sofdsnoop_example.txt

Demonstrations of sofdsnoop, the Linux eBPF/bcc version.

sofdsnoop traces FDs passed through unix sockets

# ./sofdsnoop.py
ACTION TID    COMM             SOCKET                    FD    NAME
SEND   2576   Web Content      24:socket:[39763]         51    /dev/shm/org.mozilla.ipc.2576.23874
RECV   2576   Web Content      49:socket:[809997]        51
SEND   2576   Web Content      24:socket:[39763]         58    N/A
RECV   2464   Gecko_IOThread   75:socket:[39753]         55

Every file descriptor that is passed via unix sockets os displayed
on separate line together with process info (TID/COMM columns),
ACTION details (SEND/RECV), file descriptor number (FD) and its
translation to file if available (NAME).

The file descriptor (fd) value is bound to a process. The SEND
lines display the fd value within the sending process. The RECV
lines display the fd value of the sending process. That's why
there's translation to name only on SEND lines, where we are
able to find it in task proc records.

This works by tracing sendmsg/recvmsg system calls to provide
the socket fds, and scm_send_entry/scm_detach_fds to provide
the file descriptor details.

A -T option can be used to include a timestamp column,
and a -n option to match on a command name. Regular
expressions are allowed.  For example, matching commands
containing "server" with timestamps:

# ./sofdsnoop.py -T -n Web
TIME(s)       ACTION TID    COMM             SOCKET                    FD    NAME
0.000000000   SEND   2576   Web Content      24:socket:[39763]         51    /dev/shm/org.mozilla.ipc.2576.25404 (deleted)
0.000413000   RECV   2576   Web Content      49:/dev/shm/org.mozilla.ipc.2576.25404 (deleted) 51
0.000558000   SEND   2576   Web Content      24:socket:[39763]         58    N/A
0.000952000   SEND   2576   Web Content      24:socket:[39763]         58    socket:[817962]


A -p option can be used to trace only selected process:

# ./sofdsnoop.py -p 2576 -T
TIME(s)       ACTION TID    COMM             SOCKET                    FD    NAME
0.000000000   SEND   2576   Web Content      24:socket:[39763]         51    N/A
0.000138000   RECV   2576   Web Content      49:N/A                    5
0.000191000   SEND   2576   Web Content      24:socket:[39763]         58    N/A
0.000424000   RECV   2576   Web Content      51:/dev/shm/org.mozilla.ipc.2576.25319 (deleted) 49

USAGE message:
usage: sofdsnoop.py [-h] [-T] [-p PID] [-t TID] [-n NAME] [-d DURATION]

Trace file descriptors passed via socket

optional arguments:
  -h, --help            show this help message and exit
  -T, --timestamp       include timestamp on output
  -p PID, --pid PID     trace this PID only
  -t TID, --tid TID     trace this TID only
  -n NAME, --name NAME  only print process names containing this name
  -d DURATION, --duration DURATION
                        total duration of trace in seconds

examples:
    ./sofdsnoop           # trace file descriptors passes
    ./sofdsnoop -T        # include timestamps
    ./sofdsnoop -p 181    # only trace PID 181
    ./sofdsnoop -t 123    # only trace TID 123
    ./sofdsnoop -d 10     # trace for 10 seconds only
    ./sofdsnoop -n main   # only print process names containing "main"