Alexey Ivanov | cc01a9c | 2019-01-16 09:50:46 -0800 | [diff] [blame] | 1 | #!/usr/bin/python |
Brendan Gregg | aa87997 | 2016-01-28 22:43:37 -0800 | [diff] [blame] | 2 | # |
| 3 | # bashreadline Print entered bash commands from all running shells. |
| 4 | # For Linux, uses BCC, eBPF. Embedded C. |
| 5 | # |
JayceCao | b26e26b | 2019-02-18 14:55:12 +0800 | [diff] [blame] | 6 | # USAGE: bashreadline [-s SHARED] |
Brendan Gregg | aa87997 | 2016-01-28 22:43:37 -0800 | [diff] [blame] | 7 | # This works by tracing the readline() function using a uretprobe (uprobes). |
JayceCao | b26e26b | 2019-02-18 14:55:12 +0800 | [diff] [blame] | 8 | # When you failed to run the script directly with error: |
| 9 | # `Exception: could not determine address of symbol b'readline'`, |
| 10 | # you may need specify the location of libreadline.so library |
| 11 | # with `-s` option. |
Brendan Gregg | aa87997 | 2016-01-28 22:43:37 -0800 | [diff] [blame] | 12 | # |
| 13 | # Copyright 2016 Netflix, Inc. |
| 14 | # Licensed under the Apache License, Version 2.0 (the "License") |
| 15 | # |
| 16 | # 28-Jan-2016 Brendan Gregg Created this. |
mcaleavya | ee5f823 | 2016-02-12 20:06:38 +0000 | [diff] [blame] | 17 | # 12-Feb-2016 Allan McAleavy migrated to BPF_PERF_OUTPUT |
Brendan Gregg | aa87997 | 2016-01-28 22:43:37 -0800 | [diff] [blame] | 18 | |
| 19 | from __future__ import print_function |
| 20 | from bcc import BPF |
| 21 | from time import strftime |
JayceCao | b26e26b | 2019-02-18 14:55:12 +0800 | [diff] [blame] | 22 | import argparse |
| 23 | |
| 24 | parser = argparse.ArgumentParser( |
| 25 | description="Print entered bash commands from all running shells", |
| 26 | formatter_class=argparse.RawDescriptionHelpFormatter) |
| 27 | parser.add_argument("-s", "--shared", nargs="?", |
| 28 | const="/lib/libreadline.so", type=str, |
| 29 | help="specify the location of libreadline.so library.\ |
| 30 | Default is /lib/libreadline.so") |
| 31 | args = parser.parse_args() |
| 32 | |
| 33 | name = args.shared if args.shared else "/bin/bash" |
Brendan Gregg | aa87997 | 2016-01-28 22:43:37 -0800 | [diff] [blame] | 34 | |
| 35 | # load BPF program |
| 36 | bpf_text = """ |
| 37 | #include <uapi/linux/ptrace.h> |
Juergen Hoetzel | 4995db0 | 2019-06-07 20:58:58 +0200 | [diff] [blame] | 38 | #include <linux/sched.h> |
mcaleavya | ee5f823 | 2016-02-12 20:06:38 +0000 | [diff] [blame] | 39 | |
| 40 | struct str_t { |
| 41 | u64 pid; |
| 42 | char str[80]; |
| 43 | }; |
| 44 | |
| 45 | BPF_PERF_OUTPUT(events); |
| 46 | |
Brendan Gregg | aa87997 | 2016-01-28 22:43:37 -0800 | [diff] [blame] | 47 | int printret(struct pt_regs *ctx) { |
