-
Notifications
You must be signed in to change notification settings - Fork 11
Expand file tree
/
Copy pathdtrace_syscall
More file actions
5109 lines (4280 loc) · 147 KB
/
dtrace_syscall
File metadata and controls
5109 lines (4280 loc) · 147 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1000
#!/usr/bin/ksh
#
# **** Note: The main code starts after the line containing "# main:" ****
#
# CDDL HEADER START
#
# The contents of this file are subject to the terms of the
# Common Development and Distribution License, Version 1.0 only
# (the "License"). You may not use this file except in compliance
# with the License.
#
# You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
# or http://www.opensolaris.org/os/licensing.
# See the License for the specific language governing permissions
# and limitations under the License.
#
# When distributing Covered Code, include this CDDL HEADER in each
# file and include the License file at usr/src/OPENSOLARIS.LICENSE.
# If applicable, add the following below this CDDL HEADER, with the
# fields enclosed by brackets "[]" replaced with your own identifying
# information: Portions Copyright [yyyy] [name of copyright owner]
#
# CDDL HEADER END
#
#
# Copyright 2006-2011 Bernd Schemmer All rights reserved.
# Use is subject to license terms.
#
# Notes:
#
# - use "dtrace_syscalls {-v} {-v} {-v} -h" to get the usage help
#
# - use "dtrace_syscalls -X 2>drace_syscalls.examples.doc to get some usage
# examples
#
# - use "dtrace_syscalls -H 2 >dtrace_syscalls.doc" to get the documentation
#
# - this is a Kornshell script - it may not function correctly in other shells
# - the script was written and tested with ksh88 but should also work in ksh93
# The script should also work in bash -- but that is NOT completly tested
#
##EXAMPLE## # Usage examples
##EXAMPLE##
##EXAMPLE## #
##EXAMPLE## # monitor which process changes the permissions of a file
##EXAMPLE## # (dtrace output goes to STDERR only)
##EXAMPLE## #
##EXAMPLE## # ./dtrace_syscall chmod
##EXAMPLE##
##EXAMPLE## # monitor which process changes the permissions of a file or directory and
##EXAMPLE## # which process changes the owner of a file or directory
##EXAMPLE## # (the dtrace output goes to STDERR and into the logfile /var/tmp/monitor_file_changes.log)
##EXAMPLE## #
##EXAMPLE## # ./dtrace_syscall -L /var/tmp/monitor_file_changes.log chmod chown
##EXAMPLE##
##EXAMPLE## # monitor the chmod and chown syscall for 4 hours (-t4h)
##EXAMPLE## # Other examples for the parameter -t: : -t2s = monitor 2 seconds, -t40m = monitor 40 minutes, etc
##EXAMPLE## #
##EXAMPLE## # ./dtrace_syscall -L /var/tmp/monitor_file_changes.log -t4h chmod chown
##EXAMPLE##
##EXAMPLE## # monitor chmod and chown system calls continiously (-e) and
##EXAMPLE## # do a log rotate of the logfile every 6 hours (-t6h)
##EXAMPLE## #
##EXAMPLE## # ./dtrace_syscall -L /var/tmp/monitor_file_changes.log -t6h -e chmod chown
##EXAMPLE##
##EXAMPLE## # monitor which process is removing files or directories
##EXAMPLE## #
##EXAMPLE## # ./dtrace_syscall -L /var/tmp/unlink.log -e -t6h unlink
##EXAMPLE##
##EXAMPLE## # monitor which process deletes the file /var/tmp/test2
##EXAMPLE## #
##EXAMPLE## # ./dtrace_syscall -L /var/tmp/unlink.log -k -e -t6h -i 'copyinstr(arg0) == "/var/tmp/test2" || copyinstr(arg0) == "test2" ' unlink
##EXAMPLE##
##EXAMPLE##
##EXAMPLE## # monitor the syscall of a binary (in this example ls, "-c ls")
##EXAMPLE## # Note: Use a shell script for the parameter -c if a command with parameter should be dtraced.
