TrxShell [ mangaberri.com ]

Name	Size	Permission
ModemManager	2.07 MB	-rwxr-xr-x
a2disconf	15.75 KB	-rwxr-xr-x
a2dismod	15.75 KB	-rwxr-xr-x
a2dissite	15.75 KB	-rwxr-xr-x
a2enconf	15.75 KB	-rwxr-xr-x
a2enmod	15.75 KB	-rwxr-xr-x
a2ensite	15.75 KB	-rwxr-xr-x
a2query	9.6 KB	-rwxr-xr-x
aa-load	38.75 KB	-rwxr-xr-x
aa-remove-unknown	3.15 KB	-rwxr-xr-x
aa-status	39.06 KB	-rwxr-xr-x
aa-teardown	137 B	-rwxr-xr-x
accessdb	14.55 KB	-rwxr-xr-x
add-shell	1.03 KB	-rwxr-xr-x
addgnupghome	3 KB	-rwxr-xr-x
addgroup	53.9 KB	-rwxr-xr-x
adduser	53.9 KB	-rwxr-xr-x
agetty	59.56 KB	-rwxr-xr-x
apache2	736.55 KB	-rwxr-xr-x
apache2ctl	7.26 KB	-rwxr-xr-x
apachectl	7.26 KB	-rwxr-xr-x
apparmor_parser	1.55 MB	-rwxr-xr-x
apparmor_status	39.06 KB	-rwxr-xr-x
applygnupgdefaults	2.17 KB	-rwxr-xr-x
argdist-bpfcc	36 KB	-rwxr-xr-x
arp	61.61 KB	-rwxr-xr-x
arpd	26.33 KB	-rwxr-xr-x
arptables	219.16 KB	-rwxr-xr-x
arptables-nft	219.16 KB	-rwxr-xr-x
arptables-nft-restore	219.16 KB	-rwxr-xr-x
arptables-nft-save	219.16 KB	-rwxr-xr-x
arptables-restore	219.16 KB	-rwxr-xr-x
arptables-save	219.16 KB	-rwxr-xr-x
audisp-af_unix	14.31 KB	-rwxr-xr-x
audisp-remote	50.41 KB	-rwxr-xr-x
audisp-syslog	18.3 KB	-rwxr-xr-x
audispd-zos-remote	34.38 KB	-rwxr-xr-x
auditctl	50.5 KB	-rwxr-xr-x
auditd	118.41 KB	-rwxr-xr-x
augenrules	3.74 KB	-rwxr-xr-x
aureport	110.41 KB	-rwxr-xr-x
ausearch	110.45 KB	-rwxr-xr-x
autrace	18.3 KB	-rwxr-xr-x
badblocks	34.32 KB	-rwxr-xr-x
bashreadline-bpfcc	2.32 KB	-rwxr-xr-x
bashreadline.bt	698 B	-rwxr-xr-x
bcache-super-show	14.3 KB	-rwxr-xr-x
bindsnoop-bpfcc	15.96 KB	-rwxr-xr-x
biolatency-bpfcc	11.1 KB	-rwxr-xr-x
biolatency-kp.bt	664 B	-rwxr-xr-x
biolatency.bt	681 B	-rwxr-xr-x
biolatpcts-bpfcc	10.01 KB	-rwxr-xr-x
biopattern-bpfcc	3.86 KB	-rwxr-xr-x
biosdecode	27.2 KB	-rwxr-xr-x
biosnoop-bpfcc	10.58 KB	-rwxr-xr-x
biosnoop.bt	1.12 KB	-rwxr-xr-x
biostacks.bt	915 B	-rwxr-xr-x
biotop-bpfcc	9.34 KB	-rwxr-xr-x
bitesize-bpfcc	1.14 KB	-rwxr-xr-x
bitesize.bt	567 B	-rwxr-xr-x
blkdeactivate	15.97 KB	-rwxr-xr-x
blkdiscard	22.38 KB	-rwxr-xr-x
blkid	54.41 KB	-rwxr-xr-x
blkzone	34.38 KB	-rwxr-xr-x
blockdev	34.38 KB	-rwxr-xr-x
bpflist-bpfcc	2.54 KB	-rwxr-xr-x
bpftool	1.58 KB	-rwxr-xr-x
bridge	108.49 KB	-rwxr-xr-x
btrfsdist-bpfcc	6.47 KB	-rwxr-xr-x
btrfsslower-bpfcc	9.75 KB	-rwxr-xr-x
cache_check	1.36 MB	-rwxr-xr-x
cache_dump	1.36 MB	-rwxr-xr-x
cache_metadata_size	1.36 MB	-rwxr-xr-x
cache_repair	1.36 MB	-rwxr-xr-x
cache_restore	1.36 MB	-rwxr-xr-x
cache_writeback	1.36 MB	-rwxr-xr-x
cachestat-bpfcc	6.38 KB	-rwxr-xr-x
cachetop-bpfcc	9.15 KB	-rwxr-xr-x
capable-bpfcc	8.28 KB	-rwxr-xr-x
capable.bt	1.88 KB	-rwxr-xr-x
capsh	57.09 KB	-rwxr-xr-x
cfdisk	94.73 KB	-rwxr-xr-x
cgdisk	166.48 KB	-rwxr-xr-x
chcpu	30.38 KB	-rwxr-xr-x
check_forensic	952 B	-rwxr-xr-x
chgpasswd	58.32 KB	-rwxr-xr-x
chmem	34.38 KB	-rwxr-xr-x
chpasswd	54.43 KB	-rwxr-xr-x
chroot	38.51 KB	-rwxr-xr-x
cobjnew-bpfcc	53 B	-rwxr-xr-x
compactsnoop-bpfcc	11.1 KB	-rwxr-xr-x
cpgr	48.45 KB	-rwxr-xr-x
cppw	48.45 KB	-rwxr-xr-x
cpudist-bpfcc	6.85 KB	-rwxr-xr-x
cpuunclaimed-bpfcc	14.59 KB	-rwxr-xr-x
cpuwalk.bt	497 B	-rwxr-xr-x
criticalstat-bpfcc	8.41 KB	-rwxr-xr-x
cron	58.67 KB	-rwxr-xr-x
cryptdisks_start	1.51 KB	-rwxr-xr-x
cryptdisks_stop	844 B	-rwxr-xr-x
cryptsetup	225.9 KB	-rwxr-xr-x
ctrlaltdel	14.38 KB	-rwxr-xr-x
dbslower-bpfcc	7.22 KB	-rwxr-xr-x
dbstat-bpfcc	3.7 KB	-rwxr-xr-x
dcb	80.52 KB	-rwxr-xr-x
dcsnoop-bpfcc	4.03 KB	-rwxr-xr-x
dcsnoop.bt	1.23 KB	-rwxr-xr-x
dcstat-bpfcc	3.77 KB	-rwxr-xr-x
deadlock-bpfcc	20.45 KB	-rwxr-xr-x
debugfs	225.87 KB	-rwxr-xr-x
delgroup	18.53 KB	-rwxr-xr-x
deluser	18.53 KB	-rwxr-xr-x
depmod	170.24 KB	-rwxr-xr-x
devlink	150.86 KB	-rwxr-xr-x
dhcpcd	395.4 KB	-rwxr-xr-x
dirtop-bpfcc	8.37 KB	-rwxr-xr-x
dmeventd	50.38 KB	-rwxr-xr-x
dmidecode	135.25 KB	-rwxr-xr-x
dmsetup	171.05 KB	-rwxr-xr-x
dmstats	171.05 KB	-rwxr-xr-x
dosfsck	78.38 KB	-rwxr-xr-x
dosfslabel	38.38 KB	-rwxr-xr-x
dpkg-preconfigure	4.25 KB	-rwxr-xr-x
dpkg-reconfigure	4.43 KB	-rwxr-xr-x
