statsnoop_example.txt

Demonstrations of statsnoop, the Linux eBPF/bcc version.


statsnoop traces the different stat() syscalls system-wide, and prints various
details. Example output:

# ./statsnoop 
PID    COMM               FD ERR PATH
31126  bash                0   0 .
31126  bash               -1   2 /usr/local/sbin/iconfig
31126  bash               -1   2 /usr/local/bin/iconfig
31126  bash               -1   2 /usr/sbin/iconfig
31126  bash               -1   2 /usr/bin/iconfig
31126  bash               -1   2 /sbin/iconfig
31126  bash               -1   2 /bin/iconfig
31126  bash               -1   2 /usr/games/iconfig
31126  bash               -1   2 /usr/local/games/iconfig
31126  bash               -1   2 /apps/python/bin/iconfig
31126  bash               -1   2 /mnt/src/llvm/build/bin/iconfig
8902   command-not-fou    -1   2 /usr/bin/Modules/Setup
8902   command-not-fou    -1   2 /usr/bin/lib/python3.4/os.py
8902   command-not-fou    -1   2 /usr/bin/lib/python3.4/os.pyc
8902   command-not-fou     0   0 /usr/lib/python3.4/os.py
8902   command-not-fou    -1   2 /usr/bin/pybuilddir.txt
8902   command-not-fou    -1   2 /usr/bin/lib/python3.4/lib-dynload
8902   command-not-fou     0   0 /usr/lib/python3.4/lib-dynload
8902   command-not-fou     0   0 /apps/python/lib/python2.7/site-packages
8902   command-not-fou     0   0 /apps/python/lib/python2.7/site-packages
8902   command-not-fou     0   0 /apps/python/lib/python2.7/site-packages
8902   command-not-fou     0   0 /usr/lib/python3.4/
8902   command-not-fou     0   0 /usr/lib/python3.4/
[...]

This output has caught me mistyping a command in another shell, "iconfig"
instead of "ifconfig". The first several lines show the bash shell searching
the $PATH, and failing to find it (ERR == 2 is file not found). Then, a
"command-not-found" program executes (the name is truncated to 16 characters
in the COMM field), which begins the process of searching for and suggesting
a package. ie, this:

# iconfig
No command 'iconfig' found, did you mean:
 Command 'vconfig' from package 'vlan' (main)
 Command 'fconfig' from package 'redboot-tools' (universe)
 Command 'mconfig' from package 'mono-devel' (main)
 Command 'iwconfig' from package 'wireless-tools' (main)
 Command 'zconfig' from package 'python-zconfig' (universe)
 Command 'ifconfig' from package 'net-tools' (main)
iconfig: command not found

statsnoop can be used for general debugging, to see what file information has
been requested, and whether those files exist. It can be used as a companion
to opensnoop, which shows what files were actually opened.


USAGE message:

# ./statsnoop -h
usage: statsnoop [-h] [-t] [-x] [-p PID]

Trace stat() syscalls

optional arguments:
  -h, --help         show this help message and exit
  -t, --timestamp    include timestamp on output
  -x, --failed       only show failed stats
  -p PID, --pid PID  trace this PID only

examples:
    ./statsnoop           # trace all stat() syscalls
    ./statsnoop -t        # include timestamps
    ./statsnoop -x        # only show failed stats
    ./statsnoop -p 181    # only trace PID 181