Gecko [ www.jobworksschool.com ]

Name	Size	Permission	Date
lib	[ DIR ]	drwxr-xr-x	2025-11-05 21:34
argdist_example.txt	22.49 KB	-rw-r--r--	2023-12-08 15:36
bashreadline_example.txt	882 B	-rw-r--r--	2023-12-08 15:36
bindsnoop_example.txt	4.42 KB	-rw-r--r--	2023-12-08 15:36
biolatency_example.txt	23.46 KB	-rw-r--r--	2023-12-08 15:36
biolatpcts_example.txt	2.97 KB	-rw-r--r--	2023-12-08 15:36
biopattern_example.txt	1.37 KB	-rw-r--r--	2023-12-08 15:36
biosnoop_example.txt	3.47 KB	-rw-r--r--	2023-12-08 15:36
biotop_example.txt	9.11 KB	-rw-r--r--	2023-12-08 15:36
bitesize_example.txt	4.98 KB	-rw-r--r--	2023-12-08 15:36
bpflist_example.txt	2.13 KB	-rw-r--r--	2023-12-08 15:36
btrfsdist_example.txt	9.32 KB	-rw-r--r--	2023-12-08 15:36
btrfsslower_example.txt	6.65 KB	-rw-r--r--	2023-12-08 15:36
cachestat_example.txt	3.92 KB	-rw-r--r--	2023-12-08 15:36
cachetop_example.txt	3.83 KB	-rw-r--r--	2023-12-08 15:36
capable_example.txt	6.5 KB	-rw-r--r--	2023-12-08 15:36
cobjnew_example.txt	2.97 KB	-rw-r--r--	2023-12-08 15:36
compactsnoop_example.txt	9.92 KB	-rw-r--r--	2023-12-08 15:36
cpudist_example.txt	16.48 KB	-rw-r--r--	2023-12-08 15:36
cpuunclaimed_example.txt	15.2 KB	-rw-r--r--	2023-12-08 15:36
criticalstat_example.txt	4.81 KB	-rw-r--r--	2023-12-08 15:36
cthreads_example.txt	2.08 KB	-rw-r--r--	2023-12-08 15:36
dbslower_example.txt	3.89 KB	-rw-r--r--	2023-12-08 15:36
dbstat_example.txt	6.5 KB	-rw-r--r--	2023-12-08 15:36
dcsnoop_example.txt	4.27 KB	-rw-r--r--	2023-12-08 15:36
dcstat_example.txt	3.26 KB	-rw-r--r--	2023-12-08 15:36
deadlock_example.txt	16.25 KB	-rw-r--r--	2023-12-08 15:36
dirtop_example.txt	4.98 KB	-rw-r--r--	2023-12-08 15:36
drsnoop_example.txt	5 KB	-rw-r--r--	2023-12-08 15:36
execsnoop_example.txt	6.64 KB	-rw-r--r--	2023-12-08 15:36
exitsnoop_example.txt	6.22 KB	-rw-r--r--	2023-12-08 15:36
ext4dist_example.txt	8.78 KB	-rw-r--r--	2023-12-08 15:36
ext4slower_example.txt	11.07 KB	-rw-r--r--	2023-12-08 15:36
filegone_example.txt	743 B	-rw-r--r--	2023-12-08 15:36
filelife_example.txt	2.04 KB	-rw-r--r--	2023-12-08 15:36
fileslower_example.txt	5.58 KB	-rw-r--r--	2023-12-08 15:36
filetop_example.txt	6.8 KB	-rw-r--r--	2023-12-08 15:36
funccount_example.txt	13.29 KB	-rw-r--r--	2023-12-08 15:36
funcinterval_example.txt	15.28 KB	-rw-r--r--	2023-12-08 15:36
funclatency_example.txt	20.98 KB	-rw-r--r--	2023-12-08 15:36
funcslower_example.txt	6.63 KB	-rw-r--r--	2023-12-08 15:36
gethostlatency_example.txt	1.29 KB	-rw-r--r--	2023-12-08 15:36
hardirqs_example.txt	37.05 KB	-rw-r--r--	2023-12-08 15:36
inject_example.txt	6.67 KB	-rw-r--r--	2023-12-08 15:36
javacalls_example.txt	3.91 KB	-rw-r--r--	2023-12-08 15:36
javaflow_example.txt	5.88 KB	-rw-r--r--	2023-12-08 15:36
javagc_example.txt	3.78 KB	-rw-r--r--	2023-12-08 15:36
javaobjnew_example.txt	2.97 KB	-rw-r--r--	2023-12-08 15:36
javastat_example.txt	2.98 KB	-rw-r--r--	2023-12-08 15:36
