Current File : //usr/share/doc/bpftrace/examples/bashreadline_example.txt
Demonstrations of bashreadline, the Linux bpftrace/eBPF version.
This prints bash commands from all running bash shells on the system. For
example:
# ./bashreadline.bt
Attaching 2 probes...
Tracing bash commands... Hit Ctrl-C to end.
TIME PID COMMAND
06:40:06 5526 df -h
06:40:09 5526 ls -l
06:40:18 5526 echo hello bpftrace
06:40:42 5526 echooo this is a failed command, but we can see it anyway
^C
The entered command may fail. This is just showing what command lines were
entered interactively for bash to process.
It works by tracing the return of the readline() function using uprobes
(specifically a uretprobe).
There is another version of this tool in bcc: https://github.com/iovisor/bcc
Mini Shell