execsnoop revision 1.2
1 #!/bin/sh 2 # 3 # execsnoop - snoop process execution as it occurs. 4 # Written using DTrace (Solaris 10 3/05). 5 # 6 # $Id: execsnoop,v 1.2 2026/01/11 22:24:23 wiz Exp $ 7 # 8 # USAGE: execsnoop [-a|-A|-ehsv] [-c command] 9 # 10 # execsnoop # default output 11 # 12 # -a # print all data 13 # -A # dump all data, space delimited 14 # -e # safe output - parseable 15 # -s # print start time, us 16 # -v # print start time, string 17 # -c command # command name to snoop 18 # eg, 19 # execsnoop -v # human readable timestamps 20 # execsnoop -c ls # snoop ls commands only 21 # 22 # The parseable output ensures that the ARGS field doesn't contain 23 # any "\n"s, which normally sometimes can - and would wreck postprocessing. 24 # 25 # FIELDS: 26 # UID User ID 27 # PID Process ID 28 # PPID Parent Process ID 29 # COMM command name for the process 30 # ARGS argument listing for the process 31 # TIME timestamp for the command, us 32 # STRTIME timestamp for the command, string 33 # 34 # SEE ALSO: BSM auditing. 35 # 36 # COPYRIGHT: Copyright (c) 2005 Brendan Gregg. 37 # 38 # CDDL HEADER START 39 # 40 # The contents of this file are subject to the terms of the 41 # Common Development and Distribution License, Version 1.0 only 42 # (the "License"). You may not use this file except in compliance 43 # with the License. 44 # 45 # You can obtain a copy of the license at Docs/cddl1.txt 46 # or http://www.opensolaris.org/os/licensing. 47 # See the License for the specific language governing permissions 48 # and limitations under the License. 49 # 50 # CDDL HEADER END 51 # 52 # Author: Brendan Gregg [Sydney, Australia] 53 # 54 # 27-Mar-2004 Brendan Gregg Created this. 55 # 21-Jan-2005 " " Wrapped in sh to provide options. 56 # 08-May-2005 " " Rewritten for performance. 57 # 14-May-2005 " " Added zonename. 58 # 02-Jul-2005 " " Added projid, safe printing. 59 # 11-Sep-2005 " " Increased switchrate. 60 # 11-Sep-2005 " " Last update. 61 # 62 63 64 ############################## 65 # --- Process Arguments --- 66 # 67 68 ### default variables 69 opt_dump=0; opt_cmd=0; opt_time=0; opt_timestr=0; filter=0; command=. 70 opt_safe=0 71 72 ### process options 73 while getopts aAc:ehsv name 74 do 75 case $name in 76 a) opt_time=1; opt_timestr=1; opt_jailid=1 ;; 77 A) opt_dump=1 ;; 78 c) opt_cmd=1; command=$OPTARG ;; 79 e) opt_safe=1 ;; 80 s) opt_time=1 ;; 81 v) opt_timestr=1 ;; 82 h|?) cat <<-END >&2 83 USAGE: execsnoop [-A|-a|-ehsv] [-c command] 84 execsnoop # default output 85 -A # dump all data, space delimited 86 -a # print all data 87 -c command # command name to snoop 88 -e # safe output, parseable 89 -s # print start time, us 90 -v # print start time, string 91 e.g., 92 execsnoop -v # human readable timestamps 93 execsnoop -c ls # snoop ls commands only 94 END 95 exit 1 96 esac 97 done 98 99 ### option logic 100 if [ $opt_dump -eq 1 ]; then 101 opt_time=0; opt_timestr=0 102 fi 103 if [ $opt_cmd -eq 1 ]; then 104 filter=1 105 fi 106 107 108 ################################# 109 # --- Main Program, DTrace --- 110 # 111 /usr/sbin/dtrace -n ' 112 /* 113 * Command line arguments 114 */ 115 inline int OPT_dump = '$opt_dump'; 116 inline int OPT_cmd = '$opt_cmd'; 117 inline int OPT_time = '$opt_time'; 118 inline int OPT_timestr = '$opt_timestr'; 119 inline int OPT_safe = '$opt_safe'; 120 inline int FILTER = '$filter'; 121 inline string COMMAND = "'$command'"; 122 123 #pragma D option quiet 124 #pragma D option switchrate=10hz 125 126 /* 127 * Print header 128 */ 129 dtrace:::BEGIN 130 { 131 /* print optional headers */ 132 OPT_time ? printf("%-14s ", "TIME") : 1; 133 OPT_timestr ? printf("%-20s ", "STRTIME") : 1; 134 135 /* print main headers */ 136 OPT_dump ? printf("%s %s %s %s %s %s\n", 137 "TIME", "UID", "PID", "PPID", "COMM", "ARGS") : 138 printf("%5s %6s %6s %s\n", "UID", "PID", "PPID", "ARGS"); 139 } 140 141 /* 142 * Print exec event 143 */ 144 syscall::execve:return 145 /(FILTER == 0) || (OPT_cmd == 1 && COMMAND == execname)/ 146 { 147 /* print optional fields */ 148 OPT_time ? printf("%-14d ", timestamp/1000) : 1; 149 OPT_timestr ? printf("%-20Y ", walltimestamp) : 1; 150 151 /* print main data */ 152 OPT_dump ? printf("%d %d %d %d %s ", timestamp/1000, 153 uid, pid, ppid, execname) : 154 printf("%5d %6d %6d ", uid, pid, ppid); 155 OPT_safe ? printf("%S\n", curpsinfo->pr_psargs) : 156 printf("%s\n", curpsinfo->pr_psargs); 157 } 158 ' 159
Indexes created Wed Apr 22 00:22:44 UTC 2026