opensnoop(8)

1opensnoop(8)                System Manager's Manual               opensnoop(8)
2
3
4

NAME

6       opensnoop.bt - Trace open() syscalls. Uses bpftrace/eBPF.
7

SYNOPSIS

9       opensnoop.bt
10

DESCRIPTION

12       opensnoop  traces  the  open()  syscall,  showing  which  processes are
13       attempting to open which files. This can be useful for determining  the
14       location  of  config and log files, or for troubleshooting applications
15       that are failing, specially on startup.
16
17       This works by tracing the open() syscall tracepoint.
18
19       Since this uses BPF, only the root user can use this tool.
20

REQUIREMENTS

22       CONFIG_BPF and bcc.
23

EXAMPLES

25       Trace all open() syscalls:
26              # opensnoop.bt
27

FIELDS

29       PID Process ID
30
31       TID    Thread ID
32
33       COMM   Process name
34
35       FD     File descriptor (if success), or -1 (if failed)
36
37       ERR    Error number (see the system's errno.h)
38
39       PATH   Open path
40

OVERHEAD

42       This traces the open tracepoint and prints output for  each  event.  As
43       the  rate of this is generally expected to be low (< 1000/s), the over‐
44       head is also expected to be negligible. If you have an application that
45       is  calling  a  high rate of open()s, then test and understand overhead
46       before use.
47

SOURCE

49       This is from bpftrace.
50
51              https://github.com/iovisor/bpftrace
52
53       Also look in the bpftrace distribution for  a  companion  _examples.txt
54       file containing example usage, output, and commentary for this tool.
55
56       This  is  a  bpftrace version of the bcc tool of the same name. The bcc
57       tool may provide more options and customizations.
58
59              https://github.com/iovisor/bcc
60

OS

62       Linux
63

STABILITY

65       Unstable - in development.
66

AUTHOR

68       Brendan Gregg
69