mcaleavya | ee5f823 | 2016-02-12 20:06:38 +0000 | [diff] [blame] | 48 | struct str_t data = {}; |
Juergen Hoetzel | 4995db0 | 2019-06-07 20:58:58 +0200 | [diff] [blame] | 49 | char comm[TASK_COMM_LEN] = {}; |
mcaleavya | ee5f823 | 2016-02-12 20:06:38 +0000 | [diff] [blame] | 50 | u32 pid; |
Naveen N. Rao | 4afa96a | 2016-05-03 14:54:21 +0530 | [diff] [blame] | 51 | if (!PT_REGS_RC(ctx)) |
Brendan Gregg | aa87997 | 2016-01-28 22:43:37 -0800 | [diff] [blame] | 52 | return 0; |
Hengqi Chen | f0a0dc7 | 2021-05-20 22:49:25 +0800 | [diff] [blame] | 53 | pid = bpf_get_current_pid_tgid() >> 32; |
mcaleavya | ee5f823 | 2016-02-12 20:06:38 +0000 | [diff] [blame] | 54 | data.pid = pid; |
Sumanth Korikkar | 023154c | 2020-04-20 05:54:57 -0500 | [diff] [blame] | 55 | bpf_probe_read_user(&data.str, sizeof(data.str), (void *)PT_REGS_RC(ctx)); |
Juergen Hoetzel | 4995db0 | 2019-06-07 20:58:58 +0200 | [diff] [blame] | 56 | |
| 57 | bpf_get_current_comm(&comm, sizeof(comm)); |
| 58 | if (comm[0] == 'b' && comm[1] == 'a' && comm[2] == 's' && comm[3] == 'h' && comm[4] == 0 ) { |
| 59 | events.perf_submit(ctx,&data,sizeof(data)); |
| 60 | } |
| 61 | |
Brendan Gregg | aa87997 | 2016-01-28 22:43:37 -0800 | [diff] [blame] | 62 | |
| 63 | return 0; |
| 64 | }; |
| 65 | """ |
mcaleavya | ee5f823 | 2016-02-12 20:06:38 +0000 | [diff] [blame] | 66 | |
Brendan Gregg | aa87997 | 2016-01-28 22:43:37 -0800 | [diff] [blame] | 67 | b = BPF(text=bpf_text) |
JayceCao | b26e26b | 2019-02-18 14:55:12 +0800 | [diff] [blame] | 68 | b.attach_uretprobe(name=name, sym="readline", fn_name="printret") |
Brendan Gregg | aa87997 | 2016-01-28 22:43:37 -0800 | [diff] [blame] | 69 | |
| 70 | # header |
xingfeng2510 | 03e4948 | 2022-03-17 13:07:16 +0800 | [diff] [blame] | 71 | print("%-9s %-7s %s" % ("TIME", "PID", "COMMAND")) |
Brendan Gregg | aa87997 | 2016-01-28 22:43:37 -0800 | [diff] [blame] | 72 | |
mcaleavya | ee5f823 | 2016-02-12 20:06:38 +0000 | [diff] [blame] | 73 | def print_event(cpu, data, size): |
Xiaozhou Liu | 51d62d3 | 2019-02-15 13:03:05 +0800 | [diff] [blame] | 74 | event = b["events"].event(data) |
xingfeng2510 | 03e4948 | 2022-03-17 13:07:16 +0800 | [diff] [blame] | 75 | print("%-9s %-7d %s" % (strftime("%H:%M:%S"), event.pid, |
jeromemarchand | b96ebcd | 2018-10-10 01:58:15 +0200 | [diff] [blame] | 76 | event.str.decode('utf-8', 'replace'))) |
mcaleavya | ee5f823 | 2016-02-12 20:06:38 +0000 | [diff] [blame] | 77 | |
| 78 | b["events"].open_perf_buffer(print_event) |
Brendan Gregg | aa87997 | 2016-01-28 22:43:37 -0800 | [diff] [blame] | 79 | while 1: |
Jerome Marchand | 5167127 | 2018-12-19 01:57:24 +0100 | [diff] [blame] | 80 | try: |
| 81 | b.perf_buffer_poll() |
| 82 | except KeyboardInterrupt: |
| 83 | exit() |