ebpf 追踪打开的文件

scan@scan-virtual-machine:~/sbin$ while :; do cat test.txt; sleep 1; done

aaa

aaa

aaa

aaa

aaa

aaa

scan@scan-virtual-machine:~/ebpf$ sudo python3 trace_open.py

[sudo] password for scan:

In file included from <built-in>:2:

In file included from /virtual/include/bcc/bpf.h:12:

In file included from include/linux/types.h:6:

In file included from include/uapi/linux/types.h:14:

In file included from ./include/uapi/linux/posix_types.h:5:

In file included from include/linux/stddef.h:5:

In file included from include/uapi/linux/stddef.h:2:

In file included from include/linux/compiler_types.h:80:

include/linux/compiler-clang.h:41:9: warning: '__HAVE_BUILTIN_BSWAP32__' macro redefined [-Wmacro-redefined]

#define __HAVE_BUILTIN_BSWAP32__

^

<command line>:4:9: note: previous definition is here

#define __HAVE_BUILTIN_BSWAP32__ 1

^

In file included from <built-in>:2:

In file included from /virtual/include/bcc/bpf.h:12:

In file included from include/linux/types.h:6:

In file included from include/uapi/linux/types.h:14:

In file included from ./include/uapi/linux/posix_types.h:5:

In file included from include/linux/stddef.h:5:

In file included from include/uapi/linux/stddef.h:2:

In file included from include/linux/compiler_types.h:80:

include/linux/compiler-clang.h:42:9: warning: '__HAVE_BUILTIN_BSWAP64__' macro redefined [-Wmacro-redefined]

#define __HAVE_BUILTIN_BSWAP64__

^

<command line>:5:9: note: previous definition is here

#define __HAVE_BUILTIN_BSWAP64__ 1

^

In file included from <built-in>:2:

In file included from /virtual/include/bcc/bpf.h:12:

In file included from include/linux/types.h:6:

In file included from include/uapi/linux/types.h:14:

In file included from ./include/uapi/linux/posix_types.h:5:

In file included from include/linux/stddef.h:5:

In file included from include/uapi/linux/stddef.h:2:

In file included from include/linux/compiler_types.h:80:

include/linux/compiler-clang.h:43:9: warning: '__HAVE_BUILTIN_BSWAP16__' macro redefined [-Wmacro-redefined]

#define __HAVE_BUILTIN_BSWAP16__

^

<command line>:3:9: note: previous definition is here

#define __HAVE_BUILTIN_BSWAP16__ 1

^

3 warnings generated.

TIME(s) COMM PID FILE

0.000000000 cat 15755 /etc/ld.so.cache

0.000123256 cat 15755

0.000630506 cat 15755

0.000823941 cat 15755 test.txt

0.011920539 sleep 15756 /etc/ld.so.cache

0.012007402 sleep 15756

0.012415269 sleep 15756 /usr/lib/locale/locale-archive

1.015082114 cat 15757 /etc/ld.so.cache

1.015180106 cat 15757

1.015540373 cat 15757 /usr/lib/locale/locale-archive

1.015672421 cat 15757 test.txt

1.017777680 sleep 15758 /etc/ld.so.cache

1.018101198 sleep 15758

1.018630144 sleep 15758 /usr/lib/locale/locale-archive

2.020307312 cat 15759 /etc/ld.so.cache

2.020355297 cat 15759

2.020689578 cat 15759

2.020851072 cat 15759 test.txt

2.022197865 sleep 15760 /etc/ld.so.cache

2.022365127 sleep 15760

2.022946339 sleep 15760

3.024520029 cat 15761 /etc/ld.so.cache

3.024573996 cat 15761

3.024855280 cat 15761

3.025060203 cat 15761 test.txt

3.026768170 sleep 15762 /etc/ld.so.cache

3.026835131 sleep 15762

3.027253209 sleep 15762 /usr/lib/locale/locale-archive

^Cscan@scan-virtual-machine:~/ebpf$