| Demonstrations of execsnoop, the Linux eBPF/bcc version. | |
| execsnoop traces new processes. For example, tracing the commands invoked when | |
| running "man ls": | |
| # ./execsnoop | |
| PCOMM PID RET ARGS | |
| bash 15887 0 /usr/bin/man ls | |
| preconv 15894 0 /usr/bin/preconv -e UTF-8 | |
| man 15896 0 /usr/bin/tbl | |
| man 15897 0 /usr/bin/nroff -mandoc -rLL=169n -rLT=169n -Tutf8 | |
| man 15898 0 /usr/bin/pager -s | |
| nroff 15900 0 /usr/bin/locale charmap | |
| nroff 15901 0 /usr/bin/groff -mtty-char -Tutf8 -mandoc -rLL=169n -rLT=169n | |
| groff 15902 0 /usr/bin/troff -mtty-char -mandoc -rLL=169n -rLT=169n -Tutf8 | |
| groff 15903 0 /usr/bin/grotty | |
| The output shows the parent process/command name (PCOMM), the PID, the return | |
| value of the exec() (RET), and the filename with arguments (ARGS). | |
| This works by traces the execve() system call (commonly used exec() variant), | |
| and shows details of the arguments and return value. This catches new processes | |
| that follow the fork->exec sequence, as well as processes that re-exec() | |
| themselves. Some applications fork() but do not exec(), eg, for worker | |
| processes, which won't be included in the execsnoop output. | |
| The -x option can be used to include failed exec()s. For example: | |
| # ./execsnoop -x | |
| PCOMM PID RET ARGS | |
| supervise 9660 0 ./run | |
| supervise 9661 0 ./run | |
| mkdir 9662 0 /bin/mkdir -p ./main | |
| run 9663 0 ./run | |
| chown 9664 0 /bin/chown nobody:nobody ./main | |
| run 9665 0 /bin/mkdir -p ./main | |
| supervise 9667 0 ./run | |
| run 9660 -2 /usr/local/bin/setuidgid nobody /command/multilog t ./main | |
| chown 9668 0 /bin/chown nobody:nobody ./main | |
| run 9666 0 /bin/chmod 0777 main | |
| run 9663 -2 /usr/local/bin/setuidgid nobody /command/multilog t ./main | |
| run 9669 0 /bin/mkdir -p ./main | |
| run 9661 -2 /usr/local/bin/setuidgid nobody /command/multilog t ./main | |
| supervise 9670 0 ./run | |
| [...] | |
| This example shows various regular system daemon activity, including some | |
| failures (trying to execute a /usr/local/bin/setuidgid, which I just noticed | |
| doesn't exist). | |
| A -T option can be used to include a time column, a -t option to include a | |
| timestamp column, and a -n option to match on a name. Regular expressions | |
| are allowed. | |
| For example, matching commands containing "mount": | |
| # ./execsnoop -Ttn mount | |
| TIME TIME(s) PCOMM PID PPID RET ARGS | |
| 14:08:23 2.849 mount 18049 1045 0 /bin/mount -p | |
| The -l option can be used to only show command where one of the arguments | |
| matches specified line. The limitation is that we are looking only into first 20 | |
| arguments of the command. For example, matching all command where one of the argument | |
| is "testpkg": | |
| # ./execsnoop.py -l testpkg | |
| PCOMM PID PPID RET ARGS | |
| service 3344535 4146419 0 /usr/sbin/service testpkg status | |
| systemctl 3344535 4146419 0 /bin/systemctl status testpkg.service | |
| yum 3344856 4146419 0 /usr/local/bin/yum remove testpkg | |
| python 3344856 4146419 0 /usr/local/bin/python /usr/local/bin/yum remove testpkg | |
| yum 3344856 4146419 0 /usr/bin/yum remove testpkg | |
| yum 3345086 4146419 0 /usr/local/bin/yum install testpkg | |
| python 3345086 4146419 0 /usr/local/bin/python /usr/local/bin/yum install testpkg | |
| yum 3345086 4146419 0 /usr/bin/yum install testpkg | |
| rpm 3345452 4146419 0 /bin/rpm -qa testpkg | |
| The --cgroupmap option filters based on a cgroup set. It is meant to be used | |
| with an externally created map. | |
| # ./execsnoop --cgroupmap /sys/fs/bpf/test01 | |
| For more details, see docs/special_filtering.md | |
| The -U option include UID on output: | |
| # ./execsnoop -U | |
| UID PCOMM PID PPID RET ARGS | |
| 1000 ls 171318 133702 0 /bin/ls --color=auto | |
| 1000 w 171322 133702 0 /usr/bin/w | |
| The -u options filters output based process UID. You also can use username as | |
| argument, in that cause UID will be looked up using getpwnam (see man 3 getpwnam). | |
| # ./execsnoop -Uu 1000 | |
| UID PCOMM PID PPID RET ARGS | |
| 1000 ls 171335 133702 0 /bin/ls --color=auto | |
| 1000 man 171340 133702 0 /usr/bin/man getpwnam | |
| 1000 bzip2 171341 171340 0 /bin/bzip2 -dc | |
| 1000 bzip2 171342 171340 0 /bin/bzip2 -dc | |
| 1000 bzip2 171345 171340 0 /bin/bzip2 -dc | |
| 1000 manpager 171355 171340 0 /usr/bin/manpager | |
| 1000 less 171355 171340 0 /usr/bin/less | |
| USAGE message: | |
| # ./execsnoop -h | |
| usage: execsnoop.py [-h] [-T] [-t] [-x] [--cgroupmap CGROUPMAP] [-u USER] [-q] | |
| [-n NAME] [-l LINE] [-U] [--max-args MAX_ARGS] | |
| Trace exec() syscalls | |
| optional arguments: | |
| -h, --help show this help message and exit | |
| -T, --time include time column on output (HH:MM:SS) | |
| -t, --timestamp include timestamp on output | |
| -x, --fails include failed exec()s | |
| --cgroupmap CGROUPMAP | |
| trace cgroups in this BPF map only | |
| --mntnsmap MNTNSMAP trace mount namespaces in this BPF map only | |
| -u USER, --uid USER trace this UID only | |
| -q, --quote Add quotemarks (") around arguments. | |
| -n NAME, --name NAME only print commands matching this name (regex), any | |
| arg | |
| -l LINE, --line LINE only print commands where arg contains this line | |
| (regex) | |
| -U, --print-uid print UID column | |
| --max-args MAX_ARGS maximum number of arguments parsed and displayed, | |
| defaults to 20 | |
| examples: | |
| ./execsnoop # trace all exec() syscalls | |
| ./execsnoop -x # include failed exec()s | |
| ./execsnoop -T # include time (HH:MM:SS) | |
| ./execsnoop -U # include UID | |
| ./execsnoop -u 1000 # only trace UID 1000 | |
| ./execsnoop -u root # get root UID and trace only this | |
| ./execsnoop -t # include timestamps | |
| ./execsnoop -q # add "quotemarks" around arguments | |
| ./execsnoop -n main # only print command lines containing "main" | |
| ./execsnoop -l tpkg # only print command where arguments contains "tpkg" | |
| ./execsnoop --cgroupmap mappath # only trace cgroups in this BPF map | |
| ./execsnoop --mntnsmap mappath # only trace mount namespaces in the map |