Automatically start stracing process upon invocation
The intention of below SystemTap script is to start straceing whenever a process with a given filename is started.
It is called with the following command:
stap -g -v './sstrace.stp' "$PATTERN"
Where PATTERN can for example be mount.
#!/usr/bin/env stap
# Assign command line parameter to the variable.
@define target_filename %( @1 %) # The regex the script will trigger on given as CLI parameter
probe begin {
printf( "Probe starting ...n" )
printf( "Try to attach strace upon executing binary (regex) /%s/nn" , @target_filename )
}
probe end {
printf( "Wrapping up ...n" )
}
probe syscall.execve {
if ( filename =~ @target_filename ) {
start_trace( pid() )
}
}
###
### FUNCTIONS
###
function start_trace( pid ) {
raise( 19 )
# Sleeping is bad practice in SystemTap probe, but don't know how to otherwise
# wait for strace to initialize in time. This will not work as expected when
# workting interactively. Compare these two results while increasing below sleep
# to 1 second.
# $ sudo ./go date
# $ date; echo hi
# $ bash -c 'date; echo hi'
system( sprintf( "strace -f -p %i & sleep 0.01; kill -CONT %i" , pid , pid ) )
}
The idea is that I stop execution (raise( -19 )) of the target process long enough for strace to attach to the process and, then restarting the target process (kill -CONT $TARGET_PID). This often works.
Now the problem I really at least want to understand and hopefully solve, is the fact that on some systems I cannot kill -STOP the target process, it simply throws an error along the lines of: kill: process xyz does not. exist.
I know by the time the execve syscall is called, the PID already exists. What I don't understand is why it doesn't seem to obey the SIGSTOP.
Does anyone know why this happens, how to fix the SystemTap script or have an even smarter way to accomplish the goal starting to trace a process on the fly?
systemtap
asked 4 hours ago
jippiejippie
9,09173056
add a comment |
The intention of below SystemTap script is to start straceing whenever a process with a given filename is started.
It is called with the following command:
stap -g -v './sstrace.stp' "$PATTERN"
Where PATTERN can for example be mount.
#!/usr/bin/env stap
# Assign command line parameter to the variable.
@define target_filename %( @1 %) # The regex the script will trigger on given as CLI parameter
probe begin {
printf( "Probe starting ...n" )
printf( "Try to attach strace upon executing binary (regex) /%s/nn" , @target_filename )
}
probe end {
printf( "Wrapping up ...n" )
}
probe syscall.execve {
if ( filename =~ @target_filename ) {
start_trace( pid() )
}
}
###
### FUNCTIONS
###
function start_trace( pid ) {
raise( 19 )
# Sleeping is bad practice in SystemTap probe, but don't know how to otherwise
# wait for strace to initialize in time. This will not work as expected when
# workting interactively. Compare these two results while increasing below sleep
# to 1 second.
# $ sudo ./go date
# $ date; echo hi
# $ bash -c 'date; echo hi'
system( sprintf( "strace -f -p %i & sleep 0.01; kill -CONT %i" , pid , pid ) )
}
The idea is that I stop execution (raise( -19 )) of the target process long enough for strace to attach to the process and, then restarting the target process (kill -CONT $TARGET_PID). This often works.
Now the problem I really at least want to understand and hopefully solve, is the fact that on some systems I cannot kill -STOP the target process, it simply throws an error along the lines of: kill: process xyz does not. exist.
I know by the time the execve syscall is called, the PID already exists. What I don't understand is why it doesn't seem to obey the SIGSTOP.
Does anyone know why this happens, how to fix the SystemTap script or have an even smarter way to accomplish the goal starting to trace a process on the fly?
systemtap
asked 4 hours ago
jippiejippie
9,09173056
add a comment |
The intention of below SystemTap script is to start straceing whenever a process with a given filename is started.
It is called with the following command:
stap -g -v './sstrace.stp' "$PATTERN"
Where PATTERN can for example be mount.
