23 lines
846 B
Plaintext
23 lines
846 B
Plaintext
Demonstrations of killsnoop, the Linux bpftrace/eBPF version.
|
|
|
|
|
|
|
|
This traces signals sent via the kill() syscall. For example:
|
|
|
|
# ./killsnoop.bt
|
|
Attaching 3 probes...
|
|
Tracing kill() signals... Hit Ctrl-C to end.
|
|
TIME PID COMM SIG TPID RESULT
|
|
00:09:37.345938 22485 bash 2 23856 0
|
|
00:09:40.838452 22485 bash 2 23856 -3
|
|
00:09:31.437104 22485 bash 15 23814 -3
|
|
|
|
The first line showed a SIGINT (2) sent from PID 22485 (a bash shell) to
|
|
PID 23856. The result, 0, means success. The next line shows the same signal
|
|
sent, which resulted in -3, a failure (likely because the target process
|
|
no longer existed).
|
|
|
|
|
|
There is another version of this tool in bcc: https://github.com/iovisor/bcc
|
|
The bcc version provides command line options to customize the output.
|