##EXAMPLE## #
##EXAMPLE## # ./dtrace_syscall -L /var/tmp/ls_syscalls.log +P -c ls "*"
##EXAMPLE##
##EXAMPLE## # monitor the syscalls of a running process (in this example the process with the PID 22839)
##EXAMPLE## #
##EXAMPLE## # ./dtrace_syscall -L /var/tmp/shell_syscalls.log +P -p 22839 "*"
##EXAMPLE##
##EXAMPLE## # monitor the syscalls of some processes
##EXAMPLE## #
##EXAMPLE## # ./dtrace_syscall -p "22839 22747 22822 22748" -k +P "*"
##EXAMPLE##
##EXAMPLE## # monitor the syscalls of a process and all of it's child processes (in this example
##EXAMPLE## # the process with the PID 22839 and it's child processes)
##EXAMPLE## #
##EXAMPLE## # ./dtrace_syscall -L /var/tmp/shell_syscalls.log -p 22839 -i "|| ppid == 22839" "*"
##EXAMPLE##
##EXAMPLE##
##EXAMPLE## # monitor the chmod syscall and print additional messages if found (parameter -d)
##EXAMPLE## #
##EXAMPLE## # ./dtrace_syscall -L /var/tmp/shell_syscalls.log +P -k -d 'printf( "\n *** Parameter 0 is %16s \n", copyinstr(arg0) ); ' "chmod"
##EXAMPLE##
##EXAMPLE## # monitor the chmod syscall and print only userdefined messages if found (parameter +d)
##EXAMPLE## #
##EXAMPLE## # ./dtrace_syscall -L /var/tmp/shell_syscalls.log +P -k +d 'printf( "\n *** Binary: %16s, Parameter 0: %16s \n", execname, copyinstr(arg0) ); ' "chmod"
##EXAMPLE##
##EXAMPLE##
##EXAMPLE## Trouble Shooting
##EXAMPLE##
##EXAMPLE## An error message like
##EXAMPLE##
##EXAMPLE## dtrace: error on enabled probe ID 150 (ID 7715: syscall::sigaction:entry): invalid address (0x0) in action #3 at DIF offset 28
##EXAMPLE##
##EXAMPLE## will be printed by dtrace if the parameter 0 of the function to dtrace is not from the type string.
##EXAMPLE## In this case you should use the parameter +P of the script to suppress printing the parameter 0.
##EXAMPLE##
##EXAMPLE##
# -----------------------------------------------------------------------------
####
#### dtrace_syscalls - dtrace one or more system calls
####
#### Author: Bernd Schemmer (Bernd.Schemmer@gmx.de)
####
#### Version: see variable ${__SCRIPT_VERSION} below
#### (see variable ${__SCRIPT_TEMPLATE_VERSION} for the template
#### version used)
####
#### Supported OS: Solaris and others
####
####
#### Description
#### -----------
####
#### dtrace one or more system calls
##C#
##C# Configuration file
##C# ------------------
##C#
##C# This script supports a configuration file called <scriptname>.conf.
##C# The configuration file is searched in the working directory,
##C# the home directory of the user executing this script and /etc
##C# (in this order).
##C#
##C# The configuration file is read before the parameter are processed.
##C#
##C# To override the default config file search set the variable
##C# CONFIG_FILE to the name of the config file to use.
##C#
##C# e.g. CONFIG_FILE=/var/myconfigfile ./dtrace_syscalls
##C#
##C# See the variable __CONFIG_PARAMETER below for the possible entries in
##C# the config file.
##C#
####
#### Predefined parameter
#### --------------------
####
#### see the subroutines ShowShortUsage and ShowUsage
####
#### Note: The current version of the script template can be found here:
####
#### http://bnsmb.de/solaris/scriptt.html
####
####
##T# Troubleshooting support
##T# -----------------------
##T#
##T# Use
##T#
##T# __CREATE_DUMP=<anyvalue|directory> <yourscript>
##T#
##T# to create a dump of the environment variables on program exit.
##T#
##T# e.g
##T#
##T# __CREATE_DUMP=1 ./dtrace_syscalls
##T#
##T# will create a dump of the environment variables in the files
##T#
##T# /tmp/dtrace_syscalls.envvars.$$
##T# /tmp/dtrace_syscalls.exported_envvars.$$
##T#
##T# before the script ends
##T#
##T# __CREATE_DUMP=/var/tmp/debug ./dtrace_syscalls
##T#
##T# will create a dump of the environment variables in the files
##T#
##T# /var/tmp/debug/dtrace_syscalls.envvars.$$
##T# /var/tmp/debug/dtrace_syscalls.exported_envvars.$$
##T#
##T# before the script ends (the directory /var/tmp/debug must already exist).
##T#
##T# Note that the dump files will always be created in case of a syntax error.
##T# To set the directory for these files use
##T#
##T# export __DUMPDIR=/var/tmp/debug
##T# ./dtrace_syscalls
##T#
##T# To suppress creating the dump file in case of a syntax error use
##T#
##T# __DUMP_ALREADY_CREATED=${__TRUE}
##T#
##T#
##T# Use
##T#
##T# CreateDump <uniqdirectory> [filename_add]
##T#
##T# to manually create the dump files.
##T#
##T# e.g.
##T#
##T# CreateDump /var/debug
##T#
##T# will create the files
##T#
##T# /var/debug/dtrace_syscalls.envvars.$$
##T# /var/debug/dtrace_syscalls.exported_envvars.$$
##T#
##T# CreateDump /var/debug pass2.
