Alexey Ivanov | cc01a9c | 2019-01-16 09:50:46 -0800 | [diff] [blame] | 1 | #!/usr/bin/python |
Brendan Gregg | aa87997 | 2016-01-28 22:43:37 -0800 | [diff] [blame] | 2 | # |
| 3 | # bashreadline Print entered bash commands from all running shells. |
| 4 | # For Linux, uses BCC, eBPF. Embedded C. |
| 5 | # |
| 6 | # This works by tracing the readline() function using a uretprobe (uprobes). |
| 7 | # |
| 8 | # Copyright 2016 Netflix, Inc. |
| 9 | # Licensed under the Apache License, Version 2.0 (the "License") |
| 10 | # |
| 11 | # 28-Jan-2016 Brendan Gregg Created this. |
mcaleavya | ee5f823 | 2016-02-12 20:06:38 +0000 | [diff] [blame] | 12 | # 12-Feb-2016 Allan McAleavy migrated to BPF_PERF_OUTPUT |
Brendan Gregg | aa87997 | 2016-01-28 22:43:37 -0800 | [diff] [blame] | 13 | |
| 14 | from __future__ import print_function |
| 15 | from bcc import BPF |
| 16 | from time import strftime |
| 17 | |
| 18 | # load BPF program |
| 19 | bpf_text = """ |
| 20 | #include <uapi/linux/ptrace.h> |
mcaleavya | ee5f823 | 2016-02-12 20:06:38 +0000 | [diff] [blame] | 21 | |
| 22 | struct str_t { |
| 23 | u64 pid; |
| 24 | char str[80]; |
| 25 | }; |
| 26 | |
| 27 | BPF_PERF_OUTPUT(events); |
| 28 | |
Brendan Gregg | aa87997 | 2016-01-28 22:43:37 -0800 | [diff] [blame] | 29 | int printret(struct pt_regs *ctx) { |
mcaleavya | ee5f823 | 2016-02-12 20:06:38 +0000 | [diff] [blame] | 30 | struct str_t data = {}; |
| 31 | u32 pid; |
Naveen N. Rao | 4afa96a | 2016-05-03 14:54:21 +0530 | [diff] [blame] | 32 | if (!PT_REGS_RC(ctx)) |
Brendan Gregg | aa87997 | 2016-01-28 22:43:37 -0800 | [diff] [blame] | 33 | return 0; |
mcaleavya | ee5f823 | 2016-02-12 20:06:38 +0000 | [diff] [blame] | 34 | pid = bpf_get_current_pid_tgid(); |
| 35 | data.pid = pid; |
Naveen N. Rao | 4afa96a | 2016-05-03 14:54:21 +0530 | [diff] [blame] | 36 | bpf_probe_read(&data.str, sizeof(data.str), (void *)PT_REGS_RC(ctx)); |
mcaleavya | ee5f823 | 2016-02-12 20:06:38 +0000 | [diff] [blame] | 37 | events.perf_submit(ctx,&data,sizeof(data)); |
Brendan Gregg | aa87997 | 2016-01-28 22:43:37 -0800 | [diff] [blame] | 38 | |
| 39 | return 0; |
| 40 | }; |
| 41 | """ |
mcaleavya | ee5f823 | 2016-02-12 20:06:38 +0000 | [diff] [blame] | 42 | |
Brendan Gregg | aa87997 | 2016-01-28 22:43:37 -0800 | [diff] [blame] | 43 | b = BPF(text=bpf_text) |
| 44 | b.attach_uretprobe(name="/bin/bash", sym="readline", fn_name="printret") |
| 45 | |
| 46 | # header |
| 47 | print("%-9s %-6s %s" % ("TIME", "PID", "COMMAND")) |
| 48 | |
mcaleavya | ee5f823 | 2016-02-12 20:06:38 +0000 | [diff] [blame] | 49 | def print_event(cpu, data, size): |
Xiaozhou Liu | 51d62d3 | 2019-02-15 13:03:05 +0800 | [diff] [blame] | 50 | event = b["events"].event(data) |
Paul Chaignon | ae0e025 | 2017-10-07 11:52:30 +0200 | [diff] [blame] | 51 | print("%-9s %-6d %s" % (strftime("%H:%M:%S"), event.pid, |
jeromemarchand | b96ebcd | 2018-10-10 01:58:15 +0200 | [diff] [blame] | 52 | event.str.decode('utf-8', 'replace'))) |
mcaleavya | ee5f823 | 2016-02-12 20:06:38 +0000 | [diff] [blame] | 53 | |
| 54 | b["events"].open_perf_buffer(print_event) |
Brendan Gregg | aa87997 | 2016-01-28 22:43:37 -0800 | [diff] [blame] | 55 | while 1: |
Jerome Marchand | 5167127 | 2018-12-19 01:57:24 +0100 | [diff] [blame] | 56 | try: |
| 57 | b.perf_buffer_poll() |
| 58 | except KeyboardInterrupt: |
| 59 | exit() |