javathreads_example.txt	2.08 KB	-rw-r--r--	2023-12-08 15:36
killsnoop_example.txt	1.31 KB	-rw-r--r--	2023-12-08 15:36
klockstat_example.txt	8.34 KB	-rw-r--r--	2023-12-08 15:36
kvmexit_example.txt	11.63 KB	-rw-r--r--	2023-12-08 15:36
llcstat_example.txt	3.24 KB	-rw-r--r--	2023-12-08 15:36
mdflush_example.txt	1.74 KB	-rw-r--r--	2023-12-08 15:36
memleak_example.txt	10.02 KB	-rw-r--r--	2023-12-08 15:36
mountsnoop_example.txt	1.45 KB	-rw-r--r--	2023-12-08 15:36
mysqld_qslower_example.txt	2.3 KB	-rw-r--r--	2023-12-08 15:36
netqtop_example.txt	12.2 KB	-rw-r--r--	2023-12-08 15:36
nfsdist_example.txt	8.31 KB	-rw-r--r--	2023-12-08 15:36
nfsslower_example.txt	7.68 KB	-rw-r--r--	2023-12-08 15:36
nodegc_example.txt	3.78 KB	-rw-r--r--	2023-12-08 15:36
nodestat_example.txt	2.98 KB	-rw-r--r--	2023-12-08 15:36
offcputime_example.txt	19.2 KB	-rw-r--r--	2023-12-08 15:36
offwaketime_example.txt	37.36 KB	-rw-r--r--	2023-12-08 15:36
oomkill_example.txt	1.88 KB	-rw-r--r--	2023-12-08 15:36
opensnoop_example.txt	10.33 KB	-rw-r--r--	2023-12-08 15:36
perlcalls_example.txt	3.91 KB	-rw-r--r--	2023-12-08 15:36
perlflow_example.txt	5.88 KB	-rw-r--r--	2023-12-08 15:36
perlstat_example.txt	2.98 KB	-rw-r--r--	2023-12-08 15:36
phpcalls_example.txt	3.91 KB	-rw-r--r--	2023-12-08 15:36
phpflow_example.txt	5.88 KB	-rw-r--r--	2023-12-08 15:36
phpstat_example.txt	2.98 KB	-rw-r--r--	2023-12-08 15:36
pidpersec_example.txt	677 B	-rw-r--r--	2023-12-08 15:36
ppchcalls_example.txt	6.93 KB	-rw-r--r--	2023-12-08 15:36
profile_example.txt	31.08 KB	-rw-r--r--	2023-12-08 15:36
pythoncalls_example.txt	3.91 KB	-rw-r--r--	2023-12-08 15:36
pythonflow_example.txt	5.88 KB	-rw-r--r--	2023-12-08 15:36
pythongc_example.txt	3.78 KB	-rw-r--r--	2023-12-08 15:36
pythonstat_example.txt	2.98 KB	-rw-r--r--	2023-12-08 15:36
rdmaucma_example.txt	1.94 KB	-rw-r--r--	2023-12-08 15:36
readahead_example.txt	3.17 KB	-rw-r--r--	2023-12-08 15:36
reset-trace_example.txt	9.15 KB	-rw-r--r--	2023-12-08 15:36
rubycalls_example.txt	3.91 KB	-rw-r--r--	2023-12-08 15:36
rubyflow_example.txt	5.88 KB	-rw-r--r--	2023-12-08 15:36
rubygc_example.txt	3.78 KB	-rw-r--r--	2023-12-08 15:36
rubyobjnew_example.txt	2.97 KB	-rw-r--r--	2023-12-08 15:36
rubystat_example.txt	2.98 KB	-rw-r--r--	2023-12-08 15:36
runqlat_example.txt	31.3 KB	-rw-r--r--	2023-12-08 15:36
runqlen_example.txt	11.85 KB	-rw-r--r--	2023-12-08 15:36
runqslower_example.txt	2.13 KB	-rw-r--r--	2023-12-08 15:36
shmsnoop_example.txt	2.73 KB	-rw-r--r--	2023-12-08 15:36
slabratetop_example.txt	5.22 KB	-rw-r--r--	2023-12-08 15:36
sofdsnoop_example.txt	3.14 KB	-rw-r--r--	2023-12-08 15:36
softirqs_example.txt	11.02 KB	-rw-r--r--	2023-12-08 15:36
solisten_example.txt	2.3 KB	-rw-r--r--	2023-12-08 15:36
sslsniff_example.txt	6.74 KB	-rw-r--r--	2023-12-08 15:36
stackcount_example.txt	21.45 KB	-rw-r--r--	2023-12-08 15:36