##T#
##T# will create the files
##T#
##T# /var/debug/dtrace_syscalls.envvars.pass2.$$
##T# /var/debug/dtrace_syscalls.exported_envvars.pass2.$$
##T#
#### Note:
#### The default action for the signal handler USR1 is "Create an env dump in /var/tmp"
#### The filenames for the dumps are
####
#### /var/tmp/<scriptname>.envvars.dump_no_<no>_<PID>
#### /var/tmp/<scriptname>.exported_envvars.dump_no_<no>_<PID>
####
#### where <no> is a sequential number,<PID> is the PID of the process with the script,
#### and <scriptname> is the name of the script without the path.
####
#### Credits
#### -------
####
#### wpollock (http://wikis.sun.com/display/~wpollock)
#### -- http://wikis.sun.com/display/BigAdmin/A+Script+Template+and+Useful+Techniques+for+ksh+Scripts?focusedCommentId=12517624#comment-12517624
####
#### Source for the function PrintWithTimeStamp:
#### Bernd Fingers blog:
#### http://blogs.sun.com/blogfinger/entry/prepend_command_output_lines_with
####
####
#### History:
#### --------
#### 27.09.2011 v0.0.1 /bs
#### initial release
#### 28.09.2011 v0.0.2 /bs
#### added the UID to the output
#### 04.10.2011 v0.0.3 /bs
#### added code to support mixed functions (with and without arg0)
#### 05.10.2011 v0.0.4 /bs
#### code cleanup
#### 17.10.2011 v0.0.5 /bs
#### added the parameter -K (add probe descriptions to the dtrace script)
####
####
#### script template History
#### -----------------------
#### 1.22.0 08.06.2006 /bs (BigAdmin Version 1)
#### public release; starting history for the script template
####
#### 1.22.1 12.06.2006 /bs
#### added true/false to CheckYNParameter and ConvertToYesNo
####
#### 1.22.2. 21.06.2006 /bs
#### added the parameter -V
#### added the use of environment variables
#### added the variable __NO_TIME_STAMPS
#### added the variable __NO_HEADERS
#### corrected a bug in the function executeCommandAndLogSTDERR
#### added missing return commands
####
#### 1.22.3 24.06.2006 /bs
#### added the function StartStop_LogAll_to_logfile
#### added the variable __USE_TTY (used in AskUser)
#### corrected an spelling error (dev/nul instead of /dev/null)
####
#### 1.22.4 06.07.2006 /bs
#### corrected a bug in the parameter error handling routine
####
#### 1.22.5 27.07.2006 /bs
#### corrected some minor bugs
####
#### 1.22.6 09.08.2006 /bs
#### corrected some minor bugs
####
#### 1.22.7 17.08.2006 /bs
#### add the CheckParameterCount function
#### added the parameter -T
#### added long parameter support (e.g --help)
####
#### 1.22.8 07.09.2006 /bs
#### added code to save the env variable LANG and set it temporary to C
####
#### 1.22.9 20.09.2006 /bs
#### corrected code to save the env variable LANG and set it temporary to C
####
#### 1.22.10 21.09.2006 /bs
#### cleanup comments
#### the number of temporary files created automatically is now variable
#### (see the variable __NO_OF_TEMPFILES)
#### added code to install the trap handler in all functions
####
#### 1.22.11 19.10.2006 /bs
#### corrected a minor bug in AskUser (/c was not interpreted by echo)
#### corrected a bug in the handling of the parameter -S (-S was ignored)
####
#### 1.22.12 31.10.2006 /bs
#### added the variable __REQUIRED_ZONE
####
#### 1.22.13 13.11.2006 /bs
#### the template now uses TMP or TEMP if set for the temporary files
####
#### 1.22.14 14.11.2006 /bs
#### corrected a bug in the function AskUser (the default was y not n)
####
#### 1.22.15 21.11.2006 /bs
#### added initial support for other Operating Systems
####
#### 1.22.16 05.07.2007 /bs
#### enhanced initial support for other Operating Systems
#### Support for other OS is still not fully tested!
####
#### 1.22.17 06.07.2007 /bs
#### added the global variable __TRAP_SIGNAL
####
#### 1.22.18 01.08.2007 /bs
#### __OS_VERSION and __OS_RELEASE were not set - corrected
####
#### 1.22.19 04.08.2007 /bs
#### wrong function used to print "__TRAP_SIGNAL is \"${__TRAP_SIGNAL}\"" - fixed
####
#### 1.22.20 12.09.2007 /bs
#### the script now checks the ksh version if running on Solaris
#### made some changes for compatibility with ksh93
####
#### 1.22.21 18.09.2007 /bs (BigAdmin Version 2)
#### added the variable __FINISHROUTINES
#### changed __REQUIRED_ZONE to __REQUIRED_ZONES
#### added the variable __KSH_VERSION
#### reworked the trap handling
####
#### 1.22.22 23.09.2007 /bs
#### added the signal handling for SIGUSR1 and SIGUSR2 (variables __SIGUSR1_FUNC and __SIGUSR2_FUNC)
#### added user defined function for the signals HUP, BREAK, TERM, QUIT, EXIT, USR1 and USR2
#### added the variables __WARNING_PREFIX, __ERROR_PREFIX, __INFO_PREFIX, and __RUNTIME_INFO_PREFIX
#### the parameter -T or --tee can now be on any position in the parameters
#### the default output file if called with -T or --tee is now
#### /var/tmp/${0##*/}.