GeezerVison is showing github.com — bcc/tools/bashreadline.py at master · CentUser/bcc

Expand file tree

bashreadline.py

Copy path

More file actions

Latest commit

History

executable file

64 lines (53 loc) · 1.53 KB

bashreadline.py

Copy path

File metadata and controls

executable file

64 lines (53 loc) · 1.53 KB

Raw

Copy raw file

Download raw file

Open symbols panel

Edit and raw actions

#!/usr/bin/python

# bashreadline Print entered bash commands from all running shells.

# For Linux, uses BCC, eBPF. Embedded C.

# This works by tracing the readline() function using a uretprobe (uprobes).

# Licensed under the Apache License, Version 2.0 (the "License")

# 28-Jan-2016 Brendan Gregg Created this.

# 12-Feb-2016 Allan McAleavy migrated to BPF_PERF_OUTPUT

from __future__ import print_function

from bcc import BPF

from time import strftime

import ctypes as ct

# load BPF program

bpf_text = """

#include <uapi/linux/ptrace.h>

struct str_t {

u64 pid;

char str[80];

};

BPF_PERF_OUTPUT(events);

int printret(struct pt_regs *ctx) {

struct str_t data = {};

u32 pid;

if (!PT_REGS_RC(ctx))

return 0;

pid = bpf_get_current_pid_tgid();

data.pid = pid;

bpf_probe_read(&data.str, sizeof(data.str), (void *)PT_REGS_RC(ctx));

events.perf_submit(ctx,&data,sizeof(data));

return 0;

};

"""

STR_DATA = 80

class Data(ct.Structure):

_fields_ = [

("pid", ct.c_ulonglong),

("str", ct.c_char * STR_DATA)

]

b = BPF(text=bpf_text)

b.attach_uretprobe(name="/bin/bash", sym="readline", fn_name="printret")

# header

print("%-9s %-6s %s" % ("TIME", "PID", "COMMAND"))

def print_event(cpu, data, size):

event = ct.cast(data, ct.POINTER(Data)).contents

print("%-9s %-6d %s" % (strftime("%H:%M:%S"), event.pid,

event.str.decode()))

b["events"].open_perf_buffer(print_event)

while 1:

b.perf_buffer_poll()