drsnoop-bpfcc	6.73 KB	-rwxr-xr-x
dumpe2fs	34.31 KB	-rwxr-xr-x
e2freefrag	18.3 KB	-rwxr-xr-x
e2fsck	364.34 KB	-rwxr-xr-x
e2image	42.31 KB	-rwxr-xr-x
e2label	110.56 KB	-rwxr-xr-x
e2mmpstatus	34.31 KB	-rwxr-xr-x
e2scrub	7.12 KB	-rwxr-xr-x
e2scrub_all	5.27 KB	-rwxr-xr-x
e2undo	22.3 KB	-rwxr-xr-x
e4crypt	30.38 KB	-rwxr-xr-x
e4defrag	34.3 KB	-rwxr-xr-x
ebtables	219.16 KB	-rwxr-xr-x
ebtables-nft	219.16 KB	-rwxr-xr-x
ebtables-nft-restore	219.16 KB	-rwxr-xr-x
ebtables-nft-save	219.16 KB	-rwxr-xr-x
ebtables-restore	219.16 KB	-rwxr-xr-x
ebtables-save	219.16 KB	-rwxr-xr-x
ebtables-translate	219.16 KB	-rwxr-xr-x
era_check	1.36 MB	-rwxr-xr-x
era_dump	1.36 MB	-rwxr-xr-x
era_invalidate	1.36 MB	-rwxr-xr-x
era_restore	1.36 MB	-rwxr-xr-x
ethtool	651.68 KB	-rwxr-xr-x
execsnoop-bpfcc	9.82 KB	-rwxr-xr-x
execsnoop.bt	928 B	-rwxr-xr-x
exitsnoop-bpfcc	9.42 KB	-rwxr-xr-x
ext4dist-bpfcc	6.53 KB	-rwxr-xr-x
ext4slower-bpfcc	9.71 KB	-rwxr-xr-x
faillock	22.31 KB	-rwxr-xr-x
fatlabel	38.38 KB	-rwxr-xr-x
fdisk	114.42 KB	-rwxr-xr-x
filefrag	18.32 KB	-rwxr-xr-x
filegone-bpfcc	5.64 KB	-rwxr-xr-x
filelife-bpfcc	6.38 KB	-rwxr-xr-x
fileslower-bpfcc	7.2 KB	-rwxr-xr-x
filetop-bpfcc	6.35 KB	-rwxr-xr-x
findfs	14.38 KB	-rwxr-xr-x
fixparts	58.48 KB	-rwxr-xr-x
fsadm	24 KB	-rwxr-xr-x
fsck	42.42 KB	-rwxr-xr-x
fsck.btrfs	1.16 KB	-rwxr-xr-x
fsck.cramfs	30.44 KB	-rwxr-xr-x
fsck.ext2	364.34 KB	-rwxr-xr-x
fsck.ext3	364.34 KB	-rwxr-xr-x
fsck.ext4	364.34 KB	-rwxr-xr-x
fsck.fat	78.38 KB	-rwxr-xr-x
fsck.minix	54.41 KB	-rwxr-xr-x
fsck.msdos	78.38 KB	-rwxr-xr-x
fsck.vfat	78.38 KB	-rwxr-xr-x
fsck.xfs	2.51 KB	-rwxr-xr-x
fsfreeze	14.38 KB	-rwxr-xr-x
fstab-decode	14.3 KB	-rwxr-xr-x
fstrim	42.38 KB	-rwxr-xr-x
funccount-bpfcc	12.68 KB	-rwxr-xr-x
funcinterval-bpfcc	5.46 KB	-rwxr-xr-x
funclatency-bpfcc	11.28 KB	-rwxr-xr-x
funcslower-bpfcc	10.38 KB	-rwxr-xr-x
gdisk	198.48 KB	-rwxr-xr-x
genl	120.58 KB	-rwxr-xr-x
getcap	14.3 KB	-rwxr-xr-x
gethostlatency-bpfcc	3.82 KB	-rwxr-xr-x
gethostlatency.bt	1.19 KB	-rwxr-xr-x
getpcaps	14.3 KB	-rwxr-xr-x
getty	59.56 KB	-rwxr-xr-x
groupadd	71.13 KB	-rwxr-xr-x
groupdel	62.91 KB	-rwxr-xr-x
groupmems	58.34 KB	-rwxr-xr-x
groupmod	71.04 KB	-rwxr-xr-x
grpck	58.32 KB	-rwxr-xr-x
grpconv	50.16 KB	-rwxr-xr-x
grpunconv	50.16 KB	-rwxr-xr-x
grub-bios-setup	958.55 KB	-rwxr-xr-x
grub-install	1.17 MB	-rwxr-xr-x
grub-macbless	946.41 KB	-rwxr-xr-x
grub-mkconfig	8.63 KB	-rwxr-xr-x
grub-mkdevicemap	70.69 KB	-rwxr-xr-x
grub-probe	954.66 KB	-rwxr-xr-x
grub-reboot	4.73 KB	-rwxr-xr-x
grub-set-default	3.47 KB	-rwxr-xr-x
halt	1.43 MB	-rwxr-xr-x
hardirqs-bpfcc	6.85 KB	-rwxr-xr-x
hdparm	139.43 KB	-rwxr-xr-x
httxt2dbm	14.3 KB	-rwxr-xr-x
iconvconfig	34.47 KB	-rwxr-xr-x
ifconfig	77.17 KB	-rwxr-xr-x
iftop	62.62 KB	-rwxr-xr-x
init	98.45 KB	-rwxr-xr-x
inject-bpfcc	16.06 KB	-rwxr-xr-x
insmod	170.24 KB	-rwxr-xr-x
install-sgmlcatalog	4.44 KB	-rwxr-xr-x
installkernel	2.6 KB	-rwxr-xr-x
integritysetup	67.06 KB	-rwxr-xr-x
invoke-rc.d	16.13 KB	-rwxr-xr-x
iotop	113.64 KB	-rwxr-xr-x
iotop-c	113.64 KB	-rwxr-xr-x
ip	754.8 KB	-rwxr-xr-x
ip6tables	219.16 KB	-rwxr-xr-x
ip6tables-apply	6.89 KB	-rwxr-xr-x
ip6tables-legacy	92.95 KB	-rwxr-xr-x
ip6tables-legacy-restore	92.95 KB	-rwxr-xr-x
ip6tables-legacy-save	92.95 KB	-rwxr-xr-x
ip6tables-nft	219.16 KB	-rwxr-xr-x
ip6tables-nft-restore	219.16 KB	-rwxr-xr-x
ip6tables-nft-save	219.16 KB	-rwxr-xr-x
ip6tables-restore	219.16 KB	-rwxr-xr-x
ip6tables-restore-translate	219.16 KB	-rwxr-xr-x
ip6tables-save	219.16 KB	-rwxr-xr-x
ip6tables-translate	219.16 KB	-rwxr-xr-x
ipmaddr	18.3 KB	-rwxr-xr-x
iptables	219.16 KB	-rwxr-xr-x
iptables-apply	6.89 KB	-rwxr-xr-x
iptables-legacy	92.95 KB	-rwxr-xr-x
iptables-legacy-restore	92.95 KB	-rwxr-xr-x
iptables-legacy-save	92.95 KB	-rwxr-xr-x
iptables-nft	219.16 KB	-rwxr-xr-x
iptables-nft-restore	219.16 KB	-rwxr-xr-x
iptables-nft-save	219.16 KB	-rwxr-xr-x
iptables-restore	219.16 KB	-rwxr-xr-x
iptables-restore-translate	219.16 KB	-rwxr-xr-x