$$.tee.log
####
#### 1.22.23 25.09.2007 /bs
#### added the environment variables __INFO_PREFIX, __WARNING_PREFIX,
#### __ERROR_PREFIX, and __RUNTIME_INFO_PREFIX
#### added the environment variable __DEBUG_HISTFILE
#### reworked the function to print the usage help :
#### use "-h -v" to view the extented usage help and use "-h -v -v" to
#### view the environment variables used also
####
#### 1.22.24 05.10.2007 /bs
#### another minor fix for ksh93 compatibility
####
#### 1.22.25 08.10.2007 /bs
#### only spelling errors corrected
####
#### 1.22.26 19.11.2007 /bs
#### only spelling errors corrected
####
#### 1.22.27 29.12.2007 /bs
#### improved the code to create the lockfile (thanks to wpollock for the info; see credits above)
#### improved the code to create the temporary files (thanks to wpollock for the info; see credits above)
#### added the function rand (thanks to wpollock for the info; see credits above)
#### the script now uses the directory name saved in the variable $TMPDIR for temporary files
#### if it's defined
#### now the umask used for creating temporary files can be changed (via variable __TEMPFILE_UMASK)
####
#### 1.22.28 12.01.2008 /bs
#### corrected a syntax error in the show usage routine
#### added the function PrintWithTimestamp (see credits above)
####
#### 1.22.29 31.01.2008 /bs
#### there was a bug in the new code to remove the lockfile which prevented
#### the script from removing the lockfile at program end
#### if the lockfile already exist the script printed not the correct error
#### message
####
#### 1.22.30 28.02.2008 /bs
#### Info update: executeCommandAndLog does NOT return the RC of the executed
#### command if a logfile is defined
#### added inital support for CYGWIN
#### (tested with CYGWIN_NT-5.1 v..1.5.20(0.156/4/2)
#### Most of the internal functions are NOT tested yet in CYGWIN
#### GetCurrentUID now supports UIDs greater than 254; the function now prints the UID to STDOUT
#### Corrected bug in GetUserName (only a workaround, not the solution)
#### now using printf in the AskUserRoutine
####
#### 1.22.30 28.02.2008 /bs
#### The lockfile is now also deleted if the script crashes because of a syntax error or something like this
####
#### 1.22.31 18.03.2008 /bs
#### added the version number to the start and end messages
#### an existing config file is now removed (and not read) if the script is called with -C to create a config file
####
#### 1.22.32 04.04.2008 /bs
#### minor changes for zone support
####
#### 1.22.33 12.02.2009 /bs
#### disabled the usage of prtdiag due to the fact that prtdiag on newer Sun machines needs a long time to run
#### (-> __MACHINE_SUBTYPE is now always empty for Solaris machines)
#### added the variable __CONFIG_FILE_FOUND; this variable contains the name of the config file
#### read if a config file was found
#### added the variable __CONFIG_FILE_VERSION
####
#### 1.22.34 28.02.2009 /bs
#### added code to check for the max. line no for the debug handler
#### (an array in ksh88 can only handle up to 4096 entries)
#### added the variable __PIDFILE
####
#### 1.22.35 06.04.2009 /bs
#### added the variables
#### __NO_CLEANUP
#### __NO_EXIT_ROUTINES
#### __NO_TEMPFILES_DELETE
#### __NO_TEMPMOUNTS_UMOUNT
#### __NO_TEMPDIR_DELETE
#### __NO_FINISH_ROUTINES
#### __CLEANUP_ON_ERROR
#### CONFIG_FILE
####
#### 1.22.36 11.04.2009 /bs
#### corrected a cosmetic error in the messages (wrong: ${TEMPFILE#} correct: ${__TEMPFILE#})
####
#### 1.22.37 08.07.2011
#### corrected a minor error with the QUIET parameter
#### added code to dump the environment (env var __CREATE_DUMP, function CreateDump )
#### implemented work around for missing function whence in bash
#### added the function LogIfNotVerbose
####
#### 1.22.38 22.07.2011
#### added code to make the trap handling also work in bash
#### added a sample user defined trap handler (function USER_SIGNAL_HANDLER)
#### added the function SetHousekeeping to enabe or disable house keeping
#### scriptt.sh