ULTRA [ drganbuganapathi.com ]

Linux mail.drganbuganapathi.com 6.8.0-60-generic #63-Ubuntu SMP PREEMPT_DYNAMIC Tue Apr 15 19:04:15 UTC 2025 x86_64

Apache/2.4.58 (Ubuntu)

165.22.222.249 | Your IP: 216.73.216.137

Cant read [ /etc/named.conf ]

[ drwxr-xr-x ]

/ proc / self / root / usr / share / doc / bpfcc-tools / examples / doc /

Home Upload Mass Deface Mass Delete Back Connect Notify

exitsnoop_example.txt

Demonstrations of exitsnoop.

This Linux tool traces all process terminations and reason, it
    - is implemented using BPF, which requires CAP_SYS_ADMIN and
      should therefore be invoked with sudo
    - traces sched_process_exit tracepoint in kernel/exit.c
    - includes processes by root and all users
    - includes processes in containers
    - includes processes that become zombie

The following example shows the termination of the 'sleep' and 'bash' commands
when run in a loop that is interrupted with Ctrl-C from the terminal:

# ./exitsnoop.py  > exitlog &
[1] 18997
# for((i=65;i<100;i+=5)); do bash -c "sleep 1.$i;exit $i"; done
^C
# fg
./exitsnoop.py > exitlog
^C
# cat exitlog
PCOMM            PID    PPID   TID    AGE(s)  EXIT_CODE
sleep            19004  19003  19004  1.65    0
bash             19003  17656  19003  1.65    code 65
sleep            19007  19006  19007  1.70    0
bash             19006  17656  19006  1.70    code 70
sleep            19010  19009  19010  1.75    0
bash             19009  17656  19009  1.75    code 75
sleep            19014  19013  19014  0.23    signal 2 (INT)
bash             19013  17656  19013  0.23    signal 2 (INT)

The output shows the process/command name (PCOMM), the PID,
the process that will be notified (PPID), the thread (TID), the AGE
of the process with hundredth of a second resolution, and the reason for
the process exit (EXIT_CODE).

A -t option can be used to include a timestamp column, it shows local time
by default.  The --utc option shows the time in UTC.  The --label
option adds a column indicating the tool that generated the output,
'exit' by default.  If other tools follow this format their outputs
can be merged into a single trace with a simple lexical sort
increasing in time order with each line labeled to indicate the event,
e.g. 'exec', 'open', 'exit', etc.  Time is displayed with millisecond
resolution. The -x option will show only non-zero exits and fatal
signals, which excludes processes that exit with 0 code:

# ./exitsnoop.py -t --utc -x --label= > exitlog &
[1] 18289
# for((i=65;i<100;i+=5)); do bash -c "sleep 1.$i;exit $i"; done
^C
# fg
./exitsnoop.py -t --utc -x --label= > exitlog
^C
# cat exitlog
TIME-UTC     LABEL PCOMM            PID    PPID   TID    AGE(s)  EXIT_CODE
13:20:22.997 exit  bash             18300  17656  18300  1.65    code 65
13:20:24.701 exit  bash             18303  17656  18303  1.70    code 70
13:20:26.456 exit  bash             18306  17656  18306  1.75    code 75
13:20:28.260 exit  bash             18310  17656  18310  1.80    code 80
13:20:30.113 exit  bash             18313  17656  18313  1.85    code 85
13:20:31.495 exit  sleep            18318  18317  18318  1.38    signal 2 (INT)
13:20:31.495 exit  bash             18317  17656  18317  1.38    signal 2 (INT)
#

USAGE message:

# ./exitsnoop.py -h
usage: exitsnoop.py [-h] [-t] [--utc] [-p PID] [--label LABEL] [-x] [--per-thread]

Trace all process termination (exit, fatal signal)

optional arguments:
  -h, --help         show this help message and exit
  -t, --timestamp    include timestamp (local time default)
  --utc              include timestamp in UTC (-t implied)
  -p PID, --pid PID  trace this PID only
  --label LABEL      label each line
  -x, --failed       trace only fails, exclude exit(0)
  --per-thread       trace per thread termination

examples:
    exitsnoop                # trace all process termination
    exitsnoop -x             # trace only fails, exclude exit(0)
    exitsnoop -t             # include timestamps (local time)
    exitsnoop --utc          # include timestamps (UTC)
    exitsnoop -p 181         # only trace PID 181
    exitsnoop --label=exit   # label each output line with 'exit'
    exitsnoop --per-thread   # trace per thread termination

Exit status:

