blob: 29d56b0a89372876f8690d59017bce15f13781a4 [file] [log] [blame]
Demonstrations of killsnoop, the Linux eBPF/bcc version.
This traces signals sent via the kill() syscall. For example:
# ./killsnoop
TIME PID COMM SIG TPID RESULT
12:10:51 13967 bash 9 13885 0
12:11:34 13967 bash 9 1024 -3
12:11:41 815 systemd-udevd 15 14076 0
The first line showed a SIGKILL (9) sent from PID 13967 (a bash shell) to
PID 13885. The result, 0, means success.
The second line showed the same signal sent, this time resulting in a -3
(ESRCH: no such process).
USAGE message:
# ./killsnoop -h
usage: killsnoop [-h] [-x] [-p PID]
Trace signals issued by the kill() syscall
optional arguments:
-h, --help show this help message and exit
-x, --failed only show failed kill syscalls
-p PID, --pid PID trace this PID only
examples:
./killsnoop # trace all kill() signals
./killsnoop -x # only show failed kills
./killsnoop -p 181 # only trace PID 181