#!/usr/bin/env stap
# Assign command line parameter to the variable.
@define target_filename %( @1 %) # The regex the script will trigger on given as CLI parameter
probe begin {
printf( "Probe starting ...n" )
printf( "Try to attach strace upon executing binary (regex) /%s/nn" , @target_filename )
}
probe end {
printf( "Wrapping up ...n" )
}
probe syscall.execve {
if ( filename =~ @target_filename ) {
start_trace( pid() )
}
}
###
### FUNCTIONS
###
function start_trace( pid ) {
raise( 19 )
# Sleeping is bad practice in SystemTap probe, but don't know how to otherwise
# wait for strace to initialize in time. This will not work as expected when
# workting interactively. Compare these two results while increasing below sleep
# to 1 second.
# $ sudo ./go date
# $ date; echo hi
# $ bash -c 'date; echo hi'
system( sprintf( "strace -f -p %i & sleep 0.01; kill -CONT %i" , pid , pid ) )
}
The idea is that I stop execution (raise( -19 )) of the target process long enough for strace to attach to the process and, then restarting the target process (kill -CONT $TARGET_PID). This often works.
Now the problem I really at least want to understand and hopefully solve, is the fact that on some systems I cannot kill -STOP the target process, it simply throws an error along the lines of: kill: process xyz does not. exist.
I know by the time the execve syscall is called, the PID already exists. What I don't understand is why it doesn't seem to obey the SIGSTOP.
Does anyone know why this happens, how to fix the SystemTap script or have an even smarter way to accomplish the goal starting to trace a process on the fly?
systemtap
asked 4 hours ago
jippiejippie
9,09173056
The intention of below SystemTap script is to start straceing whenever a process with a given filename is started.
It is called with the following command:
stap -g -v './sstrace.stp' "$PATTERN"
Where PATTERN can for example be mount.
#!/usr/bin/env stap
# Assign command line parameter to the variable.
@define target_filename %( @1 %) # The regex the script will trigger on given as CLI parameter
probe begin {
printf( "Probe starting ...n" )
printf( "Try to attach strace upon executing binary (regex) /%s/nn" , @target_filename )
}
probe end {
printf( "Wrapping up ...n" )
}
probe syscall.execve {
if ( filename =~ @target_filename ) {
start_trace( pid() )
}
}
###
### FUNCTIONS
###
function start_trace( pid ) {
raise( 19 )
# Sleeping is bad practice in SystemTap probe, but don't know how to otherwise
# wait for strace to initialize in time. This will not work as expected when
# workting interactively. Compare these two results while increasing below sleep
# to 1 second.
# $ sudo ./go date
# $ date; echo hi
# $ bash -c 'date; echo hi'
system( sprintf( "strace -f -p %i & sleep 0.01; kill -CONT %i" , pid , pid ) )
}
The idea is that I stop execution (raise( -19 )) of the target process long enough for strace to attach to the process and, then restarting the target process (kill -CONT $TARGET_PID). This often works.
Now the problem I really at least want to understand and hopefully solve, is the fact that on some systems I cannot kill -STOP the target process, it simply throws an error along the lines of: kill: process xyz does not. exist.
I know by the time the execve syscall is called, the PID already exists. What I don't understand is why it doesn't seem to obey the SIGSTOP.
Does anyone know why this happens, how to fix the SystemTap script or have an even smarter way to accomplish the goal starting to trace a process on the fly?
systemtap
systemtap
asked 4 hours ago
jippiejippie
9,09173056
asked 4 hours ago
jippiejippie
9,09173056
asked 4 hours ago
jippiejippie
9,09173056
asked 4 hours ago
jippiejippie
9,09173056
asked 4 hours ago
jippiejippie
9,09173056
9,09173056
add a comment |
add a comment |
0
active
oldest
votes
Your Answer
StackExchange.ready(function() {
var channelOptions = {
tags: "".split(" "),
id: "106"
};
initTagRenderer("".split(" "), "".split(" "), channelOptions);
StackExchange.using("externalEditor", function() {
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled) {
StackExchange.using("snippets", function() {
createEditor();
});
}
else {
createEditor();
}
});
function createEditor() {
StackExchange.prepareEditor({
heartbeatType: 'answer',
autoActivateHeartbeat: false,
convertImagesToLinks: false,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: null,
bindNavPrevention: true,
postfix: "",
imageUploader: {
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
},
onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
});
}
});
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2funix.stackexchange.com%2fquestions%2f507514%2fautomatically-start-stracing-process-upon-invocation%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
0
active
oldest
votes
0
active
oldest
votes
active
oldest
votes
active
oldest
votes
Thanks for contributing an answer to Unix & Linux Stack Exchange!
- Please be sure to answer the question. Provide details and share your research!
But avoid …
- Asking for help, clarification, or responding to other answers.
- Making statements based on opinion; back them up with references or personal experience.
To learn more, see our tips on writing great answers.
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2funix.stackexchange.com%2fquestions%2f507514%2fautomatically-start-stracing-process-upon-invocation%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