did not write all messages to the logfile if a relative filename was used - fixed
#### added more help text for "-v -v -v -h"
#### now user defined signal handler can have arguments
#### the RBAC feature (__USE_RBAC) did not work as expected - fixed
#### added new scriptt testsuite for testing the script template on other OS and/or shells
#### added the function SaveEnvironmentVariables
####
#### 1.22.39 24.07.2011
#### __INIT_FUNCTION now enable for cygwin also
#### __SHELL did not work in all Unixes - fixed
#### __OS_FULLNAME is now also set in Solaris and Linux
####
#### 1.22.40 25.07.2011
#### added some code for ksh93 (functions: substr)
#### Note: set __USE_ONLY_KSH88_FEATURES to ${__TRUE} to suppress using the ksh93 features
#### The default action for the signal handler USR1 is now "Create an env dump in /var/tmp"
#### The filenames for the dumps are
####
#### /var/tmp/<scriptname>.envvars.dump_no_<no>_<PID>
#### /var/tmp/<scriptname>.exported_envvars.dump_no_<no>_<PID>
####
#### where <no> is a sequential number, <PID> is the PID of the process with the script,
#### and <scriptname> is the name of the script without the path.
####
#### ----------------
#### Version variables
####
#### __SCRIPT_VERSION - the version of your script
####
####
typeset -r __SCRIPT_VERSION="v0.0.5"
####
#### __SCRIPT_TEMPLATE_VERSION - version of the script template
####
typeset -r __SCRIPT_TEMPLATE_VERSION="1.22.40 25.07.2011"
####
#### ----------------
####
##R# Predefined return codes:
##R# ------------------------
##R#
##R# 1 - show usage and exit
##R# 2 - invalid parameter found
##R#
##R# 210 - 235 reserved for the runtime system
##R# 236 - syntax error
##R# 237 - script file has to many lines for the debug handler
##R# 238 - unsupported Operating system
##R# 239 - script runs in a not supported zone
##R# 240 - internal error
##R# 241 - a command ended with an error (set -e is necessary to activate this trap)
##R# 242 - the current user is not allowed to execute this script
##R# 243 - invalid machine architecture
##R# 244 - invalid processor type
##R# 245 - invalid machine platform
##R# 246 - error writing the config file
##R# 247 - include script not found
##R# 248 - unsupported OS version
##R# 249 - Script not executed by root
##R# 250 - Script is already running
##R#
##R# 251 - QUIT signal received
##R# 252 - User break
##R# 253 - TERM signal received
##R# 254 - unknown external signal received
##R#
#### ----------------
#### Used environment variables
####
#
# The variable __USED_ENVIRONMENT_VARIABLES is used in the function ShowUsage
#
__USED_ENVIRONMENT_VARIABLES="
#### __DEBUG_CODE
#### __RT_VERBOSE_LEVEL
#### __QUIET_MODE
#### __VERBOSE_MODE
#### __VERBOSE_LEVEL
#### __OVERWRITE_MODE
#### __USER_BREAK_ALLOWED
#### __NO_TIME_STAMPS
#### __NO_HEADERS
#### __USE_COLORS
#### __USE_RBAC
#### __RBAC_BINARY
#### __TEE_OUTPUT_FILE
#### __INFO_PREFIX
#### __WARNING_PREFIX
#### __ERROR_PREFIX
#### __RUNTIME_INFO_PREFIX
#### __DEBUG_HISTFILE
#### __NO_CLEANUP
#### __NO_EXIT_ROUTINES
#### __NO_TEMPFILES_DELETE
#### __NO_TEMPMOUNTS_UMOUNT
#### __NO_TEMPDIR_DELETE
#### __NO_FINISH_ROUTINES
#### __CLEANUP_ON_ERROR
#### __CREATE_DUMP
#### __DUMP_ALREADY_CREATED
#### __DUMPDIR
#### __USE_ONLY_KSH88_FEATURES
#### CONFIG_FILE
"
####
#
# binaries and scripts used in this script:
#
# basename cat cp cpio cut date dd dirname egrep expr find grep id ln ls nawk pwd
# reboot rm sed sh tee touch tty umount uname who zonename
#
# ksh if running in a shell without builtin whence
#
# /usr/bin/pfexec
# /usr/ucb/whoami or $( whence whoami )
# /usr/openwin/bin/resize or $( whence resize )
#
# AIX: oslevel
#
# -----------------------------------------------------------------------------
# variables for the trap handler
__FUNCTION="main"
# alias to install the trap handler
#
# Note: The statement LINENO=${LINENO} is necessary to use the variable LINENO in the trap command
#
alias __settrap="
LINENO=\${LINENO}
trap 'GENERAL_SIGNAL_HANDLER SIGHUP \${LINENO} \${__FUNCTION}' 1
trap 'GENERAL_SIGNAL_HANDLER SIGINT \${LINENO} \${__FUNCTION}' 2
trap 'GENERAL_SIGNAL_HANDLER SIGQUIT \${LINENO} \${__FUNCTION}' 3
trap 'GENERAL_SIGNAL_HANDLER SIGTERM \${LINENO} \${__FUNCTION}' 15
trap 'GENERAL_SIGNAL_HANDLER SIGUSR1 \${LINENO} \${__FUNCTION}' USR1
trap 'GENERAL_SIGNAL_HANDLER SIGUSR2 \${LINENO} \${__FUNCTION}' USR2
"
