Demonstrations of killsnoop, the Linux eBPF/bcc version.
|
|
|
This traces signals sent via the kill() syscall. For example:
|
|
# ./killsnoop
|
TIME PID COMM SIG TPID RESULT
|
12:10:51 13967 bash 9 13885 0
|
12:11:34 13967 bash 9 1024 -3
|
12:11:41 815 systemd-udevd 15 14076 0
|
|
The first line showed a SIGKILL (9) sent from PID 13967 (a bash shell) to
|
PID 13885. The result, 0, means success.
|
|
The second line showed the same signal sent, this time resulting in a -3
|
(ESRCH: no such process).
|
|
|
USAGE message:
|
|
# ./killsnoop -h
|
usage: killsnoop [-h] [-x] [-p PID]
|
|
Trace signals issued by the kill() syscall
|
|
optional arguments:
|
-h, --help show this help message and exit
|
-x, --failed only show failed kill syscalls
|
-p PID, --pid PID trace this PID only
|
|
examples:
|
./killsnoop # trace all kill() signals
|
./killsnoop -x # only show failed kills
|
./killsnoop -p 181 # only trace PID 181
|
