killsnoop: use current time replace timestamp and default output

man/man8/killsnoop.8

@@ -2,7 +2,7 @@
 .SH NAME
 killsnoop \- Trace signals issued by the kill() syscall. Uses Linux eBPF/bcc.
 .SH SYNOPSIS
-.B killsnoop [\-h] [\-t] [\-x] [-p PID]
+.B killsnoop [\-h] [\-x] [-p PID]
 .SH DESCRIPTION
 killsnoop traces the kill() syscall, to show signals sent via this method. This
 may be useful to troubleshoot failing applications, where an unknown mechanism
@@ -23,9 +23,6 @@ CONFIG_BPF and bcc.
 \-h
 Print usage message.
 .TP
-\-t
-Include a timestamp column.
-.TP
 \-x
 Only print failed kill() syscalls.
 .TP
@@ -37,10 +34,6 @@ Trace all kill() syscalls:
 #
 .B killsnoop
 .TP
-Trace all kill() syscalls, and include timestamps:
-#
-.B killsnoop \-t
-.TP
 Trace only kill() syscalls that failed:
 #
 .B killsnoop \-x
@@ -50,8 +43,8 @@ Trace PID 181 only:
 .B killsnoop \-p 181
 .SH FIELDS
 .TP
-TIME(s)
-Time of the call, in seconds.
+TIME
+Time of the kill call.
 .TP
 PID
 Source process ID

tools/killsnoop.py

@@ -4,7 +4,7 @@
 # killsnoop Trace signals issued by the kill() syscall.
 # For Linux, uses BCC, eBPF. Embedded C.
 #
-# USAGE: killsnoop [-h] [-t] [-x] [-p PID]
+# USAGE: killsnoop [-h] [-x] [-p PID]
 #
 # Copyright (c) 2015 Brendan Gregg.
 # Licensed under the Apache License, Version 2.0 (the "License")
@@ -15,21 +15,19 @@
 from __future__ import print_function
 from bcc import BPF
 import argparse
+from time import strftime
 import ctypes as ct
 
 # arguments
 examples = """examples:
  ./killsnoop # trace all kill() signals
- ./killsnoop -t # include timestamps
  ./killsnoop -x # only show failed kills
  ./killsnoop -p 181 # only trace PID 181
 """
 parser = argparse.ArgumentParser(
  description="Trace signals issued by the kill() syscall",
  formatter_class=argparse.RawDescriptionHelpFormatter,
  epilog=examples)
-parser.add_argument("-t", "--timestamp", action="store_true",
- help="include timestamp on output")
 parser.add_argument("-x", "--failed", action="store_true",
  help="only show failed kill syscalls")
 parser.add_argument("-p", "--pid",
@@ -44,7 +42,6 @@
 
 struct val_t {
  u64 pid;
- u64 ts;
  int sig;
  int tpid;
  char comm[TASK_COMM_LEN];
@@ -55,8 +52,6 @@
  u64 tpid;
  int sig;
  int ret;
- u64 ts;
- u64 delta;
  char comm[TASK_COMM_LEN];
 };
 
@@ -71,7 +66,6 @@
  FILTER
  if (bpf_get_current_comm(&val.comm, sizeof(val.comm)) == 0) {
  val.pid = bpf_get_current_pid_tgid();
- val.ts = bpf_ktime_get_ns();
  val.tpid = tpid;
  val.sig = sig;
  infotmp.update(&pid, &val);
@@ -85,7 +79,6 @@
  struct data_t data = {};
  struct val_t *valp;
  u32 pid = bpf_get_current_pid_tgid();
- u64 tsp = bpf_ktime_get_ns();
 
  valp = infotmp.lookup(&pid);
  if (valp == 0) {
@@ -95,8 +88,6 @@
 
  bpf_probe_read(&data.comm, sizeof(data.comm), valp->comm);
  data.pid = pid;
- data.delta = tsp - valp->ts;
- data.ts = tsp / 1000;
  data.tpid = valp->tpid;
  data.ret = PT_REGS_RC(ctx);
  data.sig = valp->sig;
@@ -126,47 +117,21 @@ class Data(ct.Structure):
  ("tpid", ct.c_ulonglong),
  ("sig", ct.c_int),
  ("ret", ct.c_int),
- ("ts", ct.c_ulonglong),
- ("delta", ct.c_ulonglong),
  ("comm", ct.c_char * TASK_COMM_LEN)
  ]
 
-start_ts = 0
-prev_ts = 0
-delta = 0
-
 # header
-if args.timestamp:
- print("%-14s" % ("TIME(s)"), end="")
-print("%-6s %-16s %-4s %-6s %s" % ("PID", "COMM", "SIG", "TPID", "RESULT"))
+print("%-9s %-6s %-16s %-4s %-6s %s" % (
+ "TIME", "PID", "COMM", "SIG", "TPID", "RESULT"))
 
 # process event
 def print_event(cpu, data, size):
  event = ct.cast(data, ct.POINTER(Data)).contents
- global start_ts
- global prev_ts
- global delta
-
- if start_ts == 0:
- prev_ts = start_ts
-
- if start_ts == 1:
- delta = float(delta) + (event.ts - prev_ts)
-
- if (args.failed and (event.ret >= 0)):
- start_ts = 1
- prev_ts = event.ts
- return
-
- # print columns
- if args.timestamp:
- print("%-14.9f" % (delta / 1000000), end="")
 
- print("%-6d %-16s %-4d %-6d %d" % (event.pid, event.comm, event.sig,
- event.tpid, event.ret))
+ if (args.failed and (event.ret >= 0)): return
 
- prev_ts = event.ts
- start_ts = 1
+ print("%-9s %-6d %-16s %-4d %-6d %d" % (strftime("%H:%M:%S"),
+  event.pid, event.comm, event.sig, event.tpid, event.ret))
 
 # loop with callback to print_event
 b["events"].open_perf_buffer(print_event)

tools/killsnoop_example.txt

@@ -4,13 +4,13 @@ Demonstrations of killsnoop, the Linux eBPF/bcc version.
 This traces signals sent via the kill() syscall. For example:
 
 # ./killsnoop
-PID COMM SIG TPID RESULT
-17064 bash 9 27682 0
-17064 bash 9 27682 -3
-17064 bash  0 17064 0
+TIME PID COMM SIG TPID RESULT
+12:10:51 13967 bash 9 13885 0
+12:11:34 13967 bash 9 1024  -3
+12:11:41 815 systemd-udevd 15 14076 0
 
-The first line showed a SIGKILL (9) sent from PID 17064 (a bash shell) to
-PID 27682. The result, 0, means success.
+The first line showed a SIGKILL (9) sent from PID 13967 (a bash shell) to
+PID 13885. The result, 0, means success.
 
 The second line showed the same signal sent, this time resulting in a -3
 (ESRCH: no such process).
@@ -19,18 +19,16 @@ The second line showed the same signal sent, this time resulting in a -3
 USAGE message:
 
 # ./killsnoop -h
-usage: killsnoop [-h] [-t] [-x] [-p PID]
+usage: killsnoop [-h] [-x] [-p PID]
 
 Trace signals issued by the kill() syscall
 
 optional arguments:
  -h, --help show this help message and exit
- -t, --timestamp include timestamp on output
  -x, --failed only show failed kill syscalls
  -p PID, --pid PID trace this PID only
 
 examples:
  ./killsnoop # trace all kill() signals
- ./killsnoop -t # include timestamps
  ./killsnoop -x # only show failed kills
  ./killsnoop -p 181 # only trace PID 181