iptables-save	219.16 KB	-rwxr-xr-x
iptables-translate	219.16 KB	-rwxr-xr-x
iptunnel	18.3 KB	-rwxr-xr-x
iscsi-iname	18.3 KB	-rwxr-xr-x
iscsi_discovery	5.17 KB	-rwxr-xr-x
iscsiadm	370.43 KB	-rwxr-xr-x
iscsid	286.55 KB	-rwxr-xr-x
iscsistart	274.49 KB	-rwxr-xr-x
isosize	14.38 KB	-rwxr-xr-x
javacalls-bpfcc	55 B	-rwxr-xr-x
javaflow-bpfcc	54 B	-rwxr-xr-x
javagc-bpfcc	52 B	-rwxr-xr-x
javaobjnew-bpfcc	56 B	-rwxr-xr-x
javastat-bpfcc	54 B	-rwxr-xr-x
javathreads-bpfcc	57 B	-rwxr-xr-x
kbdrate	18.31 KB	-rwxr-xr-x
killall5	26.23 KB	-rwxr-xr-x
killsnoop-bpfcc	4.45 KB	-rwxr-xr-x
killsnoop.bt	873 B	-rwxr-xr-x
klockstat-bpfcc	13.04 KB	-rwxr-xr-x
kpartx	42.16 KB	-rwxr-xr-x
kvmexit-bpfcc	11.19 KB	-rwxr-xr-x
ldattach	26.38 KB	-rwxr-xr-x
ldconfig	387 B	-rwxr-xr-x
ldconfig.real	1 MB	-rwxr-xr-x
llcstat-bpfcc	4.48 KB	-rwxr-xr-x
loads.bt	1.1 KB	-rwxr-xr-x
locale-gen	4.21 KB	-rwxr-xr-x
logrotate	94.24 KB	-rwxr-xr-x
logsave	14.16 KB	-rwxr-xr-x
losetup	74.52 KB	-rwxr-xr-x
lsmod	170.24 KB	-rwxr-xr-x
luksformat	3.32 KB	-rwxr-xr-x
lvchange	3.01 MB	-rwxr-xr-x
lvconvert	3.01 MB	-rwxr-xr-x
lvcreate	3.01 MB	-rwxr-xr-x
lvdisplay	3.01 MB	-rwxr-xr-x
lvextend	3.01 MB	-rwxr-xr-x
lvm	3.01 MB	-rwxr-xr-x
lvmconfig	3.01 MB	-rwxr-xr-x
lvmdiskscan	3.01 MB	-rwxr-xr-x
lvmdump	10.12 KB	-rwxr-xr-x
lvmpolld	235.97 KB	-rwxr-xr-x
lvmsadc	3.01 MB	-rwxr-xr-x
lvmsar	3.01 MB	-rwxr-xr-x
lvreduce	3.01 MB	-rwxr-xr-x
lvremove	3.01 MB	-rwxr-xr-x
lvrename	3.01 MB	-rwxr-xr-x
lvresize	3.01 MB	-rwxr-xr-x
lvs	3.01 MB	-rwxr-xr-x
lvscan	3.01 MB	-rwxr-xr-x
lxc	589 B	-rwxr-xr-x
lxd	589 B	-rwxr-xr-x
make-bcache	22.38 KB	-rwxr-xr-x
make-ssl-cert	6.65 KB	-rwxr-xr-x
mariadbd	26.09 MB	-rwxr-xr-x
mdadm	622.21 KB	-rwxr-xr-x
mdflush-bpfcc	2.24 KB	-rwxr-xr-x
mdflush.bt	775 B	-rwxr-xr-x
mdmon	258.8 KB	-rwxr-xr-x
memleak-bpfcc	20.8 KB	-rwxr-xr-x
mii-tool	26.73 KB	-rwxr-xr-x
mkdosfs	50.83 KB	-rwxr-xr-x
mke2fs	130.62 KB	-rwxr-xr-x
mkfs	14.38 KB	-rwxr-xr-x
mkfs.bfs	22.38 KB	-rwxr-xr-x
mkfs.btrfs	560.3 KB	-rwxr-xr-x
mkfs.cramfs	34.32 KB	-rwxr-xr-x
mkfs.ext2	130.62 KB	-rwxr-xr-x
mkfs.ext3	130.62 KB	-rwxr-xr-x
mkfs.ext4	130.62 KB	-rwxr-xr-x
mkfs.fat	50.83 KB	-rwxr-xr-x
mkfs.minix	42.39 KB	-rwxr-xr-x
mkfs.msdos	50.83 KB	-rwxr-xr-x
mkfs.ntfs	66.38 KB	-rwxr-xr-x
mkfs.vfat	50.83 KB	-rwxr-xr-x
mkfs.xfs	438.99 KB	-rwxr-xr-x
mkhomedir_helper	22.34 KB	-rwxr-xr-x
mkinitramfs	15.39 KB	-rwxr-xr-x
mklost+found	14.3 KB	-rwxr-xr-x
mkntfs	66.38 KB	-rwxr-xr-x
mkswap	50.38 KB	-rwxr-xr-x
modinfo	170.24 KB	-rwxr-xr-x
modprobe	170.24 KB	-rwxr-xr-x
mount.fuse	18.3 KB	-rwxr-xr-x
mount.fuse3	18.3 KB	-rwxr-xr-x
mount.lowntfs-3g	118.98 KB	-rwxr-xr-x
mount.ntfs	159.01 KB	-rwxr-xr-x
mount.ntfs-3g	159.01 KB	-rwxr-xr-x
mountsnoop-bpfcc	14.62 KB	-rwxr-xr-x
mpathpersist	31.21 KB	-rwxr-xr-x
multipath	34.3 KB	-rwxr-xr-x
multipathc	18.3 KB	-rwxr-xr-x
multipathd	142.46 KB	-rwxr-xr-x
mysqld	26.09 MB	-rwxr-xr-x
mysqld_qslower-bpfcc	3.05 KB	-rwxr-xr-x
nameif	14.39 KB	-rwxr-xr-x
naptime.bt	1.01 KB	-rwxr-xr-x
needrestart	40.13 KB	-rwxr-xr-x
netplan	802 B	-rwxr-xr-x
netqtop-bpfcc	5.59 KB	-rwxr-xr-x
newusers	86.96 KB	-rwxr-xr-x
nfnl_osf	18.3 KB	-rwxr-xr-x
nfsdist-bpfcc	4.95 KB	-rwxr-xr-x
nfsslower-bpfcc	13.61 KB	-rwxr-xr-x
nft	26.23 KB	-rwxr-xr-x
nginx	1.25 MB	-rwxr-xr-x
nodegc-bpfcc	52 B	-rwxr-xr-x
nodestat-bpfcc	54 B	-rwxr-xr-x
nologin	14.3 KB	-rwxr-xr-x
ntfsclone	50.38 KB	-rwxr-xr-x
ntfscp	30.38 KB	-rwxr-xr-x
ntfslabel	22.38 KB	-rwxr-xr-x
ntfsresize	62.39 KB	-rwxr-xr-x
ntfsundelete	50.38 KB	-rwxr-xr-x
offcputime-bpfcc	13.46 KB	-rwxr-xr-x
offwaketime-bpfcc	15.31 KB	-rwxr-xr-x
on_ac_power	3.7 KB	-rwxr-xr-x
oomkill-bpfcc	2.04 KB	-rwxr-xr-x
oomkill.bt	1.17 KB	-rwxr-xr-x
opensnoop-bpfcc	14.24 KB	-rwxr-xr-x
opensnoop.bt	953 B	-rwxr-xr-x
overlayroot-chroot	2.45 KB	-rwxr-xr-x
ownership	14.45 KB	-rwxr-xr-x
pam-auth-update	20.96 KB	-rwxr-xr-x
pam_extrausers_chkpwd	26.31 KB	-rwxr-sr-x
pam_extrausers_update	34.31 KB	-rwxr-xr-x
pam_getenv	2.82 KB	-rwxr-xr-x
pam_namespace_helper	467 B	-rwxr-xr-x