#### ----------------
#### ##### general hints
####
#### Do not use variable names beginning with __ (these are reserved for
#### internal use)
####
# save the language setting and switch the language temporary to C
#
__SAVE_LANG="${LANG}"
LANG=C
export LANG
# -----------------------------------------------------------------------------
#### ##### constants
####
#### __TRUE - true (0)
#### __FALSE - false (1)
####
####
typeset -r __TRUE=0
typeset -r __FALSE=1
# -----------------------------------------------------------------------------
#### __KSH_VERSION - ksh version (either 88 or 93)
#### If the script is not executed by ksh the shell is compatible to
### ksh version $__KSH_VERSION
####
__KSH_VERSION=88 ; f() { typeset __KSH_VERSION=93 ; } ; f ;
# use ksh93 features?
#
if [ "${__KSH_VERSION}"x = "93"x ] ; then
__USE_ONLY_KSH88_FEATURES=${__USE_ONLY_KSH88_FEATURES:=${__FALSE}}
else
__USE_ONLY_KSH88_FEATURES=${__USE_ONLY_KSH88_FEATURES:=${__TRUE}}
fi
#### __OS - Operating system (e.g. SunOS)
####
__OS="$( uname -s )"
# -----------------------------------------------------------------------------
# specific settings for the various operating systems and shells
#
case ${__OS} in
CYGWIN* )
set +o noclobber
__SHELL_FIELD=9
;;
SunOS | AIX )
__SHELL_FIELD=9
;;
* )
__SHELL_FIELD=8
;;
esac
# -----------------------------------------------------------------------------
# specific settings for various shells
#
#### __SHELL - name of the current shell executing this script
####
__SHELL="$( ps -f -p $$ | grep -v PID | tr -s " " | cut -f${__SHELL_FIELD} -d " " )"
__SHELL=${__SHELL##*/}
: ${__SHELL:=ksh}
case "${__SHELL}" in
"bash" )
# set shell options for alias expanding if running in bash
shopt -s expand_aliases
;;
esac
# -----------------------------------------------------------------------------
# define whence if necessary
#
whence whence 2>/dev/null 1>/dev/null || function whence { ksh whence -p $* ; }
# -----------------------------------------------------------------------------
#### ----------------
#### internal variables
####
#### __TRAP_SIGNAL - current trap caught by the trap handler
#### This is a global variable that can be used in the exit routines
####
__TRAP_SIGNAL=""
# -----------------------------------------------------------------------------
#### __USE_RBAC - set this variable to ${__TRUE} to execute this script
#### with RBAC
#### default is ${__FALSE}
####
#### Note: You can also set this environment variable before starting the script
####
: ${__USE_RBAC:=${__FALSE}}
# -----------------------------------------------------------------------------
#### __RBAC_BINARY - pfexec binary
####
#### default is /usr/bin/pfexec
####
#### Note: You can also set this environment variable before starting the script
####
: ${__RBAC_BINARY:=/usr/bin/pfexec}
# -----------------------------------------------------------------------------
#
# user executing this script (works only if using a ssh session with specific
# ssh versions that export these variables!)
#
SCRIPT_USER="$( echo $SSH_ORIGINAL_USER | tr "=" " " | cut -f 5 -d " " )"
SCRIPT_USER_MSG="${SCRIPT_USER}"
# -----------------------------------------------------------------------------
#### __TEE_OUTPUT_FILE - name of the output file if called with the parameter -T
#### default: /var/tmp/$( basename $0 ).$$.tee.log
####
#### Note: You can also set this environment variable before starting the script
####
: ${__TEE_OUTPUT_FILE:=/var/tmp/${0##*/}.$$.tee.log}
# -----------------------------------------------------------------------------
# process the parameter -q or --quiet
#
if [[ \ $*\ == *\ -q* || \ $*\ == *\ --quiet\ * ]] ; then
__NO_HEADERS=${__TRUE}
__QUIET_MODE=${__TRUE}
fi
# -----------------------------------------------------------------------------
# config file found or not
#
__CONFIG_FILE_FOUND=""
# -----------------------------------------------------------------------------
# use the parameter -T or --tee to automatically call the script and pipe
# all output to tee
if [ "${__PPID}"x = ""x ] ; then
__PPID=$PPID ; export __PPID
if [[ \ $*\ == *\ -T* || \ $*\ == *\ --tee\ * ]] ; then
echo "Saving STDOUT and STDERR to \"${__TEE_OUTPUT_FILE}\" ..."
exec $0 $@ 2>&1 | tee -a "${__TEE_OUTPUT_FILE}"
__MAINRC=$?
echo "STDOUT and STDERR saved in \"${__TEE_OUTPUT_FILE}\"."
