statsnoop

#!/usr/bin/sh
#
# statsnoop - snoop file stats as they occur.
#             Written using DTrace (Solaris 10 3/05).
#
# $Id: statsnoop 65 2007-10-04 11:09:40Z brendan $
#
# USAGE:	statsnoop [-a|-A|-ceghlsvxZ] [-f pathname] [-t syscall]
#		          [-n name] [-p PID]
#
#		statsnoop	# default output
#
#		-a		# print most data
#		-A		# dump all data, space delimited
#		-c		# print cwd of process
#		-e		# print errno value
#		-g		# print command arguments
#		-l		# print syscall type
#		-s		# print start time, us
#		-v		# print start time, string
#		-x		# only print failed stats
#		-Z		# print zonename
#		-f pathname	# file pathname to snoop
#		-n name		# command name to snoop
#		-p PID		# process ID to snoop
#		-t syscall	# stat syscall to trace
#	eg,
#		statsnoop -v			# human readable timestamps
#		statsnoop -S			# syscall type
#		statsnoop -e			# see error codes
#		statsnoop -f /etc/passwd	# snoop this file only
# 	
# FIELDS:
#		ZONE		Zone name
#		UID		User ID
#		PID		Process ID
#		PPID		Parent Process ID
#		FD		file descriptor (-1 for error)
#		ERR		errno value (see /usr/include/sys/errno.h)
#		TYPE		syscall type
#		CWD		current working directory of process
#		PATH		pathname for file stat
#		COMM		command name for the process
#		ARGS		argument listing for the process
#		TIME		timestamp for the stat event, us
#		STRTIME		timestamp for the stat event, string
#
# SEE ALSO: truss, BSM auditing.
#
# COPYRIGHT: Copyright (c) 2007 Brendan Gregg.
#
# CDDL HEADER START
#
#  The contents of this file are subject to the terms of the
#  Common Development and Distribution License, Version 1.0 only
#  (the "License").  You may not use this file except in compliance
#  with the License.
#
#  You can obtain a copy of the license at Docs/cddl1.txt
#  or http://www.opensolaris.org/os/licensing.
#  See the License for the specific language governing permissions
#  and limitations under the License.
#
# CDDL HEADER END
#
# Author: Brendan Gregg  [Sydney, Australia]
#
# 09-Sep-2007	Brendan Gregg	Created this.
# 


##############################
# --- Process Arguments ---
#

### Default variables
opt_dump=0; opt_file=0; opt_time=0; opt_timestr=0; opt_args=0
opt_zone=0; opt_cwd=0; opt_failonly=0; opt_err=0; filter=0; pathname=.
opt_name=0; opt_pid=0; opt_type=0; opt_trace=0; pname=.; pid=0; trace=.

### Process options
while getopts aAcef:ghln:p:st:vxZ name
do
	case $name in
	a)	opt_time=1; opt_timestr=1; opt_args=1; opt_err=1 ;;
	A)	opt_dump=1 ;;
	c)	opt_cwd=1 ;;
	e)	opt_err=1 ;;
	g)	opt_args=1 ;;
	f)	opt_file=1; pathname=$OPTARG ;;
	l)	opt_type=1 ;;
	n)	opt_name=1; pname=$OPTARG ;;
	p)	opt_pid=1; pid=$OPTARG ;;
	s)	opt_time=1 ;;
	t)	opt_trace=1; trace=$OPTARG ;;
	v)	opt_timestr=1 ;;
	x)	opt_failonly=1 ;;
	Z)	opt_zone=1 ;;
	h|?)	cat <<-END >&2
		USAGE: statsnoop [-a|-A|-ceghlsvxZ] [-f pathname] [-t syscall]
		                 [-n execname] [-p PID]
		       statsnoop                # default output
		                -a              # print most data
		                -A              # dump all data, space delimited
		                -c              # print cwd of process
		                -e              # print errno value
		                -g              # print command arguments
		                -l              # print syscall type
		                -s              # print start time, us
		                -v              # print start time, string
		                -x              # only print failed stats
		                -Z              # print zonename
		                -f pathname	# pathname name to snoop
		                -n name		# process name to snoop
		                -p PID		# process ID to snoop
		                -t syscall	# stat syscall to trace
		  eg,
		       statsnoop -v             # human readable timestamps
		       statsnoop -e             # see error codes
		       statsnoop -f /etc/motd   # snoop this file only
		END
		exit 1
	esac
done

### Option logic
if [ $opt_dump -eq 1 ]; then
	opt_zone=0; opt_cwd=0; opt_time=0; opt_timestr=0; opt_type=0
	opt_args=2 
fi
if [ $opt_name -eq 1 -o $opt_pid -eq 1 -o $opt_trace -eq 1 ]; then
	filter=1
fi