0 EX_OK        Success
    2              argparse error
   70 EX_SOFTWARE  syntax error detected by compiler, or
                   verifier error from kernel
   77 EX_NOPERM    Need sudo (CAP_SYS_ADMIN) for BPF() system call

About process termination in Linux
----------------------------------

A program/process on Linux terminates normally
    - by explicitly invoking the exit( int ) system call
    - in C/C++ by returning an int from main(),
      ...which is then used as the value for exit()
    - by reaching the end of main() without a return
      ...which is equivalent to return 0 (C99 and C++)
  Notes:
    - Linux keeps only the least significant eight bits of the exit value
    - an exit value of 0 means success
    - an exit value of 1-255 means an error

A process terminates abnormally if it
    - receives a signal which is not ignored or blocked and has no handler
      ... the default action is to terminate with optional core dump
    - is selected by the kernel's "Out of Memory Killer",
      equivalent to being sent SIGKILL (9), which cannot be ignored or blocked
  Notes:
    - any signal can be sent asynchronously via the kill() system call
    - synchronous signals are the result of the CPU detecting
      a fault or trap during execution of the program, a kernel handler
      is dispatched which determines the cause and the corresponding
      signal, examples are
        - attempting to fetch data or instructions at invalid or
          privileged addresses,
        - attempting to divide by zero, unmasked floating point exceptions
        - hitting a breakpoint

Linux keeps process termination information in 'exit_code', an int
within struct 'task_struct' defined in <linux/sched.c>
    - if the process terminated normally:
        - the exit value is in bits 15:8
        - the least significant 8 bits of exit_code are zero (bits 7:0)
    - if the process terminates abnormally:
        - the signal number (>= 1) is in bits 6:0
        - bit 7 indicates a 'core dump' action, whether a core dump was
          actually done depends on ulimit.

Success is indicated with an exit value of zero.
The meaning of a non zero exit value depends on the program.
Some programs document their exit values and their meaning.
This script uses exit values as defined in <include/sysexits.h>

References:

https://github.com/torvalds/linux/blob/master/kernel/exit.c
   https://github.com/torvalds/linux/blob/master/arch/x86/include/uapi/asm/signal.h
   https://code.woboq.org/userspace/glibc/misc/sysexits.h.html

