shmsnoop-bpfcc8
Trace system v shared memory syscalls. uses linux ebpf/bcc.
Usage
shmsnoop [-h]
[-T]
[-p]
[-t]
[-d
DURATION]
[-n
NAME]
Overview
shmsnoop traces System V shared memory syscalls: shmget, shmat, shmdt, shmctl
Since this uses BPF, only the root user can use this tool.
Requirements
CONFIG_BPF and bcc.
Options
-
-h -
Print usage message.
-
-T -
Include a timestamp column.
-
-p PID -
Trace this process ID only (filtered in-kernel).
-
-t TID -
Trace this thread ID only (filtered in-kernel).
-
-d DURATION -
Total duration of trace in seconds.
-
-n NAME -
Only print command lines matching this command name (regex)
Examples
Trace all shm* syscalls:
|
# |
|---|---|
Trace all shm* syscalls, and include timestamps:
|
# shmsnoop -T |
Only trace shm* syscalls where the process contains "server":
|
# shmsnoop -n server |
Fields
- TIME(s)
-
Time of shm syscall return, in seconds.
- PID
-
Process ID
- COMM
-
Process/command name.
- RET
-
Return value of shm syscall.
- ARGS
-
"arg: value" couples that represent given syscall arguments as described in their manpage
Source
This is from bcc.
-
https://github.com/iovisor/bcc
Also look in the bcc distribution for a companion _examples.txt file containing example usage, output, and commentary for this tool.
OS
Linux
Stability
Unstable - in development.
Releases
4 releases since Debian 10 (Buster); the text changed 1 time.