#!/usr/bin/sh # # statsnoop - snoop file stats as they occur. # Written using DTrace (Solaris 10 3/05). # # $Id: statsnoop,v 1.1.1.1 2015/09/30 22:01:07 christos Exp $ # # USAGE: statsnoop [-a|-A|-ceghlsvxZ] [-f pathname] [-t syscall] # [-n name] [-p PID] # # statsnoop # default output # # -a # print most data # -A # dump all data, space delimited # -c # print cwd of process # -e # print errno value # -g # print command arguments # -l # print syscall type # -s # print start time, us # -v # print start time, string # -x # only print failed stats # -Z # print zonename # -f pathname # file pathname to snoop # -n name # command name to snoop # -p PID # process ID to snoop # -t syscall # stat syscall to trace # eg, # statsnoop -v # human readable timestamps # statsnoop -S # syscall type # statsnoop -e # see error codes # statsnoop -f /etc/passwd # snoop this file only # # FIELDS: # ZONE Zone name # UID User ID # PID Process ID # PPID Parent Process ID # FD file descriptor (-1 for error) # ERR errno value (see /usr/include/sys/errno.h) # TYPE syscall type # CWD current working directory of process # PATH pathname for file stat # COMM command name for the process # ARGS argument listing for the process # TIME timestamp for the stat event, us # STRTIME timestamp for the stat event, string # # SEE ALSO: truss, BSM auditing. # # COPYRIGHT: Copyright (c) 2007 Brendan Gregg. # # CDDL HEADER START # # The contents of this file are subject to the terms of the # Common Development and Distribution License, Version 1.0 only # (the "License"). You may not use this file except in compliance # with the License. # # You can obtain a copy of the license at Docs/cddl1.txt # or http://www.opensolaris.org/os/licensing. # See the License for the specific language governing permissions # and limitations under the License. # # CDDL HEADER END # # Author: Brendan Gregg [Sydney, Australia] # # 09-Sep-2007 Brendan Gregg Created this. # ############################## # --- Process Arguments --- # ### Default variables opt_dump=0; opt_file=0; opt_time=0; opt_timestr=0; opt_args=0 opt_zone=0; opt_cwd=0; opt_failonly=0; opt_err=0; filter=0; pathname=. opt_name=0; opt_pid=0; opt_type=0; opt_trace=0; pname=.; pid=0; trace=. ### Process options while getopts aAcef:ghln:p:st:vxZ name do case $name in a) opt_time=1; opt_timestr=1; opt_args=1; opt_err=1 ;; A) opt_dump=1 ;; c) opt_cwd=1 ;; e) opt_err=1 ;; g) opt_args=1 ;; f) opt_file=1; pathname=$OPTARG ;; l) opt_type=1 ;; n) opt_name=1; pname=$OPTARG ;; p) opt_pid=1; pid=$OPTARG ;; s) opt_time=1 ;; t) opt_trace=1; trace=$OPTARG ;; v) opt_timestr=1 ;; x) opt_failonly=1 ;; Z) opt_zone=1 ;; h|?) cat <<-END >&2 USAGE: statsnoop [-a|-A|-ceghlsvxZ] [-f pathname] [-t syscall] [-n execname] [-p PID] statsnoop # default output -a # print most data -A # dump all data, space delimited -c # print cwd of process -e # print errno value -g # print command arguments -l # print syscall type -s # print start time, us -v # print start time, string -x # only print failed stats -Z # print zonename -f pathname # pathname name to snoop -n name # process name to snoop -p PID # process ID to snoop -t syscall # stat syscall to trace eg, statsnoop -v # human readable timestamps statsnoop -e # see error codes statsnoop -f /etc/motd # snoop this file only END exit 1 esac done ### Option logic if [ $opt_dump -eq 1 ]; then opt_zone=0; opt_cwd=0; opt_time=0; opt_timestr=0; opt_type=0 opt_args=2 fi if [ $opt_name -eq 1 -o $opt_pid -eq 1 -o $opt_trace -eq 1 ]; then filter=1 fi ################################# # --- Main Program, DTrace --- # /usr/sbin/dtrace -n ' /* * Command line arguments */ inline int OPT_dump = '$opt_dump'; inline int OPT_file = '$opt_file'; inline int OPT_args = '$opt_args'; inline int OPT_cwd = '$opt_cwd'; inline int OPT_err = '$opt_err'; inline int OPT_zone = '$opt_zone'; inline int OPT_time = '$opt_time'; inline