exit ${__MAINRC}
fi
fi
: ${__PPID:=$PPID} ; export __PPID
# -----------------------------------------------------------------------------
#
# Set the variable ${__USE_RBAC} to ${__TRUE} to activate RBAC support
#
# Allow the use of RBAC to control who can access this script. Useful for
# administrators without root permissions
#
if [ "${__USE_RBAC}" = "${__TRUE}" ] ; then
if [ "$_" != "${__RBAC_BINARY}" -a -x "${__RBAC_BINARY}" ]; then
__USE_RBAC=${__FALSE} "${__RBAC_BINARY}" $0 $*
exit $?
else
echo "${0%%*/} ERROR: \"${__RBAC_BINARY}\" not found or not executable!" >&2
exit 238
fi
fi
# -----------------------------------------------------------------------------
####
#### ##### defined variables that may be changed
####
#### __DEBUG_CODE - code executed at start of every sub routine
#### Note: Use always "__DEBUG_CODE="eval ..." if you want to use variables or aliases
#### Default debug code : none
####
# __DEBUG_CODE=""
#### __FUNCTION_INIT - code executed at start of every sub routine
#### (see the hints for __DEBUG_CODE)
#### Default init code : install the trap handlers
####
# __FUNCTION_INIT=" eval __settrap; echo \"Now in function \${__FUNCTION}\" "
__FUNCTION_INIT=" eval __settrap "
## variables for debugging
##
## __NO_CLEANUP - do not call the cleanup routine at all at script end if ${__TRUE}
##
: ${__NO_CLEANUP:=${__FALSE}}
#### __NO_EXIT_ROUTINES - do not execute the exit routines if ${__TRUE}
####
: ${__NO_EXIT_ROUTINES:=${__FALSE}}
#### __NO_TEMPFILES_DELETE - do not remove temporary files at script end if ${__TRUE}
####
: ${__NO_TEMPFILES_DELETE:=${__FALSE}}
#### __NO_TEMPMOUNTS_UMOUNT - do not umount temporary mount points at script end if ${__TRUE}
####
: ${__NO_TEMPMOUNTS_UMOUNT:=${__FALSE}}
#### __NO_TEMPDIR_DELETE - do not remove temporary directories at script end if ${__TRUE}
####
: ${__NO_TEMPDIR_DELETE:=${__FALSE}}
#### __NO_FINISH_ROUTINES - do not execute the finish routeins at script end if ${__TRUE}
####
: ${__NO_FINISH_ROUTINES:=${__FALSE}}
#### __CLEANUP_ON_ERROR - call cleanup if the script was aborted by a syntax error
####
: ${__CLEANUP_ON_ERROR:=${__FALSE}}
####
#### sample debug code:
#### __DEBUG_CODE=" eval echo Entering the subroutine \${__FUNCTION} ... "
####
#### Note: Use an include script for more complicate debug code, e.g.
#### __DEBUG_CODE=" eval . /var/tmp/mydebugcode"
####
#### __CONFIG_PARAMETER
#### The variable __CONFIG_PARAMETER contains the configuration variables
####
#### The defaults for these variables are defined here. You
#### can use a config file to overwrite the defaults.
####
#### Use the parameter -C to create a default configuration file
####
#### Note: The config file is read and interpreted via ". configfile"
#### therefore you can also add some code her
####
__CONFIG_PARAMETER="__CONFIG_FILE_VERSION=\"${__SCRIPT_VERSION}\"
"'
# extension for backup files
DEFAULT_BACKUP_EXTENSION=".$$.backup"
#### __DUMP_ALREADY_CREATED - do not automatically create another dump if
#### this variable is ${__TRUE}
####
# __DUMP_ALREADY_CREATED=${__TRUE}
#### __CREATE_DUMP - create an environment dump if the scripts exits with
#### error
#### (replace <dumpdir> with either 0 or the directory for
#### the dumps) to always create a dump at script end
####
# __CREATE_DUMP=<dumpdir>
#### DEFAULT_DUMPDIR - default directory for environment dumps
####
DEFAULT_DUMP_DIR="${TMPDIR:-${TMP:-${TEMP:-/tmp}}}"
## Do not delete the dtrace script at script end if ${__TRUE}
##
DEFAULT_KEEP_DTRACE_SCRIPT=${__FALSE}
## add probe descriptions to the dtrace script if ${__TRUE}
##
DEFAULT_ADD_PROBE_DESC=${__FALSE}
## trace for a specified duration only (0 = trace until aborted with CTRL-C)
##
DEFAULT_TIME_TO_DTRACE="0"
## trace only these pids
##
DEFAULT_PIDS_TO_DTRACE=""
## trace only this command (Note: Use a script if parameter for the command are required!)
##
DEFAULT_CMD_TO_DTRACE=""
## print arg0 of the dtraced function?
##
DEFAULT_PRINT_ARG0=${__TRUE}
## log dtrace ouptut to a file
##
DEFAULT_LOG_FILE_FOR_DTRACE=""