Name	Type	Size	Owner/Group	Permission	Last Modified	Actions
.	dir	-	root/root	drwxr-xr-x	2024-07-10 02:06:54
..	dir	-	root/root	drwxr-xr-x	2024-07-10 02:06:54
lib	dir	-	root/root	drwxr-xr-x	2024-07-10 02:06:54
argdist_example.txt	text/plain	22.49 KB	root/root	-rw-r--r--	2023-12-08 09:06:51
bashreadline_example.txt	text/plain	882 B	root/root	-rw-r--r--	2023-12-08 09:06:51
bindsnoop_example.txt	text/plain	4.42 KB	root/root	-rw-r--r--	2023-12-08 09:06:51
biolatency_example.txt	text/plain	23.46 KB	root/root	-rw-r--r--	2023-12-08 09:06:51
biolatpcts_example.txt	text/plain	2.97 KB	root/root	-rw-r--r--	2023-12-08 09:06:51
biopattern_example.txt	text/plain	1.37 KB	root/root	-rw-r--r--	2023-12-08 09:06:51
biosnoop_example.txt	text/plain	3.47 KB	root/root	-rw-r--r--	2023-12-08 09:06:51
biotop_example.txt	text/plain	9.11 KB	root/root	-rw-r--r--	2023-12-08 09:06:51
bitesize_example.txt	text/plain	4.98 KB	root/root	-rw-r--r--	2023-12-08 09:06:51
bpflist_example.txt	text/plain	2.13 KB	root/root	-rw-r--r--	2023-12-08 09:06:51
btrfsdist_example.txt	text/plain	9.32 KB	root/root	-rw-r--r--	2023-12-08 09:06:51
btrfsslower_example.txt	text/plain	6.65 KB	root/root	-rw-r--r--	2023-12-08 09:06:51
cachestat_example.txt	text/plain	3.92 KB	root/root	-rw-r--r--	2023-12-08 09:06:51
cachetop_example.txt	text/plain	3.83 KB	root/root	-rw-r--r--	2023-12-08 09:06:51
capable_example.txt	text/plain	6.5 KB	root/root	-rw-r--r--	2023-12-08 09:06:51
cobjnew_example.txt	text/plain	2.97 KB	root/root	-rw-r--r--	2023-12-08 09:06:51
compactsnoop_example.txt	text/plain	9.92 KB	root/root	-rw-r--r--	2023-12-08 09:06:51
cpudist_example.txt	text/plain	16.48 KB	root/root	-rw-r--r--	2023-12-08 09:06:51
cpuunclaimed_example.txt	text/plain	15.2 KB	root/root	-rw-r--r--	2023-12-08 09:06:51
criticalstat_example.txt	text/plain	4.81 KB	root/root	-rw-r--r--	2023-12-08 09:06:51
cthreads_example.txt	text/plain	2.08 KB	root/root	-rw-r--r--	2023-12-08 09:06:51
dbslower_example.txt	text/plain	3.89 KB	root/root	-rw-r--r--	2023-12-08 09:06:51
dbstat_example.txt	text/plain	6.5 KB	root/root	-rw-r--r--	2023-12-08 09:06:51
dcsnoop_example.txt	text/plain	4.27 KB	root/root	-rw-r--r--	2023-12-08 09:06:51
dcstat_example.txt	text/x-c	3.26 KB	root/root	-rw-r--r--	2023-12-08 09:06:51
deadlock_example.txt	text/x-pascal	16.25 KB	root/root	-rw-r--r--	2023-12-08 09:06:51
dirtop_example.txt	text/plain	4.98 KB	root/root	-rw-r--r--	2023-12-08 09:06:51
drsnoop_example.txt	text/plain	5 KB	root/root	-rw-r--r--	2023-12-08 09:06:51
execsnoop_example.txt	text/plain	6.64 KB	root/root	-rw-r--r--	2023-12-08 09:06:51
exitsnoop_example.txt	text/x-c	6.22 KB	root/root	-rw-r--r--	2023-12-08 09:06:51
ext4dist_example.txt	text/plain	8.78 KB	root/root	-rw-r--r--	2023-12-08 09:06:51
ext4slower_example.txt	text/plain	11.07 KB	root/root	-rw-r--r--	2023-12-08 09:06:51
filegone_example.txt	text/plain	743 B	root/root	-rw-r--r--	2023-12-08 09:06:51
filelife_example.txt	text/plain	2.04 KB	root/root	-rw-r--r--	2023-12-08 09:06:51
fileslower_example.txt	text/plain	5.58 KB	root/root	-rw-r--r--	2023-12-08 09:06:51
filetop_example.txt	text/plain	6.8 KB	root/root	-rw-r--r--	2023-12-08 09:06:51
funccount_example.txt	text/plain	13.29 KB	root/root	-rw-r--r--	2023-12-08 09:06:51
funcinterval_example.txt	text/plain	15.28 KB	root/root	-rw-r--r--	2023-12-08 09:06:51
funclatency_example.txt	text/plain	20.98 KB	root/root	-rw-r--r--	2023-12-08 09:06:51
funcslower_example.txt	text/plain	6.63 KB	root/root	-rw-r--r--	2023-12-08 09:06:51
gethostlatency_example.txt	text/plain	1.29 KB	root/root	-rw-r--r--	2023-12-08 09:06:51
hardirqs_example.txt	text/plain	37.05 KB	root/root	-rw-r--r--	2023-12-08 09:06:51
