FM / lwtools

/usr/share/systemtap/examples/lwtools

Name	Size	Mode	Actions
accept2close-nd.8	1424	0644	edit dl rm
accept2close-nd.meta	597	0644	edit dl rm
accept2close-nd.stp	1798	0755	edit dl rm
accept2close-nd.txt	3385	0644	edit dl rm
biolatency-nd.8	1671	0644	edit dl rm
biolatency-nd.meta	622	0644	edit dl rm
biolatency-nd.stp	2071	0755	edit dl rm
biolatency-nd_example.txt	7362	0644	edit dl rm
bitesize-nd.8	1157	0644	edit dl rm
bitesize-nd.meta	491	0644	edit dl rm
bitesize-nd.stp	1543	0755	edit dl rm
bitesize-nd_example.txt	3426	0644	edit dl rm
execsnoop-nd.8	1235	0644	edit dl rm
execsnoop-nd.meta	570	0644	edit dl rm
execsnoop-nd.stp	1283	0755	edit dl rm
execsnoop-nd_example.txt	2585	0644	edit dl rm
fslatency-nd.8	1930	0644	edit dl rm
fslatency-nd.meta	660	0644	edit dl rm
fslatency-nd.stp	3982	0755	edit dl rm
fslatency-nd_example.txt	13384	0644	edit dl rm
fsslower-nd.8	1753	0644	edit dl rm
fsslower-nd.meta	623	0644	edit dl rm
fsslower-nd.stp	3715	0755	edit dl rm
fsslower-nd_example.txt	1938	0644	edit dl rm
killsnoop-nd.8	1131	0644	edit dl rm
killsnoop-nd.meta	384	0644	edit dl rm
killsnoop-nd.stp	1281	0755	edit dl rm
killsnoop-nd_example.txt	1908	0644	edit dl rm
opensnoop-nd.8	1268	0644	edit dl rm
opensnoop-nd.meta	357	0644	edit dl rm
opensnoop-nd.stp	1026	0755	edit dl rm
opensnoop-nd_example.txt	1124	0644	edit dl rm
README	107	0644	edit dl rm
rwtime-nd.8	1146	0644	edit dl rm
rwtime-nd.meta	412	0644	edit dl rm
rwtime-nd.stp	1599	0755	edit dl rm
rwtime-nd_example.txt	4185	0644	edit dl rm
syscallbypid-nd.8	1089	0644	edit dl rm
syscallbypid-nd.meta	404	0644	edit dl rm
syscallbypid-nd.stp	1100	0755	edit dl rm
syscallbypid-nd_example.txt	9322	0644	edit dl rm

Edit: /usr/share/systemtap/examples/lwtools/execsnoop-nd.8 (1235B)

.TH execsnoop-nd 8  "2015-01-30" "USER COMMANDS"
.SH NAME
execsnoop-nd \- trace process exec() with arguments. Uses Linux SystemTap (non-debuginfo).
.SH SYNOPSIS
.B execsnoop-nd.stp
.SH DESCRIPTION
This traces exec() from the fork()->exec() sequence, which means it will not
catch new processes that only fork(). It will also show every exec(), including
those if a process re-execs.

This is a basic version of execsnoop.
.SH REQUIREMENTS
SystemTap.
.SH EXAMPLES
.TP
Trace all new processes and arguments via exec():
#
.B execsnoop-nd.stp
.SH FIELDS
.TP
TIME
Time of the exec(), in human readable format.
.TP
PID
Process ID.
.TP
PPID
Parent process ID.
.TP
COMM
Process name.
.TP
ARGS
Command line arguments.
.SH OVERHEAD
This reads and processes exec() events and prints a line of output for each.
Since the rate of exec() is expected to be low (< 500/s), the overhead is
expected to be negligible.
.SH SOURCE
This is from the SystemTap lwtools collection.
.IP
https://github.com/brendangregg/systemtap-lwtools
.PP
Also look under the examples directory for a text file containing example
usage, output, and commentary for this tool.
.SH OS
Linux
.SH STABILITY
Unstable - in development.
.SH AUTHOR
Brendan Gregg
.SH SEE ALSO
top(1)

cmd: