0800 | [diff] [blame] | 1 | #!/usr/bin/python |
| 2 | # |
| 3 | # bashreadline Print entered bash commands from all running shells. |
| 4 | # For Linux, uses BCC, eBPF. Embedded C. |
| 5 | # |
| 6 | # This works by tracing the readline() function using a uretprobe (uprobes). |
| 7 | # |
| 8 | # Copyright 2016 Netflix, Inc. |
| 9 | # Licensed under the Apache License, Version 2.0 (the "License") |
| 10 | # |
| 11 | # 28-Jan-2016 Brendan Gregg Created this. |
mcaleavya | ee5f823 | 2016-02-12 20:06:38 +0000 | [diff] [blame] | 12 | # 12-Feb-2016 Allan McAleavy migrated to BPF_PERF_OUTPUT |
Brendan Gregg | aa87997 | 2016-01-28 22:43:37 -0800 | [diff] [blame] | 13 | |
| 14 | from __future__ import print_function |
| 15 | from bcc import BPF |
| 16 | from time import strftime |
mcaleavya | ee5f823 | 2016-02-12 20:06:38 +0000 | [diff] [blame] | 17 | import ctypes as ct |
Brendan Gregg | aa87997 | 2016-01-28 22:43:37 -0800 | [diff] [blame] | 18 | |
| 19 | # load BPF program |
| 20 | bpf_text = """ |
| 21 | #include <uapi/linux/ptrace.h> |
mcaleavya | ee5f823 | 2016-02-12 20:06:38 +0000 | [diff] [blame] | 22 | |
| 23 | struct str_t { |
| 24 | u64 pid; |
| 25 | char str[80]; |
| 26 | }; |
| 27 | |
| 28 | BPF_PERF_OUTPUT(events); |
| 29 | |
Brendan Gregg | aa87997 | 2016-01-28 22:43:37 -0800 | [diff] [blame] | 30 | int printret(struct pt_regs *ctx) { |
mcaleavya | ee5f823 | 2016-02-12 20:06:38 +0000 | [diff] [blame] | 31 | struct str_t data = {}; |
| 32 | u32 pid; |
Naveen N. Rao | 4afa96a | 2016-05-03 14:54:21 +0530 | [diff] [blame] | 33 | if (!PT_REGS_RC(ctx)) |
Brendan Gregg | aa87997 | 2016-01-28 22:43:37 -0800 | [diff] [blame] | 34 | return 0; |
mcaleavya | ee5f823 | 2016-02-12 20:06:38 +0000 | [diff] [blame] | 35 | pid = bpf_get_current_pid_tgid(); |
| 36 | data.pid = pid; |
Naveen N. Rao | 4afa96a | 2016-05-03 14:54:21 +0530 | [diff] [blame] | 37 | bpf_probe_read(&data.str, sizeof(data.str), (void *)PT_REGS_RC(ctx)); |
mcaleavya | ee5f823 | 2016-02-12 20:06:38 +0000 | [diff] [blame] | 38 | events.perf_submit(ctx,&data,sizeof(data)); |
Brendan Gregg | aa87997 | 2016-01-28 22:43:37 -0800 | [diff] [blame] | 39 | |
| 40 | return 0; |
| 41 | }; |
| 42 | """ |
mcaleavya | ee5f823 | 2016-02-12 20:06:38 +0000 | [diff] [blame] | 43 | STR_DATA = 80 |
| 44 | |
| 45 | class Data(ct.Structure): |
| 46 | _fields_ = [ |
| 47 | ("pid", ct.c_ulonglong), |
| 48 | ("str", ct.c_char * STR_DATA) |
| 49 | ] |
| 50 | |
Brendan Gregg | aa87997 | 2016-01-28 22:43:37 -0800 | [diff] [blame] | 51 | b = BPF(text=bpf_text) |
| 52 | b.attach_uretprobe(name="/bin/bash", sym="readline", fn_name="printret") |
| 53 | |
| 54 | # header |
| 55 | print("%-9s %-6s %s" % ("TIME", "PID", "COMMAND")) |
| 56 | |
mcaleavya | ee5f823 | 2016-02-12 20:06:38 +0000 | [diff] [blame] | 57 | def print_event(cpu, data, size): |
| 58 | event = ct.cast(data, ct.POINTER(Data)).contents |
Rafael F | 78948e4 | 2017-03-26 14:54:25 +0200 | [diff] [blame] | 59 | print("%-9s %-6d %s" % (strftime("%H:%M:%S"), event.pid, event.str.decode())) |
mcaleavya | ee5f823 | 2016-02-12 20:06:38 +0000 | [diff] [blame] | 60 | |
| 61 | b["events"].open_perf_buffer(print_event) |
Brendan Gregg | aa87997 | 2016-01-28 22:43:37 -0800 | [diff] [blame] | 62 | while 1: |
mcaleavya | ee5f823 | 2016-02-12 20:06:38 +0000 | [diff] [blame] | 63 | b.kprobe_poll() |