inject_example.txt	text/x-c	6.67 KB	root/root	-rw-r--r--	2023-12-08 09:06:51
javacalls_example.txt	text/plain	3.91 KB	root/root	-rw-r--r--	2023-12-08 09:06:51
javaflow_example.txt	text/plain	5.88 KB	root/root	-rw-r--r--	2023-12-08 09:06:51
javagc_example.txt	text/plain	3.78 KB	root/root	-rw-r--r--	2023-12-08 09:06:51
javaobjnew_example.txt	text/plain	2.97 KB	root/root	-rw-r--r--	2023-12-08 09:06:51
javastat_example.txt	text/plain	2.98 KB	root/root	-rw-r--r--	2023-12-08 09:06:51
javathreads_example.txt	text/plain	2.08 KB	root/root	-rw-r--r--	2023-12-08 09:06:51
killsnoop_example.txt	text/plain	1.31 KB	root/root	-rw-r--r--	2023-12-08 09:06:51
klockstat_example.txt	text/plain	8.34 KB	root/root	-rw-r--r--	2023-12-08 09:06:51
kvmexit_example.txt	text/plain	11.63 KB	root/root	-rw-r--r--	2023-12-08 09:06:51
llcstat_example.txt	text/plain	3.24 KB	root/root	-rw-r--r--	2023-12-08 09:06:51
mdflush_example.txt	text/plain	1.74 KB	root/root	-rw-r--r--	2023-12-08 09:06:51
memleak_example.txt	text/plain	10.02 KB	root/root	-rw-r--r--	2023-12-08 09:06:51
mountsnoop_example.txt	text/plain	1.45 KB	root/root	-rw-r--r--	2023-12-08 09:06:51
mysqld_qslower_example.txt	text/plain	2.3 KB	root/root	-rw-r--r--	2023-12-08 09:06:51
netqtop_example.txt	text/plain	12.2 KB	root/root	-rw-r--r--	2023-12-08 09:06:51
nfsdist_example.txt	text/plain	8.31 KB	root/root	-rw-r--r--	2023-12-08 09:06:51
nfsslower_example.txt	text/plain	7.68 KB	root/root	-rw-r--r--	2023-12-08 09:06:51
nodegc_example.txt	text/plain	3.78 KB	root/root	-rw-r--r--	2023-12-08 09:06:51
nodestat_example.txt	text/plain	2.98 KB	root/root	-rw-r--r--	2023-12-08 09:06:51
offcputime_example.txt	text/plain	19.2 KB	root/root	-rw-r--r--	2023-12-08 09:06:51
offwaketime_example.txt	text/plain	37.36 KB	root/root	-rw-r--r--	2023-12-08 09:06:51
oomkill_example.txt	text/plain	1.88 KB	root/root	-rw-r--r--	2023-12-08 09:06:51
opensnoop_example.txt	text/plain	10.33 KB	root/root	-rw-r--r--	2023-12-08 09:06:51
perlcalls_example.txt	text/plain	3.91 KB	root/root	-rw-r--r--	2023-12-08 09:06:51
perlflow_example.txt	text/plain	5.88 KB	root/root	-rw-r--r--	2023-12-08 09:06:51
perlstat_example.txt	text/plain	2.98 KB	root/root	-rw-r--r--	2023-12-08 09:06:51
phpcalls_example.txt	text/plain	3.91 KB	root/root	-rw-r--r--	2023-12-08 09:06:51
phpflow_example.txt	text/plain	5.88 KB	root/root	-rw-r--r--	2023-12-08 09:06:51
phpstat_example.txt	text/plain	2.98 KB	root/root	-rw-r--r--	2023-12-08 09:06:51
pidpersec_example.txt	text/plain	677 B	root/root	-rw-r--r--	2023-12-08 09:06:51
ppchcalls_example.txt	text/plain	6.93 KB	root/root	-rw-r--r--	2023-12-08 09:06:51
profile_example.txt	text/x-c	31.08 KB	root/root	-rw-r--r--	2023-12-08 09:06:51
pythoncalls_example.txt	text/plain	3.91 KB	root/root	-rw-r--r--	2023-12-08 09:06:51
pythonflow_example.txt	text/plain	5.88 KB	root/root	-rw-r--r--	2023-12-08 09:06:51
pythongc_example.txt	text/plain	3.78 KB	root/root	-rw-r--r--	2023-12-08 09:06:51
pythonstat_example.txt	text/plain	2.98 KB	root/root	-rw-r--r--	2023-12-08 09:06:51
rdmaucma_example.txt	text/plain	1.94 KB	root/root	-rw-r--r--	2023-12-08 09:06:51
readahead_example.txt	text/plain	3.17 KB	root/root	-rw-r--r--	2023-12-08 09:06:51
reset-trace_example.txt	text/plain	9.15 KB	root/root	-rw-r--r--	2023-12-08 09:06:51
rubycalls_example.txt	text/plain	3.91 KB	root/root	-rw-r--r--	2023-12-08 09:06:51
rubyflow_example.txt	text/plain	5.88 KB	root/root	-rw-r--r--	2023-12-08 09:06:51
rubygc_example.txt	text/plain	3.78 KB	root/root	-rw-r--r--	2023-12-08 09:06:51
rubyobjnew_example.txt	text/plain	2.97 KB	root/root	-rw-r--r--	2023-12-08 09:06:51
