stapprobes.process5

Overview

This family of probe points is used to probe the process activities. It contains the following probe points:

process.create

Fires whenever a new process is successfully created, either as a result of one of the fork syscall variants, or a new kernel thread.

Arguments:

task
a handle to the newly created process

new_pid
pid of the newly created process

process.start

Fires immediately before a new process begins execution.

Arguments:

N/A

process.exec

Fires whenever a process attempts to exec to a new program

Arguments:

filename
the path to the new executable

process.exec_complete

Fires at the completion of an exec call

Arguments:

errno
the error number resulting from the exec

success
a boolean indicating whether the exec was successful

process.exit

Fires when a process terminates. This will always be followed by a process.release, though the latter may be delayed if the process waits in a zombie state.

Arguments:

code
the exit code of the process

process.release

Fires when a process is released from the kernel. This always follows a process.exit, though it may be delayed somewhat if the process waits in a zombie state.

Arguments:

task
a task handle to the process being released

pid
pid of the process being released