int OPT_timestr = '$opt_timestr'; inline int OPT_type = '$opt_type'; inline int OPT_failonly = '$opt_failonly'; inline int OPT_pid = '$opt_pid'; inline int OPT_name = '$opt_name'; inline int OPT_trace = '$opt_trace'; inline int FILTER = '$filter'; inline int PID = '$pid'; inline string PATHNAME = "'$pathname'"; inline string NAME = "'$pname'"; inline string TRACE = "'$trace'"; #pragma D option quiet #pragma D option switchrate=10hz /* * Print header */ dtrace:::BEGIN { /* print optional headers */ OPT_time ? printf("%-14s ", "TIME") : 1; OPT_timestr ? printf("%-20s ", "STRTIME") : 1; OPT_zone ? printf("%-10s ", "ZONE") : 1; /* print dump headers */ OPT_dump ? printf("%s %s %s %s %s %s %s %s %s %s %s", "ZONE", "TIME", "UID", "PID", "PPID", "COMM", "FD", "ERR", "CWD", "PATH", "ARGS") : printf("%5s %6s ","UID","PID"); /* print main headers */ OPT_args == 0 ? printf("%-12s ", "COMM") : 1; OPT_dump == 0 ? printf("%3s ", "FD") : 1; OPT_err ? printf("%3s ", "ERR") : 1; OPT_cwd ? printf("%-20s ", "CWD") : 1; OPT_type ? printf("%-8s ", "TYPE") : 1; OPT_dump == 0 ? printf("%-20s ", "PATH") : 1; OPT_args == 1 ? printf("%s", "ARGS") : 1; printf("\n"); } /* * Print stat event */ syscall::stat:entry, syscall::stat64:entry, syscall::xstat:entry, syscall::lstat:entry, syscall::lstat64:entry, syscall::lxstat:entry, syscall::fstat:entry, syscall::fstat64:entry, syscall::fxstat:entry { /* default is to trace unless filtering */ self->ok = FILTER ? 0 : 1; /* check each filter */ (OPT_name == 1 && NAME == execname) ? self->ok = 1 : 1; (OPT_pid == 1 && PID == pid) ? self->ok = 1 : 1; (OPT_trace == 1 && TRACE == probefunc) ? self->ok = 1 : 1; } syscall::stat:entry, syscall::stat64:entry, syscall::lstat:entry, syscall::lstat64:entry, syscall::lxstat:entry /self->ok/ { self->pathp = arg0; } syscall::xstat:entry /self->ok/ { self->pathp = arg1; } syscall::stat:return, syscall::stat64:return, syscall::xstat:return, syscall::lstat:return, syscall::lstat64:return, syscall::lxstat:return /self->ok/ { self->path = copyinstr(self->pathp); self->pathp = 0; } syscall::fstat:return, syscall::fstat64:entry, syscall::fxstat:entry /self->ok/ { self->filep = curthread->t_procp->p_user.u_finfo.fi_list[arg0].uf_file; } syscall::fstat:return, syscall::fstat64:return, syscall::fxstat:return /self->ok/ { this->vnodep = self->filep != 0 ? self->filep->f_vnode : 0; self->path = this->vnodep ? (this->vnodep->v_path != 0 ? cleanpath(this->vnodep->v_path) : "") : ""; self->filep = 0; } syscall::stat:return, syscall::stat64:return, syscall::xstat:return, syscall::lstat:return, syscall::lstat64:return, syscall::lxstat:return, syscall::fstat:return, syscall::fstat64:return, syscall::fxstat:return /self->ok && (! OPT_failonly || (int)arg0 < 0) && ((OPT_file == 0) || (OPT_file == 1 && PATHNAME == copyinstr(self->pathp)))/ { /* print optional fields */ OPT_time ? printf("%-14d ", timestamp/1000) : 1; OPT_timestr ? printf("%-20Y ", walltimestamp) : 1; OPT_zone ? printf("%-10s ", zonename) : 1; /* print dump fields */ OPT_dump ? printf("%s %d %d %d %d %s %d %d %s %s %S", zonename, timestamp/1000, uid, pid, ppid, execname, (int)arg0, errno, cwd, self->path, curpsinfo->pr_psargs) : printf("%5d %6d ", uid, pid); /* print main fields */ OPT_args == 0 ? printf("%-12.12s ", execname) : 1; OPT_dump == 0 ? printf("%3d ", (int)arg0) : 1; OPT_err ? printf("%3d ", errno) : 1; OPT_cwd ? printf("%-20s ", cwd) : 1; OPT_type ? printf("%-8s ", probefunc) : 1; OPT_dump == 0 ? printf("%-20s ", self->path) : 1; OPT_args == 1 ? printf("%S", curpsinfo->pr_psargs) : 1; printf("\n"); /* cleanup */ self->path = 0; self->ok = 0; } /* * Cleanup */ syscall::stat:return, syscall::stat64:return, syscall::xstat:return, syscall::lstat:return, syscall::lstat64:return, syscall::lxstat:return, syscall::fstat:return, syscall::fstat64:return, syscall::fxstat:return /self->ok/ { self->path = 0; self->ok = 0; } '