Lines Matching +full:- +full:linux +full:- +full:x86_64
1 Demonstrations of opensnoop, the Linux eBPF/bcc version.
4 opensnoop traces the open() syscall system-wide, and prints various details.
26 17358 run 3 0 /lib/x86_64-linux-gnu/libtinfo.so.5
27 17358 run 3 0 /lib/x86_64-linux-gnu/libdl.so.2
28 17358 run 3 0 /lib/x86_64-linux-gnu/libc.so.6
29 17358 run -1 6 /dev/tty
33 17358 run 3 0 /lib/x86_64-linux-gnu/libnss_compat.so.2
34 17358 run 3 0 /lib/x86_64-linux-gnu/libnsl.so.1
36 17358 run 3 0 /lib/x86_64-linux-gnu/libnss_nis.so.2
37 17358 run 3 0 /lib/x86_64-linux-gnu/libnss_files.so.2
50 The -p option can be used to filter on a PID, which is filtered in-kernel. Here
51 I've used it with -T to print timestamps:
53 ./opensnoop -Tp 1956
68 The -x option only prints failed opens:
70 # ./opensnoop -x
72 18372 run -1 6 /dev/tty
73 18373 run -1 6 /dev/tty
74 18373 multilog -1 13 lock
75 18372 multilog -1 13 lock
76 18384 df -1 2 /usr/share/locale/en_US.UTF-8/LC_MESSAGES/coreutils.mo
77 18384 df -1 2 /usr/share/locale/en_US.utf8/LC_MESSAGES/coreutils.mo
78 18384 df -1 2 /usr/share/locale/en_US/LC_MESSAGES/coreutils.mo
79 18384 df -1 2 /usr/share/locale/en.UTF-8/LC_MESSAGES/coreutils.mo
80 18384 df -1 2 /usr/share/locale/en.utf8/LC_MESSAGES/coreutils.mo
81 18384 df -1 2 /usr/share/locale/en/LC_MESSAGES/coreutils.mo
82 18385 run -1 6 /dev/tty
83 18386 run -1 6 /dev/tty
92 A maximum tracing duration can be set with the -d option. For example, to trace
95 # ./opensnoop -d 2
97 2191 indicator-multi 11 0 /sys/block
98 2191 indicator-multi 11 0 /sys/block
99 2191 indicator-multi 11 0 /sys/block
100 2191 indicator-multi 11 0 /sys/block
101 2191 indicator-multi 11 0 /sys/block
104 The -n option can be used to filter on process name using partial matches:
106 # ./opensnoop -n ed
110 2679 sed 3 0 /lib/x86_64-linux-gnu/libselinux.so.1
111 2679 sed 3 0 /lib/x86_64-linux-gnu/libc.so.6
112 2679 sed 3 0 /lib/x86_64-linux-gnu/libpcre.so.3
113 2679 sed 3 0 /lib/x86_64-linux-gnu/libdl.so.2
114 2679 sed 3 0 /lib/x86_64-linux-gnu/libpthread.so.0
116 2679 sed 3 0 /usr/lib/locale/locale-archive
117 2679 sed -1 2
118 2679 sed 3 0 /usr/lib/x86_64-linux-gnu/gconv/gconv-modules.cache
121 2680 sed 3 0 /lib/x86_64-linux-gnu/libselinux.so.1
122 2680 sed 3 0 /lib/x86_64-linux-gnu/libc.so.6
123 2680 sed 3 0 /lib/x86_64-linux-gnu/libpcre.so.3
124 2680 sed 3 0 /lib/x86_64-linux-gnu/libdl.so.2
125 2680 sed 3 0 /lib/x86_64-linux-gnu/libpthread.so.0
127 2680 sed 3 0 /usr/lib/locale/locale-archive
128 2680 sed -1 2
132 to the '-n' option.
137 # ./opensnoop -h
138 usage: opensnoop [-h] [-T] [-x] [-p PID] [-t TID] [-d DURATION] [-n NAME]
143 -h, --help show this help message and exit
144 -T, --timestamp include timestamp on output
145 -x, --failed only show failed opens
146 -p PID, --pid PID trace this PID only
147 -t TID, --tid TID trace this TID only
148 -d DURATION, --duration DURATION
150 -n NAME, --name NAME only print process names containing this name
154 ./opensnoop -T # include timestamps
155 ./opensnoop -x # only show failed opens
156 ./opensnoop -p 181 # only trace PID 181
157 ./opensnoop -t 123 # only trace TID 123
158 ./opensnoop -d 10 # trace for 10 seconds only
159 ./opensnoop -n main # only print process names containing "main"