execsnoop revision 1.1.1.1
1 #!/bin/sh 2 # 3 # execsnoop - snoop process execution as it occurs. 4 # Written using DTrace (Solaris 10 3/05). 5 # 6 # $Id: execsnoop,v 1.1.1.1 2015/09/30 22:01:06 christos Exp $ 7 # 8 # USAGE: execsnoop [-a|-A|-ehsvJ] [-c command] 9 # 10 # execsnoop # default output 11 # 12 # -a # print all data 13 # -A # dump all data, space delimited 14 # -e # safe output - parseable 15 # -s # print start time, us 16 # -v # print start time, string 17 # -J # print jail ID 18 # -c command # command name to snoop 19 # eg, 20 # execsnoop -v # human readable timestamps 21 # execsnoop -J # print jail ID 22 # execsnoop -c ls # snoop ls commands only 23 # 24 # The parseable output ensures that the ARGS field doesn't contain 25 # any "\n"s, which normally sometimes can - and would wreck postprocessing. 26 # 27 # FIELDS: 28 # UID User ID 29 # PID Process ID 30 # PPID Parent Process ID 31 # COMM command name for the process 32 # ARGS argument listing for the process 33 # JAIL ID Jail ID 34 # TIME timestamp for the command, us 35 # STRTIME timestamp for the command, string 36 # 37 # SEE ALSO: BSM auditing. 38 # 39 # COPYRIGHT: Copyright (c) 2005 Brendan Gregg. 40 # 41 # CDDL HEADER START 42 # 43 # The contents of this file are subject to the terms of the 44 # Common Development and Distribution License, Version 1.0 only 45 # (the "License"). You may not use this file except in compliance 46 # with the License. 47 # 48 # You can obtain a copy of the license at Docs/cddl1.txt 49 # or http://www.opensolaris.org/os/licensing. 50 # See the License for the specific language governing permissions 51 # and limitations under the License. 52 # 53 # CDDL HEADER END 54 # 55 # Author: Brendan Gregg [Sydney, Australia] 56 # 57 # 27-Mar-2004 Brendan Gregg Created this. 58 # 21-Jan-2005 " " Wrapped in sh to provide options. 59 # 08-May-2005 " " Rewritten for performance. 60 # 14-May-2005 " " Added zonename. 61 # 02-Jul-2005 " " Added projid, safe printing. 62 # 11-Sep-2005 " " Increased switchrate. 63 # 11-Sep-2005 " " Last update. 64 # 65 66 67 ############################## 68 # --- Process Arguments --- 69 # 70 71 ### default variables 72 opt_dump=0; opt_cmd=0; opt_time=0; opt_timestr=0; filter=0; command=. 73 opt_jailid=0; opt_safe=0 74 75 ### process options 76 while getopts aAc:ehsvJ name 77 do 78 case $name in 79 a) opt_time=1; opt_timestr=1; opt_jailid=1 ;; 80 A) opt_dump=1 ;; 81 c) opt_cmd=1; command=$OPTARG ;; 82 e) opt_safe=1 ;; 83 s) opt_time=1 ;; 84 v) opt_timestr=1 ;; 85 J) opt_jailid=1 ;; 86 h|?) cat <<-END >&2 87 USAGE: execsnoop [-a|-A|-ehjsvJ] [-c command] 88 execsnoop # default output 89 -a # print all data 90 -A # dump all data, space delimited 91 -e # safe output, parseable 92 -s # print start time, us 93 -v # print start time, string 94 -J # print jail ID 95 -c command # command name to snoop 96 eg, 97 execsnoop -v # human readable timestamps 98 execsnoop -J # print jail ID 99 execsnoop -c ls # snoop ls commands only 100 END 101 exit 1 102 esac 103 done 104 105 ### option logic 106 if [ $opt_dump -eq 1 ]; then 107 opt_time=0; opt_timestr=0; opt_jailid=0 108 fi 109 if [ $opt_cmd -eq 1 ]; then 110 filter=1 111 fi 112 113 114 ################################# 115 # --- Main Program, DTrace --- 116 # 117 /usr/sbin/dtrace -n ' 118 /* 119 * Command line arguments 120 */ 121 inline int OPT_dump = '$opt_dump'; 122 inline int OPT_cmd = '$opt_cmd'; 123 inline int OPT_time = '$opt_time'; 124 inline int OPT_timestr = '$opt_timestr'; 125 inline int OPT_jailid = '$opt_jailid'; 126 inline int OPT_safe = '$opt_safe'; 127 inline int FILTER = '$filter'; 128 inline string COMMAND = "'$command'"; 129 130 #pragma D option quiet 131 #pragma D option switchrate=10hz 132 133 /* 134 * Print header 135 */ 136 dtrace:::BEGIN 137 { 138 /* print optional headers */ 139 OPT_time ? printf("%-14s ", "TIME") : 1; 140 OPT_timestr ? printf("%-20s ", "STRTIME") : 1; 141 OPT_jailid ? printf("%-10s ", "JAIL ID") : 1; 142 143 /* print main headers */ 144 OPT_dump ? printf("%s %s %s %s %s %s %s\n", 145 "TIME", "JAIL ID", "UID", "PID", "PPID", "COMM", "ARGS") : 146 printf("%5s %6s %6s %s\n", "UID", "PID", "PPID", "ARGS"); 147 } 148 149 /* 150 * Print exec event 151 */ 152 syscall::execve:return 153 /(FILTER == 0) || (OPT_cmd == 1 && COMMAND == execname)/ 154 { 155 /* print optional fields */ 156 OPT_time ? printf("%-14d ", timestamp/1000) : 1; 157 OPT_timestr ? printf("%-20Y ", walltimestamp) : 1; 158 OPT_jailid ? printf("%-10d ", curpsinfo->pr_jailid) : 1; 159 160 /* print main data */ 161 OPT_dump ? printf("%d %d %d %d %d %s ", timestamp/1000, 162 curpsinfo->pr_jailid, uid, pid, ppid, execname) : 163 printf("%5d %6d %6d ", uid, pid, ppid); 164 OPT_safe ? printf("%S\n", curpsinfo->pr_psargs) : 165 printf("%s\n", curpsinfo->pr_psargs); 166 } 167 ' 168
Indexes created Wed Apr 22 00:22:44 UTC 2026