1sofdsnoop(8) System Manager's Manual sofdsnoop(8)
2
3
4
6 sofdsnoop - Trace FDs passed through unix sockets. Uses Linux eBPF/bcc.
7
9 sofdsnoop [-h] [-T] [-p PID] [-t TID] [-n NAME] [-d DURATION]
10
12 sofdsnoop traces FDs passed through unix sockets
13
14 Every file descriptor that is passed via unix sockets os displayed on
15 separate line together with process info (TID/COMM columns), ACTION
16 details (SEND/RECV), file descriptor number (FD) and its translation to
17 file if available (NAME).
18
19 Since this uses BPF, only the root user can use this tool.
20
22 CONFIG_BPF and bcc.
23
25 -h Print usage message.
26
27 -T Include a timestamp column.
28
29 -p PID Trace this process ID only (filtered in-kernel).
30
31 -t TID Trace this thread ID only (filtered in-kernel).
32
33 -d DURATION
34 Total duration of trace in seconds.
35
36 -n NAME
37 Only print command lines matching this command name (regex)
38
40 Trace all sockets:
41 # sofdsnoop
42
43 Trace all sockets, and include timestamps:
44 # sofdsnoop -T
45
46 Only trace sockets where the process contains "server":
47 # sofdsnoop -n server
48
50 TIME(s)
51 Time of SEDN/RECV actions, in seconds.
52
53 ACTION Operation on the fd SEND/RECV.
54
55 TID Process TID
56
57 COMM Parent process/command name.
58
59 SOCKET The socket carrier.
60
61 FD file descriptor number
62
63 NAME file name for SEND lines
64
66 This is from bcc.
67
68 https://github.com/iovisor/bcc
69
70 Also look in the bcc distribution for a companion _examples.txt file
71 containing example usage, output, and commentary for this tool.
72
74 Linux
75
77 Unstable - in development.
78
80 Jiri Olsa
81
83 opensnoop(1)
84
85
86
87USER COMMANDS 2018-11-08 sofdsnoop(8)