#!/bin/sh //usr/bin/env stap -DSTP_NO_OVERLOAD $@ $0; exit $? # errsnoop.stp # Copyright (C) 2009 Eugene Teo # # This program is free software; you can redistribute it and/or modify # it under the terms of the GNU General Public License version 2 as # published by the Free Software Foundation. # # attack "stupid userspace" apps # global error, trace probe syscall.* { trace[tid(), probefunc()] = argstr } probe syscall.*.return { t = tid(); p = probefunc() if ([t, p] in trace) { argstr = trace[t, p] delete trace[t, p] } errstr = errno_str(errno = returnval()) if (errno < 0 && strlen(errstr) > 0) { errstr = sprintf("%3d (%s)", -errno, errstr) error[probefunc(), execname(), pid(), errstr, argstr] <<< 1 } } probe timer.s(5) { printf("\033[2J\033[1;1H") printf("%22s %16s %5s %5s %-12s %s\n", "SYSCALL", "PROCESS", "PID", "COUNT", "ERRSTR", "ARGSTR") foreach([func, proc, pid, errstr, argstr] in error- limit 20) { printf("%22s %16s %5d %5d %-12s %s\n", func, proc, pid, @count(error[func, proc, pid, errstr, argstr]), errstr, argstr) } delete error }