3 # statsnoop - snoop file stats as they occur.
4 # Written using DTrace (Solaris 10 3/05).
6 # $Id: statsnoop 65 2007-10-04 11:09:40Z brendan $
8 # USAGE: statsnoop [-a|-A|-ceghlsvxZ] [-f pathname] [-t syscall]
11 # statsnoop # default output
13 # -a # print most data
14 # -A # dump all data, space delimited
15 # -c # print cwd of process
16 # -e # print errno value
17 # -g # print command arguments
18 # -l # print syscall type
19 # -s # print start time, us
20 # -v # print start time, string
21 # -x # only print failed stats
23 # -f pathname # file pathname to snoop
24 # -n name # command name to snoop
25 # -p PID # process ID to snoop
26 # -t syscall # stat syscall to trace
28 # statsnoop -v # human readable timestamps
29 # statsnoop -S # syscall type
30 # statsnoop -e # see error codes
31 # statsnoop -f /etc/passwd # snoop this file only
37 # PPID Parent Process ID
38 # FD file descriptor (-1 for error)
39 # ERR errno value (see /usr/include/sys/errno.h)
41 # CWD current working directory of process
42 # PATH pathname for file stat
43 # COMM command name for the process
44 # ARGS argument listing for the process
45 # TIME timestamp for the stat event, us
46 # STRTIME timestamp for the stat event, string
48 # SEE ALSO: truss, BSM auditing.
50 # COPYRIGHT: Copyright (c) 2007 Brendan Gregg.
54 # The contents of this file are subject to the terms of the
55 # Common Development and Distribution License, Version 1.0 only
56 # (the "License"). You may not use this file except in compliance
59 # You can obtain a copy of the license at Docs/cddl1.txt
60 # or http://www.opensolaris.org/os/licensing.
61 # See the License for the specific language governing permissions
62 # and limitations under the License.
66 # Author: Brendan Gregg [Sydney, Australia]
68 # 09-Sep-2007 Brendan Gregg Created this.
72 ##############################
73 # --- Process Arguments ---
77 opt_dump=0; opt_file=0; opt_time=0; opt_timestr=0; opt_args=0
78 opt_zone=0; opt_cwd=0; opt_failonly=0; opt_err=0; filter=0; pathname=.
79 opt_name=0; opt_pid=0; opt_type=0; opt_trace=0; pname=.; pid=0; trace=.
82 while getopts aAcef:ghln:p:st:vxZ name
85 a) opt_time=1; opt_timestr=1; opt_args=1; opt_err=1 ;;
90 f) opt_file=1; pathname=$OPTARG ;;
92 n) opt_name=1; pname=$OPTARG ;;
93 p) opt_pid=1; pid=$OPTARG ;;
95 t) opt_trace=1; trace=$OPTARG ;;
100 USAGE: statsnoop [-a|-A|-ceghlsvxZ] [-f pathname] [-t syscall]
101 [-n execname] [-p PID]
102 statsnoop # default output
104 -A # dump all data, space delimited
105 -c # print cwd of process
106 -e # print errno value
107 -g # print command arguments
108 -l # print syscall type
109 -s # print start time, us
110 -v # print start time, string
111 -x # only print failed stats
113 -f pathname # pathname name to snoop
114 -n name # process name to snoop
115 -p PID # process ID to snoop
116 -t syscall # stat syscall to trace
118 statsnoop -v # human readable timestamps
119 statsnoop -e # see error codes
120 statsnoop -f /etc/motd # snoop this file only
127 if [ $opt_dump -eq 1 ]; then
128 opt_zone=0; opt_cwd=0; opt_time=0; opt_timestr=0; opt_type=0
131 if [ $opt_name -eq 1 -o $opt_pid -eq 1 -o $opt_trace -eq 1 ]; then
136 #################################
137 # --- Main Program, DTrace ---
139 /usr/sbin/dtrace -n '
141 * Command line arguments
143 inline int OPT_dump = '$opt_dump';
144 inline int OPT_file = '$opt_file';
145 inline int OPT_args = '$opt_args';
146 inline int OPT_cwd = '$opt_cwd';
147 inline int OPT_err = '$opt_err';
148 inline int OPT_zone = '$opt_zone';
149 inline int OPT_time = '$opt_time';
150 inline int OPT_timestr = '$opt_timestr';
151 inline int OPT_type = '$opt_type';
152 inline int OPT_failonly = '$opt_failonly';
