Current File : //usr/share/doc/bpfcc-tools/examples/doc/sofdsnoop_example.txt
Demonstrations of sofdsnoop, the Linux eBPF/bcc version.
sofdsnoop traces FDs passed through unix sockets
# ./sofdsnoop.py
ACTION TID COMM SOCKET FD NAME
SEND 2576 Web Content 24:socket:[39763] 51 /dev/shm/org.mozilla.ipc.2576.23874
RECV 2576 Web Content 49:socket:[809997] 51
SEND 2576 Web Content 24:socket:[39763] 58 N/A
RECV 2464 Gecko_IOThread 75:socket:[39753] 55
Every file descriptor that is passed via unix sockets os displayed
on separate line together with process info (TID/COMM columns),
ACTION details (SEND/RECV), file descriptor number (FD) and its
translation to file if available (NAME).
The file descriptor (fd) value is bound to a process. The SEND
lines display the fd value within the sending process. The RECV
lines display the fd value of the sending process. That's why
there's translation to name only on SEND lines, where we are
able to find it in task proc records.
This works by tracing sendmsg/recvmsg system calls to provide
the socket fds, and scm_send_entry/scm_detach_fds to provide
the file descriptor details.
A -T option can be used to include a timestamp column,
and a -n option to match on a command name. Regular
expressions are allowed. For example, matching commands
containing "server" with timestamps:
# ./sofdsnoop.py -T -n Web
TIME(s) ACTION TID COMM SOCKET FD NAME
0.000000000 SEND 2576 Web Content 24:socket:[39763] 51 /dev/shm/org.mozilla.ipc.2576.25404 (deleted)
0.000413000 RECV 2576 Web Content 49:/dev/shm/org.mozilla.ipc.2576.25404 (deleted) 51
0.000558000 SEND 2576 Web Content 24:socket:[39763] 58 N/A
0.000952000 SEND 2576 Web Content 24:socket:[39763] 58 socket:[817962]
A -p option can be used to trace only selected process:
# ./sofdsnoop.py -p 2576 -T
TIME(s) ACTION TID COMM SOCKET FD NAME
0.000000000 SEND 2576 Web Content 24:socket:[39763] 51 N/A
0.000138000 RECV 2576 Web Content 49:N/A 5
0.000191000 SEND 2576 Web Content 24:socket:[39763] 58 N/A
0.000424000 RECV 2576 Web Content 51:/dev/shm/org.mozilla.ipc.2576.25319 (deleted) 49
USAGE message:
usage: sofdsnoop.py [-h] [-T] [-p PID] [-t TID] [-n NAME] [-d DURATION]
Trace file descriptors passed via socket
optional arguments:
-h, --help show this help message and exit
-T, --timestamp include timestamp on output
-p PID, --pid PID trace this PID only
-t TID, --tid TID trace this TID only
-n NAME, --name NAME only print process names containing this name
-d DURATION, --duration DURATION
total duration of trace in seconds
examples:
./sofdsnoop # trace passed file descriptors
./sofdsnoop -T # include timestamps
./sofdsnoop -p 181 # only trace PID 181
./sofdsnoop -t 123 # only trace TID 123
./sofdsnoop -d 10 # trace for 10 seconds only
./sofdsnoop -n main # only print process names containing "main"
Mini Shell