bpftrace/tools/opensnoop.bt at master · sevan/bpftrace · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
#!/usr/bin/env bpftrace
// opensnoop	Trace open() syscalls.
// 		For Linux, uses bpftrace and eBPF.
//
// USAGE: opensnoop.bt -- [--depth=<N>] [--errname]
//
// Example of usage:
//
// # ./opensnoop.bt
// Attached 8 probes
// Tracing open syscalls... Hit Ctrl-C to end.
// PID    COMM               FD ERR PATH
// 37421  bpftrace           33   0 /sys/kernel/debug/tracing/events/syscalls/sys_exit_openat2/id
// 3108   cgroupify           5   0 /Git/bpftrace/bpftrace/rongtao/.
// 1400   systemd-oomd       13   0 /sys/fs/cgroup/user.slice/user-1000.slice/user@1000.service/app.slice/app-gnome\x2dsession\x2dmanager.slice/memory.pressure
// 3108   cgroupify           5   0 /Git/bpftrace/bpftrace/rongtao/3122/cgroup.procs
// 1615   abrt-dump-journ     4   0 /var/log/journal/c27675f9250c4420a7479dd37bd7e8e2/system.journal
// 1614   abrt-dump-journ     4   0 /var/log/journal/c27675f9250c4420a7479dd37bd7e8e2/system.journal
// 1613   abrt-dump-journ     4   0 /var/log/journal/c27675f9250c4420a7479dd37bd7e8e2/system.journal
// 3108   cgroupify           5   0 /Git/bpftrace/bpftrace/rongtao/3150/cgroup.procs
// 3108   cgroupify           5   0 /Git/bpftrace/bpftrace/rongtao/17355/cgroup.procs
// 2440   snmp-pass           4   0 /proc/cpuinfo
// 2440   snmp-pass           4   0 /proc/stat
//
// While tracing, at "ls" command was launched: the libraries it uses can be seen
// as they were opened.
//
// opensnoop can be useful for discovering configuration and log files, if used
// during application startup.
//
// This is a bpftrace version of the bcc tool of the same name.
// The bcc version provides command line options to customize the output.
//
// Copyright 2018 Netflix, Inc.
//
// 08-Sep-2018	Brendan Gregg	Created this.
// 16-Sep-2025	Rong Tao	Support fullpath of file.
// 29-Jul-2026	Rong Tao	Use stdlib abs_path() to get the absolute path.

config = {
  missing_probes = warn;
}

macro max_path_depth()
{
  getopt("depth", 35, "Maximum depth of full path")
}

macro errname()
{
  getopt("errname", false, "Show error message instead of errno")
}

BEGIN
{
  printf("Tracing open syscalls... Hit Ctrl-C to end.\n");
  printf("%-6s %-16s %4s", "PID", "COMM", "FD");
  if errname {
    printf(" %16s", "ERR");
  } else {
    printf(" %4s", "ERR");
  }
  printf(" %s\n", "PATH");
}

tracepoint:syscalls:sys_enter_open,
tracepoint:syscalls:sys_enter_openat,
tracepoint:syscalls:sys_enter_openat2
{
  @filename[tid] = args.filename;
}

macro sys_exit(ret, $file)
{
  $ret = ret;
  $fd = ($ret >= 0) ? $ret : (-1);
  $errno = ($ret >= 0) ? 0 : (-$ret);

  printf("%-6d %-16s %4d", pid, comm, $fd);

  if errname {
    printf(" %16s ", strerror($errno));
  } else {
    printf(" %3d ", $errno);
  }

  // Skip display cwd if path start with '/'.
  if ($file[0] != "/"[0]) {
    printf("%s\n", abs_path($file, max_path_depth));
  } else {
    printf("%s\n", $file);
  }
}

tracepoint:syscalls:sys_exit_open,
tracepoint:syscalls:sys_exit_openat,
tracepoint:syscalls:sys_exit_openat2
/@filename[tid]/
{
  $file = str(@filename[tid]);
  sys_exit(args.ret, $file);
  delete(@filename, tid);
}

END
{
  clear(@filename);
}