153 inline int OPT_pid = '$opt_pid';
154 inline int OPT_name = '$opt_name';
155 inline int OPT_trace = '$opt_trace';
156 inline int FILTER = '$filter';
157 inline int PID = '$pid';
158 inline string PATHNAME = "'$pathname'";
159 inline string NAME = "'$pname'";
160 inline string TRACE = "'$trace'";
162 #pragma D option quiet
163 #pragma D option switchrate=10hz
170 /* print optional headers */
171 OPT_time ? printf("%-14s ", "TIME") : 1;
172 OPT_timestr ? printf("%-20s ", "STRTIME") : 1;
173 OPT_zone ? printf("%-10s ", "ZONE") : 1;
175 /* print dump headers */
176 OPT_dump ? printf("%s %s %s %s %s %s %s %s %s %s %s", "ZONE",
177 "TIME", "UID", "PID", "PPID", "COMM", "FD", "ERR", "CWD",
178 "PATH", "ARGS") : printf("%5s %6s ","UID","PID");
180 /* print main headers */
181 OPT_args == 0 ? printf("%-12s ", "COMM") : 1;
182 OPT_dump == 0 ? printf("%3s ", "FD") : 1;
183 OPT_err ? printf("%3s ", "ERR") : 1;
184 OPT_cwd ? printf("%-20s ", "CWD") : 1;
185 OPT_type ? printf("%-8s ", "TYPE") : 1;
186 OPT_dump == 0 ? printf("%-20s ", "PATH") : 1;
187 OPT_args == 1 ? printf("%s", "ARGS") : 1;
194 syscall::stat:entry, syscall::stat64:entry, syscall::xstat:entry,
195 syscall::lstat:entry, syscall::lstat64:entry, syscall::lxstat:entry,
196 syscall::fstat:entry, syscall::fstat64:entry, syscall::fxstat:entry
198 /* default is to trace unless filtering */
199 self->ok = FILTER ? 0 : 1;
201 /* check each filter */
202 (OPT_name == 1 && NAME == execname) ? self->ok = 1 : 1;
203 (OPT_pid == 1 && PID == pid) ? self->ok = 1 : 1;
204 (OPT_trace == 1 && TRACE == probefunc) ? self->ok = 1 : 1;
207 syscall::stat:entry, syscall::stat64:entry,
208 syscall::lstat:entry, syscall::lstat64:entry, syscall::lxstat:entry
220 syscall::stat:return, syscall::stat64:return, syscall::xstat:return,
221 syscall::lstat:return, syscall::lstat64:return, syscall::lxstat:return
224 self->path = copyinstr(self->pathp);
228 syscall::fstat:return, syscall::fstat64:entry, syscall::fxstat:entry
231 self->filep = curthread->t_procp->p_user.u_finfo.fi_list[arg0].uf_file;
234 syscall::fstat:return, syscall::fstat64:return, syscall::fxstat:return
237 this->vnodep = self->filep != 0 ? self->filep->f_vnode : 0;
238 self->path = this->vnodep ? (this->vnodep->v_path != 0 ?
239 cleanpath(this->vnodep->v_path) : "<unknown>") : "<unknown>";
243 syscall::stat:return, syscall::stat64:return, syscall::xstat:return,
244 syscall::lstat:return, syscall::lstat64:return, syscall::lxstat:return,
245 syscall::fstat:return, syscall::fstat64:return, syscall::fxstat:return
246 /self->ok && (! OPT_failonly || (int)arg0 < 0) &&
247 ((OPT_file == 0) || (OPT_file == 1 && PATHNAME == copyinstr(self->pathp)))/
249 /* print optional fields */
250 OPT_time ? printf("%-14d ", timestamp/1000) : 1;
251 OPT_timestr ? printf("%-20Y ", walltimestamp) : 1;
252 OPT_zone ? printf("%-10s ", zonename) : 1;
254 /* print dump fields */
255 OPT_dump ? printf("%s %d %d %d %d %s %d %d %s %s %S", zonename,
256 timestamp/1000, uid, pid, ppid, execname, (int)arg0, errno,
257 cwd, self->path, curpsinfo->pr_psargs) :
258 printf("%5d %6d ", uid, pid);
260 /* print main fields */
261 OPT_args == 0 ? printf("%-12.12s ", execname) : 1;
262 OPT_dump == 0 ? printf("%3d ", (int)arg0) : 1;
263 OPT_err ? printf("%3d ", errno) : 1;
264 OPT_cwd ? printf("%-20s ", cwd) : 1;
265 OPT_type ? printf("%-8s ", probefunc) : 1;
266 OPT_dump == 0 ? printf("%-20s ", self->path) : 1;
267 OPT_args == 1 ? printf("%S", curpsinfo->pr_psargs) : 1;
278 syscall::stat:return, syscall::stat64:return, syscall::xstat:return,
279 syscall::lstat:return, syscall::lstat64:return, syscall::lxstat:return,
280 syscall::fstat:return, syscall::fstat64:return, syscall::fxstat:return