pam_timestamp_check	14.31 KB	-rwxr-xr-x
parted	94.4 KB	-rwxr-xr-x
partprobe	14.38 KB	-rwxr-xr-x
pdata_tools	1.36 MB	-rwxr-xr-x
perlcalls-bpfcc	55 B	-rwxr-xr-x
perlflow-bpfcc	54 B	-rwxr-xr-x
perlstat-bpfcc	54 B	-rwxr-xr-x
php-fpm8.3	5.49 MB	-rwxr-xr-x
phpcalls-bpfcc	54 B	-rwxr-xr-x
phpdismod	7.11 KB	-rwxr-xr-x
phpenmod	7.11 KB	-rwxr-xr-x
phpflow-bpfcc	53 B	-rwxr-xr-x
phpquery	6.24 KB	-rwxr-xr-x
phpstat-bpfcc	53 B	-rwxr-xr-x
pidpersec-bpfcc	1.08 KB	-rwxr-xr-x
pidpersec.bt	628 B	-rwxr-xr-x
pivot_root	14.38 KB	-rwxr-xr-x
plipconfig	14.3 KB	-rwxr-xr-x
plymouthd	146.57 KB	-rwxr-xr-x
poweroff	1.43 MB	-rwxr-xr-x
ppchcalls-bpfcc	13.89 KB	-rwxr-xr-x
profile-bpfcc	14.41 KB	-rwxr-xr-x
pvchange	3.01 MB	-rwxr-xr-x
pvck	3.01 MB	-rwxr-xr-x
pvcreate	3.01 MB	-rwxr-xr-x
pvdisplay	3.01 MB	-rwxr-xr-x
pvmove	3.01 MB	-rwxr-xr-x
pvremove	3.01 MB	-rwxr-xr-x
pvresize	3.01 MB	-rwxr-xr-x
pvs	3.01 MB	-rwxr-xr-x
pvscan	3.01 MB	-rwxr-xr-x
pwck	54.29 KB	-rwxr-xr-x
pwconv	46.16 KB	-rwxr-xr-x
pwhistory_helper	22.31 KB	-rwxr-xr-x
pwunconv	46.16 KB	-rwxr-xr-x
pythoncalls-bpfcc	57 B	-rwxr-xr-x
pythonflow-bpfcc	56 B	-rwxr-xr-x
pythongc-bpfcc	54 B	-rwxr-xr-x
pythonstat-bpfcc	56 B	-rwxr-xr-x
rarp	32.33 KB	-rwxr-xr-x
rdmaucma-bpfcc	4.95 KB	-rwxr-xr-x
readahead-bpfcc	6.54 KB	-rwxr-xr-x
readprofile	22.41 KB	-rwxr-xr-x
reboot	1.43 MB	-rwxr-xr-x
remove-shell	1.08 KB	-rwxr-xr-x
reset-trace-bpfcc	3.42 KB	-rwxr-xr-x
resize2fs	70.3 KB	-rwxr-xr-x
resolvconf	158.67 KB	-rwxr-xr-x
rmmod	170.24 KB	-rwxr-xr-x
rmt	54.71 KB	-rwxr-xr-x
rmt-tar	54.71 KB	-rwxr-xr-x
route	68.27 KB	-rwxr-xr-x
rsyslogd	771.67 KB	-rwxr-xr-x
rtacct	28.31 KB	-rwxr-xr-x
rtcwake	34.38 KB	-rwxr-xr-x
rtmon	116.52 KB	-rwxr-xr-x
rubycalls-bpfcc	55 B	-rwxr-xr-x
rubyflow-bpfcc	54 B	-rwxr-xr-x
rubygc-bpfcc	52 B	-rwxr-xr-x
rubyobjnew-bpfcc	56 B	-rwxr-xr-x
rubystat-bpfcc	54 B	-rwxr-xr-x
runlevel	1.43 MB	-rwxr-xr-x
runqlat-bpfcc	9.3 KB	-rwxr-xr-x
runqlat.bt	788 B	-rwxr-xr-x
runqlen-bpfcc	8.05 KB	-rwxr-xr-x
runqlen.bt	1.01 KB	-rwxr-xr-x
runqslower-bpfcc	9.01 KB	-rwxr-xr-x
runuser	54.38 KB	-rwxr-xr-x
service	8.89 KB	-rwxr-xr-x
setcap	14.3 KB	-rwxr-xr-x
setuids.bt	1.76 KB	-rwxr-xr-x
setvesablank	14.37 KB	-rwxr-xr-x
setvtrgb	14.43 KB	-rwxr-xr-x
sfdisk	106.38 KB	-rwxr-xr-x
sgdisk	178.48 KB	-rwxr-xr-x
shadowconfig	2.22 KB	-rwxr-xr-x
shmsnoop-bpfcc	7.8 KB	-rwxr-xr-x
shutdown	1.43 MB	-rwxr-xr-x
slabratetop-bpfcc	6.38 KB	-rwxr-xr-x
slattach	36.08 KB	-rwxr-xr-x
sofdsnoop-bpfcc	8.06 KB	-rwxr-xr-x
softirqs-bpfcc	5.59 KB	-rwxr-xr-x
solisten-bpfcc	5.96 KB	-rwxr-xr-x
split-logfile	2.36 KB	-rwxr-xr-x
sshd	899.82 KB	-rwxr-xr-x
ssllatency.bt	2.08 KB	-rwxr-xr-x
sslsniff-bpfcc	13.68 KB	-rwxr-xr-x
sslsnoop.bt	1.99 KB	-rwxr-xr-x
stackcount-bpfcc	16.26 KB	-rwxr-xr-x
start-stop-daemon	47.49 KB	-rwxr-xr-x
statsnoop-bpfcc	4.92 KB	-rwxr-xr-x
statsnoop.bt	1.26 KB	-rwxr-xr-x
sudo_logsrvd	248.5 KB	-rwxr-xr-x
sudo_sendlog	131.67 KB	-rwxr-xr-x
sulogin	42.38 KB	-rwxr-xr-x
swapin.bt	600 B	-rwxr-xr-x
swaplabel	18.38 KB	-rwxr-xr-x
swapoff	22.38 KB	-rwxr-xr-x
swapon	42.38 KB	-rwxr-xr-x
switch_root	22.38 KB	-rwxr-xr-x
syncsnoop-bpfcc	1.27 KB	-rwxr-xr-x
syncsnoop.bt	839 B	-rwxr-xr-x
syscount-bpfcc	8.57 KB	-rwxr-xr-x
syscount.bt	872 B	-rwxr-xr-x
sysctl	30.38 KB	-rwxr-xr-x
tarcat	936 B	-rwxr-xr-x
tc	630.08 KB	-rwxr-xr-x
tclcalls-bpfcc	54 B	-rwxr-xr-x
tclflow-bpfcc	53 B	-rwxr-xr-x
tclobjnew-bpfcc	55 B	-rwxr-xr-x
tclstat-bpfcc	53 B	-rwxr-xr-x
tcpaccept-bpfcc	9 KB	-rwxr-xr-x
tcpaccept.bt	1.71 KB	-rwxr-xr-x
tcpcong-bpfcc	20.11 KB	-rwxr-xr-x
tcpconnect-bpfcc	18.46 KB	-rwxr-xr-x
tcpconnect.bt	1.58 KB	-rwxr-xr-x
tcpconnlat-bpfcc	9.07 KB	-rwxr-xr-x
tcpdrop-bpfcc	7.44 KB	-rwxr-xr-x
tcpdrop.bt	2.41 KB	-rwxr-xr-x
tcplife-bpfcc	16.55 KB	-rwxr-xr-x
tcplife.bt	2.72 KB	-rwxr-xr-x
tcpretrans-bpfcc	13.77 KB	-rwxr-xr-x
tcpretrans.bt	2.07 KB	-rwxr-xr-x
tcprtt-bpfcc	8.7 KB	-rwxr-xr-x
tcpstates-bpfcc	13.73 KB	-rwxr-xr-x
tcpsubnet-bpfcc	7.63 KB	-rwxr-xr-x
tcpsynbl-bpfcc	2.12 KB	-rwxr-xr-x