#################################
# --- Main Program, DTrace ---
#
/usr/sbin/dtrace -n '
 /*
  * Command line arguments
  */
 inline int OPT_dump 	 = '$opt_dump';
 inline int OPT_file 	 = '$opt_file';
 inline int OPT_args 	 = '$opt_args';
 inline int OPT_cwd	 = '$opt_cwd';
 inline int OPT_err	 = '$opt_err';
 inline int OPT_zone 	 = '$opt_zone';
 inline int OPT_time 	 = '$opt_time';
 inline int OPT_timestr	 = '$opt_timestr';
 inline int OPT_type	 = '$opt_type';
 inline int OPT_failonly = '$opt_failonly';
 inline int OPT_pid	 = '$opt_pid';
 inline int OPT_name	 = '$opt_name';
 inline int OPT_trace	 = '$opt_trace';
 inline int FILTER 	 = '$filter';
 inline int PID		 = '$pid';
 inline string PATHNAME	 = "'$pathname'";
 inline string NAME	 = "'$pname'";
 inline string TRACE	 = "'$trace'";
 /*
  * Manifest constants
  */
 inline uint_t AT_FDCWD = 0xffd19553;
 inline uint_t SLASH = 0x2f;	/* '/' */

 #pragma D option quiet
 #pragma D option switchrate=10hz

 /*
  * Print header
  */
 dtrace:::BEGIN 
 {
	/* print optional headers */
 	OPT_time ? printf("%-14s ", "TIME") : 1;
 	OPT_timestr ? printf("%-20s ", "STRTIME") : 1;
 	OPT_zone ? printf("%-10s ", "ZONE") : 1;

	/* print dump headers */
	OPT_dump ? printf("%s %s %s %s %s %s %s %s %s %s %s", "ZONE",
	    "TIME", "UID", "PID", "PPID", "COMM", "FD", "ERR", "CWD", 
	    "PATH", "ARGS") : printf("%5s %6s ","UID","PID");
	
	/* print main headers */
	OPT_args == 0 ? printf("%-12s ", "COMM") : 1;
	OPT_dump == 0 ? printf("%3s ", "FD") : 1;
	OPT_err ? printf("%3s ", "ERR") : 1;
	OPT_cwd ? printf("%-20s ", "CWD") : 1;
	OPT_type ? printf("%-8s ", "TYPE") : 1;
	OPT_dump == 0 ? printf("%-20s ", "PATH") : 1;
	OPT_args == 1 ? printf("%s", "ARGS") : 1;
	printf("\n");
 }

 /*
  * Print stat event
  */
 syscall::fstatat:entry, syscall::fstatat64:entry
 {
	/* default is to trace unless filtering */
	self->ok = FILTER ? 0 : 1;

	/* check each filter */
	(OPT_name == 1 && NAME == execname) ? self->ok = 1 : 1;
	(OPT_pid == 1 && PID == pid) ? self->ok = 1 : 1;
	(OPT_trace == 1 && TRACE == probefunc) ? self->ok = 1 : 1;
 }

 syscall::fstatat:entry, syscall::fstatat64:entry
 /self->ok/
 {
	self->dfd = (uint_t)arg0;	/* may be AT_FDCWD */
	self->pathp = arg1;		/* may be 0 (for fstat) */
 }

 syscall::fstatat:return, syscall::fstatat64:return
 /self->ok && self->pathp != 0/		/* stat, lstat */
 {
	self->rpath = copyinstr(self->pathp);
	self->dir = *self->rpath == SLASH? "" :	/* it is a full pathname */
	    (self->dfd == AT_FDCWD? cwd :	/* it is relative to cwd */
	    fds[self->dfd].fi_pathname);	/* it is relative to dfd */
	self->join = *self->rpath == SLASH? "" : "/";
	self->path = strjoin(strjoin(self->dir, self->join), self->rpath);

	/* cleanup */
	self->join = 0;
	self->dir = 0;
	self->rpath = 0;
 }

 syscall::fstatat:return, syscall::fstatat64:return
 /self->ok && self->pathp == 0/		/* fstat */
 {
	self->path = fds[self->dfd].fi_pathname;
 }

 syscall::fstatat:return, syscall::fstatat64:return
 /self->ok && (!OPT_failonly || (int)arg0 < 0) && 
     (OPT_file == 0 || (OPT_file == 1 && PATHNAME == self->path))/
 {
	/* print optional fields */
 	OPT_time ? printf("%-14d ", timestamp/1000) : 1;
 	OPT_timestr ? printf("%-20Y ", walltimestamp) : 1;
 	OPT_zone ? printf("%-10s ", zonename) : 1;

	/* print dump fields */
	OPT_dump ? printf("%s %d %d %d %d %s %d %d %s %s %S", zonename,
	    timestamp/1000, uid, pid, ppid, execname, (int)arg0, errno,
	    cwd, self->path, curpsinfo->pr_psargs) :
	    printf("%5d %6d ", uid, pid);

	/* print main fields */
	OPT_args == 0 ? printf("%-12.12s ", execname) : 1;
	OPT_dump == 0 ? printf("%3d ", (int)arg0) : 1;
	OPT_err ? printf("%3d ", errno) : 1;
	OPT_cwd ? printf("%-20s ", cwd) : 1;
	OPT_type ? printf("%-8s ", probefunc) : 1;
	OPT_dump == 0 ? printf("%-20s ", self->path) : 1;
	OPT_args == 1 ? printf("%S", curpsinfo->pr_psargs) : 1;
	printf("\n");
 }

 /* 
  * Cleanup 
  */
 syscall::fstatat:return, syscall::fstatat64:return
 /self->ok/
 {
	self->dfd = 0;
	self->pathp = 0;
	self->path = 0;
	self->ok = 0;
 }
'