#!/usr/bin/stap /* * opensnoop-nd.stp Trace file open()s. Basic version of opensnoop. * For Linux, uses SystemTap (non-debuginfo). * * Copyright (C) 2015 Brendan Gregg. * * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License as published by * the Free Software Foundation; either version 2 of the License, or * (at your option) any later version. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * 21-Mar-2014 Brendan Gregg Created this. */ probe begin { printf("%6s %6s %16s %4s %s\n", "UID", "PID", "COMM", "FD", "PATH"); } probe nd_syscall.open.return { /* trace on return to ensure the pathname has faulted in */ printf("%6d %6d %16s %4d %s\n", uid(), pid(), execname(), retval, user_string(@entry(pointer_arg(1)), "-")); }