Code Editor : argdist-bpfcc

#! /usr/bin/python3
#
# argdist   Trace a function and display a distribution of its
#           parameter values as a histogram or frequency count.
#
# USAGE: argdist [-h] [-p PID] [-z STRING_SIZE] [-i INTERVAL] [-n COUNT] [-v]
#                [-c] [-T TOP] [-C specifier] [-H specifier] [-I header]
#                [-t TID]
#
# Licensed under the Apache License, Version 2.0 (the "License")
# Copyright (C) 2016 Sasha Goldshtein.

from bcc import BPF, USDT, StrcmpRewrite
from time import sleep, strftime
import argparse
import re
import traceback
import os
import sys

class Probe(object):
        next_probe_index = 0
        streq_index = 0
        aliases = {"$PID": "(bpf_get_current_pid_tgid() >> 32)", "$COMM": "&val.name"}

def _substitute_aliases(self, expr):
                if expr is None:
                        return expr
                for alias, subst in Probe.aliases.items():
                        expr = expr.replace(alias, subst)
                return expr

def _parse_signature(self):
                params = map(str.strip, self.signature.split(','))
                self.param_types = {}
                for param in params:
                        # If the type is a pointer, the * can be next to the
                        # param name. Other complex types like arrays are not
                        # supported right now.
                        index = param.rfind('*')
                        index = index if index != -1 else param.rfind(' ')
                        param_type = param[0:index + 1].strip()
                        param_name = param[index + 1:].strip()
                        self.param_types[param_name] = param_type
                        # Maintain list of user params. Then later decide to
                        # switch to bpf_probe_read_kernel or bpf_probe_read_user.
                        if "__user" in param_type.split():
                                self.probe_user_list.add(param_name)

def _generate_entry(self):
                self.entry_probe_func = self.probe_func_name + "_entry"
                text = """
int PROBENAME(struct pt_regs *ctx SIGNATURE)
{
        u64 __pid_tgid = bpf_get_current_pid_tgid();
        u32 __pid      = __pid_tgid;        // lower 32 bits
        u32 __tgid     = __pid_tgid >> 32;  // upper 32 bits
        PID_FILTER
        TID_FILTER
        COLLECT
        return 0;
}
"""
                text = text.replace("PROBENAME", self.entry_probe_func)
                text = text.replace("SIGNATURE",
                     "" if len(self.signature) == 0 else ", " + self.signature)
                text = text.replace("PID_FILTER", self._generate_pid_filter())
                text = text.replace("TID_FILTER", self._generate_tid_filter())
                collect = ""
                for pname in self.args_to_probe:
                        param_hash = self.hashname_prefix + pname
                        if pname == "__latency":
                                collect += """
u64 __time = bpf_ktime_get_ns();
%s.update(&__pid, &__time);
                        """ % param_hash
                        else:
                                collect += "%s.update(&__pid, &%s);\n" % \
                                           (param_hash, pname)
                text = text.replace("COLLECT", collect)
                return text

def _generate_entry_probe(self):
                # Any $entry(name) expressions result in saving that argument
                # when entering the function.
                self.args_to_probe = set()
                regex = r"\$entry$(\w+)$"
                for expr in self.exprs:
                        for arg in re.finditer(regex, expr):
                                self.args_to_probe.add(arg.group(1))
                for arg in re.finditer(regex, self.filter):
                        self.args_to_probe.add(arg.group(1))
                if any(map(lambda expr: "$latency" in expr, self.exprs)) or \
                   "$latency" in self.filter:
                        self.args_to_probe.add("__latency")
                        self.param_types["__latency"] = "u64"    # nanoseconds
                for pname in self.args_to_probe:
                        if pname not in self.param_types:
                                raise ValueError("$entry(%s): no such param" %
                                                 arg)

self.hashname_prefix = "%s_param_" % self.probe_hash_name
                text = ""
                for pname in self.args_to_probe:
                        # Each argument is stored in a separate hash that is
                        # keyed by pid.
                        text += "BPF_HASH(%s, u32, %s);\n" % \
                             (self.hashname_prefix + pname,
                              self.param_types[pname])
                text += self._generate_entry()
                return text

def _generate_retprobe_prefix(self):
                # After we're done here, there are __%s_val variables for each
                # argument we needed to probe using $entry(name), and they all
                # have values (which isn't necessarily the case if we missed
                # the method entry probe).
                text = ""
                self.param_val_names = {}
                for pname in self.args_to_probe:
                        val_name = "__%s_val" % pname
                        text += "%s *%s = %s.lookup(&__pid);\n" % \
                                (self.param_types[pname], val_name,
                                 self.hashname_prefix + pname)
                        text += "if (%s == 0) { return 0 ; }\n" % val_name
                        self.param_val_names[pname] = val_name
                return text
        
        def _generate_comm_prefix(self):
                text = """
struct val_t {
        u32 pid;
        char name[sizeof(struct __string_t)];
};
struct val_t val = {.pid = (bpf_get_current_pid_tgid() >> 32) };
bpf_get_current_comm(&val.name, sizeof(val.name));
        """
                return text

def _replace_entry_exprs(self):
                for pname, vname in self.param_val_names.items():
                        if pname == "__latency":
                                entry_expr = "$latency"
                                val_expr = "(bpf_ktime_get_ns() - *%s)" % vname
                        else:
                                entry_expr = "$entry(%s)" % pname
                                val_expr = "(*%s)" % vname
                        for i in range(0, len(self.exprs)):
                                self.exprs[i] = self.exprs[i].replace(
                                                entry_expr, val_expr)
                        self.filter = self.filter.replace(entry_expr,
                                                          val_expr)

def _attach_entry_probe(self):
                if self.is_user:
                        self.bpf.attach_uprobe(name=self.library,
                                               sym=self.function,
                                               fn_name=self.entry_probe_func,
                                               pid=self.pid or -1)
                else:
                        self.bpf.attach_kprobe(event=self.function,
                                               fn_name=self.entry_probe_func)

def _bail(self, error):
                raise ValueError("error parsing probe '%s': %s" %
                                 (self.raw_spec, error))

