OwlCyberSecurity - MANAGER

Edit File: killsnoop.bt

#!/usr/bin/env bpftrace /* * killsnoop Trace signals issued by the kill() syscall. * For Linux, uses bpftrace and eBPF. * * USAGE: killsnoop.bt * * Also a basic example of bpftrace. * * This is a bpftrace version of the bcc tool of the same name. * * Copyright 2018 Netflix, Inc. * Licensed under the Apache License, Version 2.0 (the "License") * * 07-Sep-2018 Brendan Gregg Created this. */ BEGIN { printf("Tracing kill() signals... Hit Ctrl-C to end.\n"); printf("%-15s %7s %-16s %4s %6s %s\n", "TIME", "PID", "COMM", "SIG", "TPID", "RESULT"); } tracepoint:syscalls:sys_enter_kill { @tpid[tid] = args.pid; @tsig[tid] = args.sig; } tracepoint:syscalls:sys_exit_kill /@tpid[tid]/ { printf("%-15s %7d %-16s %4d %6d %6d\n", strftime("%H:%M:%S.%f", nsecs), pid, comm, @tsig[tid], @tpid[tid], args.ret); delete(@tpid[tid]); delete(@tsig[tid]); }