## dtrace endless ?
##
DEFAULT_DTRACE_ENDLESS=${__FALSE}
## log file intervall for endless dtracing
##
DEFAULT_ENDLESS_DTRACE_LOG_INTERVALL="1h"
## add. clauses
##
DEFAULT_ADD_CLAUSE=""
## add. commands to execute in the dtrace script
##
DEFAULT_ADD_DTRACE_CMDS=""
## default printf statements for probes with a char * arg0
##
DEFAULT_TRACE_INSTRUCTIONS_WITH_ARG0="
printf( \"### %10s Binary: %16s Parameter: %16s (pwd: %10s) UID: %6d PID: %6d PPID: %6d Time: %Y \n \", probefunc, execname, copyinstr(arg0), cwd, curthread->t_procp->p_parent->p_cred->cr_uid, pid, ppid, walltimestamp );
printf(\"### Parent Binary: %16s, Parent Parameter: %16s, Parent UID: %6d\n\n \", curthread->t_procp->p_parent->p_parent->p_user.u_comm, stringof(curthread->t_procp->p_parent->p_user.u_psargs), curthread->t_procp->p_parent->p_parent->p_cred->cr_uid );
"
## default printf statements for probes without a char * arg0
##
TRACE_INSTRUCTIONS_WITHOUT_ARG0="
printf( \"### %10s Binary: %16s (pwd: %10s) UID: %6d PID: %6d PPID: %6d Time: %Y \n\", probefunc, execname, cwd, curthread->t_procp->p_parent->p_cred->cr_uid, pid, ppid, walltimestamp );
printf( \"### Parent Binary: %16s, Parent Parameter: %16s, Parent UID: %6d\n\n \", curthread->t_procp->p_parent->p_parent->p_user.u_comm, stringof(curthread->t_procp->p_parent->p_user.u_psargs), curthread->t_procp->p_parent->p_parent->p_cred->cr_uid );
"
# only change the following variables if you know what you are doing #
# no further internal variables defined yet
#
# Note you can redefine any variable that is initialized before calling
# ReadConfigFile here!
'
# end of config parameters
#### __SHORT_DESC - short description (for help texts, etc)
#### Change to your need
####
typeset -r __SHORT_DESC="dtrace one or more system calls"
#### __LONG_USAGE_HELP - Additional help if the script is called with
#### the parameter "-v -h"
####
#### Note: To use variables in the help text use the variable name without
#### an escape character, eg. ${OS_VERSION}
####
__LONG_USAGE_HELP='
-k|+k - do/do not delete the drace script used; current value: $( ConvertToYesNo ${KEEP_DTRACE_SCRIPT} ) )
Long format: --keep_dtrace_script / ++keep_dtrace_script
-K|+K - do/do not add probe descriptions to the dtrace script; current value: $( ConvertToYesNo ${ADD_PROBE_DESC} ) )
Long format: --add_probe_desc
-t n - trace only n sec/min/hours; current value: ${TIME_TO_DTRACE};
use 0 to trace until stopped with CTRL-C
Long format: --time_to_trace
-p n - trace only the PID n; this parameter can be used more than one time
current value: ${PIDS_TO_DTRACE}
Long format: --pid
-c cmd - trace only the command cmd
current value: ${CMD_TO_DTRACE}
Long format: --cmd
Note: Use either -p or -c but not both; for commands with parameter use a script
-P|+P - print arg0 of the dtraced function(s); current value: $( ConvertToYesNo ${PRINT_ARG0} )
Long format: --printarg0
-L logfile
- log file for dtrace messages
current value: ${LOG_FILE_FOR_DTRACE}
Long format: --dtrace_logfile
-i clause
- add. clause for dtrace
current value: ${ADD_CLAUSE}
Long format: --add_clause
-d dtrace_commands
- add. dtrace commands
current value: ${ADD_DTRACE_CMDS}
Long format: --add_drace_cmds
-e|+e - log endless
current value: $( ConvertToYesNo ${DTRACE_ENDLESS} )
Long format: --endless
-X - view examples and exit
Long format: --list_examples
'
#### __SHORT_USAGE_HELP - Additional help if the script is called with the parameter "-h"
####
#### Note: To use variables in the help text use the variable name without an escape
#### character, eg. ${OS_VERSION}
####
__SHORT_USAGE_HELP='
[-X] [-k|+k] [-K|+K] [-t n] [-p n] [-P|+P] [-c cmd] [-i clause]
[-L dtracelogfile] [-d drace_cmds] [-e|+e] [sysfunction1] [... [sysfunction#] ]
'
#### __MUST_BE_ROOT - run script only by root (def.: false)
#### set to ${__TRUE} for scripts that must be executed by root only
####
__MUST_BE_ROOT=${__TRUE}
#### __REQUIRED_USERID - required userid to run this script (def.: none)
#### use blanks to separate multiple userids
#### e.g. "oracle dba sysdba"
#### "" = no special userid required
####
__REQUIRED_USERID=""
#### __REQUIRED_ZONES - required zones (either global, non-global or local
#### or the names of the valid zones)
#### (def.: none)
#### "" = no special zone required
####