def _validate_specifier(self):
                # Everything after '#' is the probe label, ignore it
                spec = self.raw_spec.split('#')[0]
                parts = spec.strip().split(':')
                if len(parts) < 3:
                        self._bail("at least the probe type, library, and " +
                                   "function signature must be specified")
                if len(parts) > 6:
                        self._bail("extraneous ':'-separated parts detected")
                if parts[0] not in ["r", "p", "t", "u"]:
                        self._bail("probe type must be 'p', 'r', 't', or 'u'" +
                                   " but got '%s'" % parts[0])
                if re.match(r"\S+$.*$", parts[2]) is None:
                        self._bail(("function signature '%s' has an invalid " +
                                    "format") % parts[2])

def _parse_expr_types(self, expr_types):
                if len(expr_types) == 0:
                        self._bail("no expr types specified")
                self.expr_types = expr_types.split(',')

def _parse_exprs(self, exprs):
                if len(exprs) == 0:
                        self._bail("no exprs specified")
                self.exprs = exprs.split(',')

def _make_valid_identifier(self, ident):
                return re.sub(r'[^A-Za-z0-9_]', '_', ident)

def __init__(self, tool, type, specifier):
                self.usdt_ctx = None
                self.streq_functions = ""
                self.pid = tool.args.pid
                self.tid = tool.args.tid
                self.cumulative = tool.args.cumulative or False
                self.raw_spec = specifier
                self.probe_user_list = set()
                self.bin_cmp = False
                self._validate_specifier()

spec_and_label = specifier.split('#')
                self.label = spec_and_label[1] \
                             if len(spec_and_label) == 2 else None

parts = spec_and_label[0].strip().split(':')
                self.type = type    # hist or freq
                self.probe_type = parts[0]
                fparts = parts[2].split('(')
                self.function = fparts[0].strip()
                if self.probe_type == "t":
                        self.library = ""       # kernel
                        self.tp_category = parts[1]
                        self.tp_event = self.function
                elif self.probe_type == "u":
                        self.library = parts[1]
                        self.probe_func_name = self._make_valid_identifier(
                                "%s_probe%d" %
                                (self.function, Probe.next_probe_index))
                        self._enable_usdt_probe()
                else:
                        self.library = parts[1]
                self.is_user = len(self.library) > 0
                self.signature = fparts[1].strip()[:-1]
                self._parse_signature()

# If the user didn't specify an expression to probe, we probe
                # the retval in a ret probe, or simply the value "1" otherwise.
                self.is_default_expr = len(parts) < 5
                if not self.is_default_expr:
                        self._parse_expr_types(parts[3])
                        self._parse_exprs(parts[4])
                        if len(self.exprs) != len(self.expr_types):
                                self._bail("mismatched # of exprs and types")
                        if self.type == "hist" and len(self.expr_types) > 1:
                                self._bail("histograms can only have 1 expr")
                else:
                        if not self.probe_type == "r" and self.type == "hist":
                                self._bail("histograms must have expr")
                        self.expr_types = \
                          ["u64" if not self.probe_type == "r" else "int"]
                        self.exprs = \
                          ["1" if not self.probe_type == "r" else "$retval"]
                self.filter = "" if len(parts) != 6 else parts[5]
                self._substitute_exprs()

# Do we need to attach an entry probe so that we can collect an
                # argument that is required for an exit (return) probe?
                def check(expr):
                        keywords = ["$entry", "$latency"]
                        return any(map(lambda kw: kw in expr, keywords))
                self.entry_probe_required = self.probe_type == "r" and \
                        (any(map(check, self.exprs)) or check(self.filter))

self.probe_func_name = self._make_valid_identifier(
                        "%s_probe%d" %
                        (self.function, Probe.next_probe_index))
                self.probe_hash_name = self._make_valid_identifier(
                        "%s_hash%d" %
                        (self.function, Probe.next_probe_index))
                Probe.next_probe_index += 1

def _enable_usdt_probe(self):
                self.usdt_ctx = USDT(path=self.library, pid=self.pid)
                self.usdt_ctx.enable_probe(
                        self.function, self.probe_func_name)

def _substitute_exprs(self):
                def repl(expr):
                        expr = self._substitute_aliases(expr)
                        rdict = StrcmpRewrite.rewrite_expr(expr,
                                self.bin_cmp, self.library,
                                self.probe_user_list, self.streq_functions,
                                Probe.streq_index)
                        expr = rdict["expr"]
                        self.streq_functions = rdict["streq_functions"]
                        Probe.streq_index = rdict["probeid"]
                        return expr.replace("$retval", "PT_REGS_RC(ctx)")
                for i in range(0, len(self.exprs)):
                        self.exprs[i] = repl(self.exprs[i])
                self.filter = repl(self.filter)

def _is_string(self, expr_type):
                return expr_type == "char*" or expr_type == "char *"

def _generate_hash_field(self, i):
                if self._is_string(self.expr_types[i]):
                        return "struct __string_t v%d;\n" % i
                else:
                        return "%s v%d;\n" % (self.expr_types[i], i)

def _generate_usdt_arg_assignment(self, i):
                expr = self.exprs[i]
                if self.probe_type == "u" and expr[0:3] == "arg":
                        arg_index = int(expr[3])
                        arg_ctype = self.usdt_ctx.get_probe_arg_ctype(
                                self.function, arg_index - 1)
                        return ("        %s %s = 0;\n" +
                                "        bpf_usdt_readarg(%s, ctx, &%s);\n") \
                                % (arg_ctype, expr, expr[3], expr)
                else:
                        return ""

def _generate_field_assignment(self, i):
                text = self._generate_usdt_arg_assignment(i)
                if self._is_string(self.expr_types[i]):
                        if self.is_user or \
                            self.exprs[i] in self.probe_user_list:
                                probe_readfunc = "bpf_probe_read_user"
                        else:
                                probe_readfunc = "bpf_probe_read_kernel"
                        return (text + "        %s(&__key.v%d.s," +
                                " sizeof(__key.v%d.s), (void *)%s);\n") % \
                                (probe_readfunc, i, i, self.exprs[i])
                else:
                        return text + "        __key.v%d = %s;\n" % \
                               (i, self.exprs[i])

def _generate_hash_decl(self):
                if self.type == "hist":
                        return "BPF_HISTOGRAM(%s, %s);" % \
                               (self.probe_hash_name, self.expr_types[0])
                else:
                        text = "struct %s_key_t {\n" % self.probe_hash_name
                        for i in range(0, len(self.expr_types)):
                                text += self._generate_hash_field(i)
                        text += "};\n"
                        text += "BPF_HASH(%s, struct %s_key_t, u64);\n" % \
                                (self.probe_hash_name, self.probe_hash_name)
                        return text

def _generate_key_assignment(self):
                if self.type == "hist":
                        return self._generate_usdt_arg_assignment(0) + \
                               ("%s __key = %s;\n" %
                                (self.expr_types[0], self.exprs[0]))
                else:
                        text = "struct %s_key_t __key = {};\n" % \
                                self.probe_hash_name
                        for i in range(0, len(self.exprs)):
                                text += self._generate_field_assignment(i)
                        return text

def _generate_hash_update(self):
                if self.type == "hist":
                        return "%s.atomic_increment(bpf_log2l(__key));" % \
                                self.probe_hash_name
                else:
                        return "%s.atomic_increment(__key);" % \
                                self.probe_hash_name

def _generate_pid_filter(self):
                # Kernel probes need to explicitly filter pid, because the
                # attach interface doesn't support pid filtering
                if self.pid is not None and not self.is_user:
                        return "if (__tgid != %d) { return 0; }" % self.pid
                else:
                        return ""

def _generate_tid_filter(self):
                if self.tid is not None and not self.is_user:
                        return "if (__pid != %d) { return 0; }" % self.tid
                else:
                        return ""

def generate_text(self):
                program = ""
                probe_text = """
DATA_DECL
                """ + (
                    "TRACEPOINT_PROBE(%s, %s)" %
                    (self.tp_category, self.tp_event)
                    if self.probe_type == "t"
                    else "int PROBENAME(struct pt_regs *ctx SIGNATURE)") + """
{
        u64 __pid_tgid = bpf_get_current_pid_tgid();
        u32 __pid      = __pid_tgid;        // lower 32 bits
        u32 __tgid     = __pid_tgid >> 32;  // upper 32 bits
        PID_FILTER
        TID_FILTER
        PREFIX
        KEY_EXPR
        if (!(FILTER)) return 0;
        COLLECT
        return 0;
}
"""
                prefix = ""
                signature = ""