rubystat_example.txt	text/plain	2.98 KB	root/root	-rw-r--r--	2023-12-08 09:06:51
runqlat_example.txt	text/plain	31.3 KB	root/root	-rw-r--r--	2023-12-08 09:06:51
runqlen_example.txt	text/plain	11.85 KB	root/root	-rw-r--r--	2023-12-08 09:06:51
runqslower_example.txt	text/plain	2.13 KB	root/root	-rw-r--r--	2023-12-08 09:06:51
shmsnoop_example.txt	text/plain	2.73 KB	root/root	-rw-r--r--	2023-12-08 09:06:51
slabratetop_example.txt	text/plain	5.22 KB	root/root	-rw-r--r--	2023-12-08 09:06:51
sofdsnoop_example.txt	text/plain	3.14 KB	root/root	-rw-r--r--	2023-12-08 09:06:51
softirqs_example.txt	text/plain	11.02 KB	root/root	-rw-r--r--	2023-12-08 09:06:51
solisten_example.txt	text/plain	2.3 KB	root/root	-rw-r--r--	2023-12-08 09:06:51
sslsniff_example.txt	text/html	6.74 KB	root/root	-rw-r--r--	2023-12-08 09:06:51
stackcount_example.txt	text/plain	21.45 KB	root/root	-rw-r--r--	2023-12-08 09:06:51
statsnoop_example.txt	text/plain	3.02 KB	root/root	-rw-r--r--	2023-12-08 09:06:51
swapin.txt	text/x-python	2.57 KB	root/root	-rw-r--r--	2023-12-08 09:06:51
swapin_example.txt	text/plain	1.39 KB	root/root	-rw-r--r--	2023-12-08 09:06:51
syncsnoop_example.txt	text/plain	387 B	root/root	-rw-r--r--	2023-12-08 09:06:51
syscount_example.txt	text/plain	6.27 KB	root/root	-rw-r--r--	2023-12-08 09:06:51
tclcalls_example.txt	text/plain	3.91 KB	root/root	-rw-r--r--	2023-12-08 09:06:51
tclflow_example.txt	text/plain	5.88 KB	root/root	-rw-r--r--	2023-12-08 09:06:51
tclobjnew_example.txt	text/plain	2.97 KB	root/root	-rw-r--r--	2023-12-08 09:06:51
tclstat_example.txt	text/plain	2.98 KB	root/root	-rw-r--r--	2023-12-08 09:06:51
tcpaccept_example.txt	text/plain	2.76 KB	root/root	-rw-r--r--	2023-12-08 09:06:51
tcpcong_example.txt	text/plain	33.31 KB	root/root	-rw-r--r--	2023-12-08 09:06:51
tcpconnect_example.txt	text/plain	6.27 KB	root/root	-rw-r--r--	2023-12-08 09:06:51
tcpconnlat_example.txt	text/plain	2.55 KB	root/root	-rw-r--r--	2023-12-08 09:06:51
tcpdrop_example.txt	text/plain	1.95 KB	root/root	-rw-r--r--	2023-12-08 09:06:51
tcplife_example.txt	text/plain	6.83 KB	root/root	-rw-r--r--	2023-12-08 09:06:51
tcpretrans_example.txt	text/plain	3.85 KB	root/root	-rw-r--r--	2023-12-08 09:06:51
tcprtt_example.txt	text/plain	9.83 KB	root/root	-rw-r--r--	2023-12-08 09:06:51
tcpstates_example.txt	text/plain	2.84 KB	root/root	-rw-r--r--	2023-12-08 09:06:51
tcpsubnet_example.txt	text/x-pascal	5.37 KB	root/root	-rw-r--r--	2023-12-08 09:06:51
tcpsynbl_example.txt	text/plain	1.15 KB	root/root	-rw-r--r--	2023-12-08 09:06:51
tcptop_example.txt	text/plain	5.75 KB	root/root	-rw-r--r--	2023-12-08 09:06:51
tcptracer_example.txt	text/x-fortran	1.98 KB	root/root	-rw-r--r--	2023-12-08 09:06:51
threadsnoop_example.txt	text/plain	1.07 KB	root/root	-rw-r--r--	2023-12-08 09:06:51
tplist_example.txt	text/plain	4.4 KB	root/root	-rw-r--r--	2023-12-08 09:06:51
trace_example.txt	text/x-pascal	21.62 KB	root/root	-rw-r--r--	2023-12-08 09:06:51
ttysnoop_example.txt	text/plain	3.24 KB	root/root	-rw-r--r--	2023-12-08 09:06:51
vfscount_example.txt	text/plain	2.17 KB	root/root	-rw-r--r--	2023-12-08 09:06:51
vfsstat_example.txt	text/plain	1.66 KB	root/root	-rw-r--r--	2023-12-08 09:06:51
virtiostat_example.txt	text/plain	2.62 KB	root/root	-rw-r--r--	2023-12-08 09:06:51
wakeuptime_example.txt	text/plain	33.25 KB	root/root	-rw-r--r--	2023-12-08 09:06:51
xfsdist_example.txt	text/plain	6.77 KB	root/root	-rw-r--r--	2023-12-08 09:06:51
xfsslower_example.txt	text/plain	6.91 KB	root/root	-rw-r--r--	2023-12-08 09:06:51
zfsdist_example.txt	text/plain	9.52 KB	root/root	-rw-r--r--	2023-12-08 09:06:51
zfsslower_example.txt	text/plain	7.37 KB	root/root	-rw-r--r--	2023-12-08 09:06:51