OwlCyberSecurity - MANAGER

Edit File: mdflush.bt

#!/usr/bin/env bpftrace /* * mdflush Trace md flush events. * For Linux, uses bpftrace and eBPF. * * USAGE: mdflush.bt * * This is a bpftrace version of the bcc tool of the same name. * * For Linux 5.12+ (see tools/old for script for lower versions). * * Copyright 2018 Netflix, Inc. * Licensed under the Apache License, Version 2.0 (the "License") * * 08-Sep-2018 Brendan Gregg Created this. */ #ifndef BPFTRACE_HAVE_BTF #include <linux/blkdev.h> #include <linux/bio.h> #endif BEGIN { printf("Tracing md flush events... Hit Ctrl-C to end.\n"); printf("%-8s %-6s %-16s %s\n", "TIME", "PID", "COMM", "DEVICE"); } kprobe:md_flush_request { time("%H:%M:%S "); printf("%-6d %-16s %s\n", pid, comm, ((struct bio *)arg1)->bi_bdev->bd_disk->disk_name); }