# If any entry arguments are probed in a ret probe, we need
                # to generate an entry probe to collect them
                if self.entry_probe_required:
                        program += self._generate_entry_probe()
                        prefix += self._generate_retprobe_prefix()
                        # Replace $entry(paramname) with a reference to the
                        # value we collected when entering the function:
                        self._replace_entry_exprs()

if self.probe_type == "p" and len(self.signature) > 0:
                        # Only entry uprobes/kprobes can have user-specified
                        # signatures. Other probes force it to ().
                        signature = ", " + self.signature

# If COMM is specified prefix with code to get process name
                if self.exprs.count(self.aliases['$COMM']):
                        prefix += self._generate_comm_prefix()

program += probe_text.replace("PROBENAME",
                                              self.probe_func_name)
                program = program.replace("SIGNATURE", signature)
                program = program.replace("PID_FILTER",
                                          self._generate_pid_filter())
                program = program.replace("TID_FILTER",
                                          self._generate_tid_filter())

decl = self._generate_hash_decl()
                key_expr = self._generate_key_assignment()
                collect = self._generate_hash_update()
                program = program.replace("DATA_DECL", decl)
                program = program.replace("KEY_EXPR", key_expr)
                program = program.replace("FILTER",
                        "1" if len(self.filter) == 0 else self.filter)
                program = program.replace("COLLECT", collect)
                program = program.replace("PREFIX", prefix)

return self.streq_functions + program

def _attach_u(self):
                libpath = BPF.find_library(self.library)
                if libpath is None:
                        libpath = BPF.find_exe(self.library)
                if libpath is None or len(libpath) == 0:
                        self._bail("unable to find library %s" % self.library)

if self.probe_type == "r":
                        self.bpf.attach_uretprobe(name=libpath,
                                                  sym=self.function,
                                                  fn_name=self.probe_func_name,
                                                  pid=self.pid or -1)
                else:
                        self.bpf.attach_uprobe(name=libpath,
                                               sym=self.function,
                                               fn_name=self.probe_func_name,
                                               pid=self.pid or -1)

def _attach_k(self):
                if self.probe_type == "t":
                        pass    # Nothing to do for tracepoints
                elif self.probe_type == "r":
                        self.bpf.attach_kretprobe(event=self.function,
                                             fn_name=self.probe_func_name)
                else:
                        self.bpf.attach_kprobe(event=self.function,
                                          fn_name=self.probe_func_name)

def attach(self, bpf):
                self.bpf = bpf
                if self.probe_type == "u":
                        return
                if self.is_user:
                        self._attach_u()
                else:
                        self._attach_k()
                if self.entry_probe_required:
                        self._attach_entry_probe()
                # Check whether hash table batch ops is supported
                if self.type == "freq" and self.bpf.kernel_struct_has_field(
                        b'bpf_map_ops', b'map_lookup_and_delete_batch') == 1:
                    self.htab_batch_ops = True
                else:
                    self.htab_batch_ops = False

def _v2s(self, v):
                # Most fields can be converted with plain str(), but strings
                # are wrapped in a __string_t which has an .s field
                if "__string_t" in type(v).__name__:
                        return str(v.s)
                return str(v)

def _display_expr(self, i):
                # Replace ugly latency calculation with $latency
                expr = self.exprs[i].replace(
                        "(bpf_ktime_get_ns() - *____latency_val)", "$latency")
                # Replace alias values back with the alias name
                for alias, subst in Probe.aliases.items():
                        expr = expr.replace(subst, alias)
                # Replace retval expression with $retval
                expr = expr.replace("PT_REGS_RC(ctx)", "$retval")
                # Replace ugly (*__param_val) expressions with param name
                return re.sub(r"$\*__(\w+)_val$", r"\1", expr)

def _display_key(self, key):
                if self.is_default_expr:
                        if not self.probe_type == "r":
                                return "total calls"
                        else:
                                return "retval = %s" % str(key.v0)
                else:
                        # The key object has v0, ..., vk fields containing
                        # the values of the expressions from self.exprs
                        def str_i(i):
                                key_i = self._v2s(getattr(key, "v%d" % i))
                                return "%s = %s" % \
                                        (self._display_expr(i), key_i)
                        return ", ".join(map(str_i, range(0, len(self.exprs))))

def display(self, top):
                data = self.bpf.get_table(self.probe_hash_name)
                if self.type == "freq":
                        print(self.label or self.raw_spec)
                        print("\t%-10s %s" % ("COUNT", "EVENT"))
                        sdata = sorted(data.items_lookup_batch()
                                if self.htab_batch_ops else data.items(),
                                key=lambda p: p[1].value)
                        if top is not None:
                                sdata = sdata[-top:]
                        for key, value in sdata:
                                # Print some nice values if the user didn't
                                # specify an expression to probe
                                if self.is_default_expr:
                                        if not self.probe_type == "r":
                                                key_str = "total calls"
                                        else:
                                                key_str = "retval = %s" % \
                                                          self._v2s(key.v0)
                                else:
                                        key_str = self._display_key(key)
                                print("\t%-10s %s" %
                                      (str(value.value), key_str))
                elif self.type == "hist":
                        label = self.label or (self._display_expr(0)
                                if not self.is_default_expr else "retval")
                        data.print_log2_hist(val_type=label)
                if not self.cumulative:
                    if self.htab_batch_ops:
                        data.items_delete_batch()
                    else:
                        data.clear()

def __str__(self):
                return self.label or self.raw_spec

class Tool(object):
        examples = """
Probe specifier syntax:
        {p,r,t,u}:{[library],category}:function(signature):type[,type...]:expr[,expr...][:filter]][#label]
Where:
        p,r,t,u    -- probe at function entry, function exit, kernel
                      tracepoint, or USDT probe
                      in exit probes: can use $retval, $entry(param), $latency
        library    -- the library that contains the function
                      (leave empty for kernel functions)
        category   -- the category of the kernel tracepoint (e.g. net, sched)
        function   -- the function name to trace (or tracepoint name)
        signature  -- the function's parameters, as in the C header
        type       -- the type of the expression to collect (supports multiple)
        expr       -- the expression to collect (supports multiple)
        filter     -- the filter that is applied to collected values
        label      -- the label for this probe in the resulting output

