#!/bin/sh # #!/usr/bin/sh # # execsnoop - snoop process execution as it occurs. # Written using DTrace (Solaris 10 3/05). # # 11-Sep-2005, ver 1.25 # # USAGE: execsnoop [-a|-A|-ehjsvZ] [-c command] # # execsnoop # default output # # -a # print all data # -A # dump all data, space delimited # -e # safe output - parseable # -j # print project ID # -s # print start time, us # -v # print start time, string # -Z # print zonename # -c command # command name to snoop # eg, # execsnoop -v # human readable timestamps # execsnoop -Z # print zonename # execsnoop -c ls # snoop ls commands only # # The parseable output ensures that the ARGS field doesn't contain # any "\n"s, which normally sometimes can - and would wreck postprocessing. # # FIELDS: # UID User ID # PID Process ID # PPID Parent Process ID # COMM command name for the process # ARGS argument listing for the process # ZONE zonename # PROJ project ID # TIME timestamp for the command, us # STRTIME timestamp for the command, string # # SEE ALSO: BSM auditing. # # COPYRIGHT: Copyright (c) 2005 Brendan Gregg. # # CDDL HEADER START # # The contents of this file are subject to the terms of the # Common Development and Distribution License, Version 1.0 only # (the "License"). You may not use this file except in compliance # with the License. # # You can obtain a copy of the license at Docs/cddl1.txt # or http://www.opensolaris.org/os/licensing. # See the License for the specific language governing permissions # and limitations under the License. # # CDDL HEADER END # # Author: Brendan Gregg [Sydney, Australia] # # 27-Mar-2004 Brendan Gregg Created this. # 21-Jan-2005 " " Wrapped in sh to provide options. # 08-May-2005 " " Rewritten for performance. # 14-May-2005 " " Added zonename. # 02-Jul-2005 " " Added projid, safe printing. # 11-Sep-2005 " " Increased switchrate. # ############################## # --- Process Arguments --- # ### default variables opt_dump=0; opt_cmd=0; opt_time=0; opt_timestr=0; filter=0; command=. opt_zone=0; opt_safe=0; opt_proj=0 ### process options while getopts aAc:ehjsvZ name do case $name in a) opt_time=1; opt_timestr=1; opt_zone=0; opt_proj=1 ;; A) opt_dump=1 ;; c) opt_cmd=1; command=$OPTARG ;; e) opt_safe=1 ;; j) opt_proj=1 ;; s) opt_time=1 ;; v) opt_timestr=1 ;; Z) opt_zone=1 ;; h|?) cat <<-END >&2 USAGE: execsnoop [-a|-A|-ehjsvZ] [-c command] execsnoop # default output -a # print all data -A # dump all data, space delimited -e # safe output, parseable -j # print project ID -s # print start time, us -v # print start time, string -Z # print zonename -c command # command name to snoop eg, execsnoop -v # human readable timestamps execsnoop -Z # print zonename execsnoop -c ls # snoop ls commands only END exit 1 esac done ### option logic if [ $opt_dump -eq 1 ]; then opt_time=0; opt_timestr=0; opt_zone=0; opt_proj=0 fi if [ $opt_cmd -eq 1 ]; then filter=1 fi ################################# # --- Main Program, DTrace --- # /usr/sbin/dtrace -n ' /* * Command line arguments */ inline int OPT_dump = '$opt_dump'; inline int OPT_cmd = '$opt_cmd'; inline int OPT_time = '$opt_time'; inline int OPT_timestr = '$opt_timestr'; inline int OPT_zone = '$opt_zone'; inline int OPT_safe = '$opt_safe'; inline int OPT_proj = '$opt_proj'; inline int FILTER = '$filter'; inline string COMMAND = "'$command'"; #pragma D option quiet #pragma D option switchrate=10hz /* * Print header */ dtrace:::BEGIN { /* print optional headers */ OPT_time ? printf("%-14s ", "TIME") : 1; OPT_timestr ? printf("%-20s ", "STRTIME") : 1; OPT_zone ? printf("%-10s ", "ZONE") : 1; OPT_proj ? printf("%5s ", "PROJ") : 1; /* print main headers */ OPT_dump ? printf("%s %s %s %s %s %s %s %s\n", "TIME", "ZONE", "PROJ", "UID", "PID", "PPID", "COMM", "ARGS") : printf("%5s %6s %6s %s\n", "UID", "PID", "PPID", "ARGS"); } /* * Print exec event */ /* SOLARIS: syscall::exec:return, syscall::exece:return */ syscall::execve:return, syscall::posix_spawn:return /(FILTER == 0) || (OPT_cmd == 1 && COMMAND == strstr(COMMAND, execname)) || (OPT_cmd == 1 && execname == strstr(execname, COMMAND))/ { /* print optional fields */ OPT_time ? printf("%-14d ", timestamp/1000) : 1; OPT_timestr ? printf("%-20Y ", walltimestamp) : 1; OPT_zone ? printf("%-10s ", zonename) : 1; OPT_proj ? printf("%5d ", curpsinfo->pr_projid) : 1; /* print main data */ OPT_dump ? printf("%d %s %d %d %d %d %s ", timestamp/1000, zonename, curpsinfo->pr_projid, uid, pid, ppid, execname) : printf("%5d %6d %6d ", uid, pid, ppid); OPT_safe ? printf("%S\n", curpsinfo->pr_psargs) : printf("%s\n", curpsinfo->pr_psargs); } '