#!/bin/sh
opt_dump=0; opt_file=0; opt_time=0; opt_timestr=0; opt_args=0
opt_zone=0; opt_cwd=0; opt_failonly=0; opt_err=0; filter=0; pathname=.
opt_name=0; opt_pid=0; pname=.; pid=0
while getopts aAcef:ghn:p:svxZ name
do
case $name in
a) opt_time=1; opt_timestr=1; opt_args=1; opt_err=1 ;;
A) opt_dump=1 ;;
c) opt_cwd=1 ;;
e) opt_err=1 ;;
g) opt_args=1 ;;
f) opt_file=1; pathname=$OPTARG ;;
n) opt_name=1; pname=$OPTARG ;;
p) opt_pid=1; pid=$OPTARG ;;
s) opt_time=1 ;;
v) opt_timestr=1 ;;
x) opt_failonly=1 ;;
Z) opt_zone=1 ;;
h|?) cat <<-END >&2
USAGE: opensnoop [-a|-A|-ceghsvxZ] [-f pathname]
[-n name] [-p PID]
opensnoop -a -A -c -e -g -s -v -x -Z -f pathname -n name -p PID eg,
opensnoop -v opensnoop -e opensnoop -f /etc/motd END
exit 1
esac
done
if [ $opt_dump -eq 1 ]; then
opt_zone=0; opt_cwd=0; opt_time=0; opt_timestr=0; opt_args=2
fi
if [ $opt_name -eq 1 -o $opt_pid -eq 1 ]; then
filter=1
fi
/usr/sbin/dtrace -n '
/*
* Command line arguments
*/
inline int OPT_dump = '$opt_dump';
inline int OPT_file = '$opt_file';
inline int OPT_args = '$opt_args';
inline int OPT_cwd = '$opt_cwd';
inline int OPT_err = '$opt_err';
inline int OPT_zone = '$opt_zone';
inline int OPT_time = '$opt_time';
inline int OPT_timestr = '$opt_timestr';
inline int OPT_failonly = '$opt_failonly';
inline int OPT_pid = '$opt_pid';
inline int OPT_name = '$opt_name';
inline int FILTER = '$filter';
inline int PID = '$pid';
inline string PATHNAME = "'$pathname'";
inline string NAME = "'$pname'";
/*
* Print header
*/
dtrace:::BEGIN
{
/*
* ternary operators are used to improve performance.
* OPT_args is unusual in that it can have one of three values.
*/
/* print optional headers */
OPT_time ? printf("%-14s ", "TIME") : 1;
OPT_timestr ? printf("%-20s ", "STRTIME") : 1;
OPT_zone ? printf("%-10s ", "ZONE") : 1;
/* print dump headers */
OPT_dump ? printf("%s %s %s %s %s %s %s %s %s %s %s", "ZONE",
"TIME", "UID", "PID", "PPID", "COMM", "FD", "ERR", "CWD",
"PATH", "ARGS") : printf("%5s %6s ","UID","PID");
/* print main headers */
OPT_args == 0 ? printf("%-12s ", "COMM") : 1;
OPT_dump == 0 ? printf("%3s ", "FD") : 1;
OPT_err ? printf("%3s ", "ERR") : 1;
OPT_cwd ? printf("%-20s ", "CWD") : 1;
OPT_dump == 0 ? printf("%-20s ", "PATH") : 1;
OPT_args == 1 ? printf("%s", "ARGS") : 1;
printf("\n");
}
/*
* Print open event
*/
/* SOLARIS: syscall::open:entry, syscall::open64:entry */
syscall::open:entry, syscall::open_nocancel:entry
{
/* save pathname */
self->pathp = arg0;
/* default is to trace unless filtering */
self->ok = FILTER ? 0 : 1;
/* check each filter */
(OPT_name == 1 && NAME == strstr(NAME, execname))? self->ok = 1 : 1;
(OPT_name == 1 && execname == strstr(execname, NAME))? self->ok = 1 : 1;
(OPT_pid == 1 && PID == pid) ? self->ok = 1 : 1;
/* OPT_file is checked on return to ensure pathp is mapped */
}
/* SOLARIS: syscall::open:return, syscall::open64:return */
syscall::open:return, syscall::open_nocancel:return
/self->ok && (! OPT_failonly || (int)arg0 < 0) &&
((OPT_file == 0) || (OPT_file == 1 && PATHNAME == copyinstr(self->pathp)))/
{
/* print optional fields */
OPT_time ? printf("%-14d ", timestamp/1000) : 1;
OPT_timestr ? printf("%-20Y ", walltimestamp) : 1;
OPT_zone ? printf("%-10s ", zonename) : 1;
/* print dump fields */
OPT_dump ? printf("%s %d %d %d %d %s %d %d %s %s %S", zonename,
timestamp/1000, uid, pid, ppid, execname, (int)arg0, errno,
cwd, copyinstr(self->pathp), curpsinfo->pr_psargs) :
printf("%5d %6d ", uid, pid);
/* print main fields */
OPT_args == 0 ? printf("%-12s ", execname) : 1;
OPT_dump == 0 ? printf("%3d ", (int)arg0) : 1;
OPT_err ? printf("%3d ", errno) : 1;
OPT_cwd ? printf("%-20s ", cwd) : 1;
OPT_dump == 0 ? printf("%-20s ", copyinstr(self->pathp)) : 1;
OPT_args == 1 ? printf("%S", curpsinfo->pr_psargs) : 1;
printf("\n");
/* cleanup */
self->pathp = 0;
self->ok = 0;
}
/*
* Cleanup
*/
/* SOLARIS: syscall::open:return, syscall::open64:return */
syscall::open:return, syscall::open_nocancel:return
/self->ok/
{
self->pathp = 0;
self->ok = 0;
}
'