EXAMPLES:

argdist -H 'p::__kmalloc(u64 size):u64:size'
        Print a histogram of allocation sizes passed to kmalloc

argdist -p 1005 -C 'p:c:malloc(size_t size):size_t:size:size==16'
        Print a frequency count of how many times process 1005 called malloc
        with an allocation size of 16 bytes

argdist -C 'r:c:gets():char*:(char*)$retval#snooped strings'
        Snoop on all strings returned by gets()

argdist -H 'r::__kmalloc(size_t size):u64:$latency/$entry(size)#ns per byte'
        Print a histogram of nanoseconds per byte from kmalloc allocations

argdist -C 'p::__kmalloc(size_t sz, gfp_t flags):size_t:sz:flags&GFP_ATOMIC'
        Print frequency count of kmalloc allocation sizes that have GFP_ATOMIC

argdist -p 1005 -C 'p:c:write(int fd):int:fd' -T 5
        Print frequency counts of how many times writes were issued to a
        particular file descriptor number, in process 1005, but only show
        the top 5 busiest fds

argdist -p 1005 -H 'r:c:read()'
        Print a histogram of results (sizes) returned by read() in process 1005

argdist -C 'r::__vfs_read():u32:$PID:$latency > 100000'
        Print frequency of reads by process where the latency was >0.1ms

argdist -C 'r::__vfs_read():u32:$COMM:$latency > 100000'
        Print frequency of reads by process name where the latency was >0.1ms

argdist -H 'r::__vfs_read(void *file, void *buf, size_t count):size_t:
            $entry(count):$latency > 1000000'
        Print a histogram of read sizes that were longer than 1ms

argdist -H \\
        'p:c:write(int fd, const void *buf, size_t count):size_t:count:fd==1'
        Print a histogram of buffer sizes passed to write() across all
        processes, where the file descriptor was 1 (STDOUT)

argdist -C 'p:c:fork()#fork calls'
        Count fork() calls in libc across all processes
        Can also use funccount.py, which is easier and more flexible

argdist -H 't:block:block_rq_complete():u32:args->nr_sector'
        Print histogram of number of sectors in completing block I/O requests

argdist -C 't:irq:irq_handler_entry():int:args->irq'
        Aggregate interrupts by interrupt request (IRQ)

argdist -C 'u:pthread:pthread_start():u64:arg2' -p 1337
        Print frequency of function addresses used as a pthread start function,
        relying on the USDT pthread_start probe in process 1337

argdist -H 'p:c:sleep(u32 seconds):u32:seconds' \\
        -H 'p:c:nanosleep(struct timespec *req):long:req->tv_nsec'
        Print histograms of sleep() and nanosleep() parameter values

argdist -p 2780 -z 120 \\
        -C 'p:c:write(int fd, char* buf, size_t len):char*:buf:fd==1'
        Spy on writes to STDOUT performed by process 2780, up to a string size
        of 120 characters

argdist -I 'kernel/sched/sched.h' \\
        -C 'p::__account_cfs_rq_runtime(struct cfs_rq *cfs_rq):s64:cfs_rq->runtime_remaining'
        Trace on the cfs scheduling runqueue remaining runtime. The struct cfs_rq is defined
        in kernel/sched/sched.h which is in kernel source tree and not in kernel-devel
        package.  So this command needs to run at the kernel source tree root directory
        so that the added header file can be found by the compiler.
"""

def __init__(self):
                parser = argparse.ArgumentParser(description="Trace a " +
                  "function and display a summary of its parameter values.",
                  formatter_class=argparse.RawDescriptionHelpFormatter,
                  epilog=Tool.examples)
                parser.add_argument("-p", "--pid", type=int,
                  help="id of the process to trace (optional)")
                parser.add_argument("-t", "--tid", type=int,
                  help="id of the thread to trace (optional)")
                parser.add_argument("-z", "--string-size", default=80,
                  type=int,
                  help="maximum string size to read from char* arguments")
                parser.add_argument("-i", "--interval", default=1, type=int,
                  help="output interval, in seconds (default 1 second)")
                parser.add_argument("-d", "--duration", type=int,
                  help="total duration of trace, in seconds")
                parser.add_argument("-n", "--number", type=int, dest="count",
                  help="number of outputs")
                parser.add_argument("-v", "--verbose", action="store_true",
                  help="print resulting BPF program code before executing")
                parser.add_argument("-c", "--cumulative", action="store_true",
                  help="do not clear histograms and freq counts at " +
                       "each interval")
                parser.add_argument("-T", "--top", type=int,
                  help="number of top results to show (not applicable to " +
                  "histograms)")
                parser.add_argument("-H", "--histogram", action="append",
                  dest="histspecifier", metavar="specifier",
                  help="probe specifier to capture histogram of " +
                  "(see examples below)")
                parser.add_argument("-C", "--count", action="append",
                  dest="countspecifier", metavar="specifier",
                  help="probe specifier to capture count of " +
                  "(see examples below)")
                parser.add_argument("-I", "--include", action="append",
                  metavar="header",
                  help="additional header files to include in the BPF program "
                       "as either full path, "
                       "or relative to relative to current working directory, "
                       "or relative to default kernel header search path")
                parser.add_argument("--ebpf", action="store_true",
                  help=argparse.SUPPRESS)
                self.args = parser.parse_args()
                self.usdt_ctx = None

def _create_probes(self):
                self.probes = []
                for specifier in (self.args.countspecifier or []):
                        self.probes.append(Probe(self, "freq", specifier))
                for histspecifier in (self.args.histspecifier or []):
                        self.probes.append(Probe(self, "hist", histspecifier))
                if len(self.probes) == 0:
                        print("at least one specifier is required")
                        exit(1)

def _generate_program(self):
                bpf_source = """
struct __string_t { char s[%d]; };

#include <uapi/linux/ptrace.h>
                """ % self.args.string_size
                for include in (self.args.include or []):
                        if include.startswith((".", "/")):
                                include = os.path.abspath(include)
                                bpf_source += "#include \"%s\"\n" % include
                        else:
                                bpf_source += "#include <%s>\n" % include

bpf_source += BPF.generate_auto_includes(
                                map(lambda p: p.raw_spec, self.probes))
                for probe in self.probes:
                        bpf_source += probe.generate_text()
                if self.args.verbose:
                        for text in [probe.usdt_ctx.get_text()
                                     for probe in self.probes
                                     if probe.usdt_ctx]:
                            print(text)
                if self.args.verbose or self.args.ebpf:
                    print(bpf_source)
                    if self.args.ebpf:
                        exit()
                usdt_contexts = [probe.usdt_ctx
                                 for probe in self.probes if probe.usdt_ctx]
                self.bpf = BPF(text=bpf_source, usdt_contexts=usdt_contexts)

def _attach(self):
                for probe in self.probes:
                        probe.attach(self.bpf)
                if self.args.verbose:
                        print("open uprobes: %s" % list(self.bpf.uprobe_fds.keys()))
                        print("open kprobes: %s" % list(self.bpf.kprobe_fds.keys()))

def _main_loop(self):
                count_so_far = 0
                seconds = 0
                while True:
                        try:
                                sleep(self.args.interval)
                                seconds += self.args.interval
                        except KeyboardInterrupt:
                                exit()
                        print("[%s]" % strftime("%H:%M:%S"))
                        for probe in self.probes:
                                probe.display(self.args.top)
                        count_so_far += 1
                        if self.args.count is not None and \
                           count_so_far >= self.args.count:
                                exit()
                        if self.args.duration and \
                           seconds >= self.args.duration:
                                exit()

def run(self):
                try:
                        self._create_probes()
                        self._generate_program()
                        self._attach()
                        self._main_loop()
                except:
                        exc_info = sys.exc_info()
                        sys_exit = exc_info[0] is SystemExit
                        if self.args.verbose:
                                traceback.print_exc()
                        elif not sys_exit:
                                print(exc_info[1])
                        exit(0 if sys_exit else 1)

if __name__ == "__main__":
        Tool().run()

${this.title}

Code Editor : argdist-bpfcc