statsnoop_example.txt	3.02 KB	-rw-r--r--	2023-12-08 15:36
swapin.txt	2.57 KB	-rw-r--r--	2023-12-08 15:36
swapin_example.txt	1.39 KB	-rw-r--r--	2023-12-08 15:36
syncsnoop_example.txt	387 B	-rw-r--r--	2023-12-08 15:36
syscount_example.txt	6.27 KB	-rw-r--r--	2023-12-08 15:36
tclcalls_example.txt	3.91 KB	-rw-r--r--	2023-12-08 15:36
tclflow_example.txt	5.88 KB	-rw-r--r--	2023-12-08 15:36
tclobjnew_example.txt	2.97 KB	-rw-r--r--	2023-12-08 15:36
tclstat_example.txt	2.98 KB	-rw-r--r--	2023-12-08 15:36
tcpaccept_example.txt	2.76 KB	-rw-r--r--	2023-12-08 15:36
tcpcong_example.txt	33.31 KB	-rw-r--r--	2023-12-08 15:36
tcpconnect_example.txt	6.27 KB	-rw-r--r--	2023-12-08 15:36
tcpconnlat_example.txt	2.55 KB	-rw-r--r--	2023-12-08 15:36
tcpdrop_example.txt	1.95 KB	-rw-r--r--	2023-12-08 15:36
tcplife_example.txt	6.83 KB	-rw-r--r--	2023-12-08 15:36
tcpretrans_example.txt	3.85 KB	-rw-r--r--	2023-12-08 15:36
tcprtt_example.txt	9.83 KB	-rw-r--r--	2023-12-08 15:36
tcpstates_example.txt	2.84 KB	-rw-r--r--	2023-12-08 15:36
tcpsubnet_example.txt	5.37 KB	-rw-r--r--	2023-12-08 15:36
tcpsynbl_example.txt	1.15 KB	-rw-r--r--	2023-12-08 15:36
tcptop_example.txt	5.75 KB	-rw-r--r--	2023-12-08 15:36
tcptracer_example.txt	1.98 KB	-rw-r--r--	2023-12-08 15:36
threadsnoop_example.txt	1.07 KB	-rw-r--r--	2023-12-08 15:36
tplist_example.txt	4.4 KB	-rw-r--r--	2023-12-08 15:36
trace_example.txt	21.62 KB	-rw-r--r--	2023-12-08 15:36
ttysnoop_example.txt	3.24 KB	-rw-r--r--	2023-12-08 15:36
vfscount_example.txt	2.17 KB	-rw-r--r--	2023-12-08 15:36
vfsstat_example.txt	1.66 KB	-rw-r--r--	2023-12-08 15:36
virtiostat_example.txt	2.62 KB	-rw-r--r--	2023-12-08 15:36
wakeuptime_example.txt	33.25 KB	-rw-r--r--	2023-12-08 15:36
xfsdist_example.txt	6.77 KB	-rw-r--r--	2023-12-08 15:36
xfsslower_example.txt	6.91 KB	-rw-r--r--	2023-12-08 15:36
zfsdist_example.txt	9.52 KB	-rw-r--r--	2023-12-08 15:36
zfsslower_example.txt	7.37 KB	-rw-r--r--	2023-12-08 15:36

Rename

Demonstrations of ttysnoop, the Linux eBPF/bcc version.

ttysnoop watches a tty or pts device, and prints the same output that is
appearing on that device. It can be used to mirror the output from a shell
session, or the system console.

Let's snoop /dev/pts/2:

# ./ttysnoop 2
<screen clears>
date
Sun Oct 16 01:28:47 UTC 2016
# uname -a
Linux bgregg-xenial-bpf-i-xxx 4.8.0-rc4-virtual #1 SMP Wed Aug 31 22:54:37 UTC 2016 x86_64 x86_64 x86_64 GNU/Linux
# df -h
Filesystem      Size  Used Avail Use% Mounted on
udev            7.4G     0  7.4G   0% /dev
tmpfs           1.5G   89M  1.4G   6% /run
/dev/xvda1      7.8G  4.5G  3.3G  59% /
tmpfs           7.4G     0  7.4G   0% /dev/shm
tmpfs           5.0M     0  5.0M   0% /run/lock
tmpfs           7.4G     0  7.4G   0% /sys/fs/cgroup
tmpfs           250M     0  250M   0% /run/shm
/dev/md0        160G   20G  141G  13% /mnt
tmpfs           1.5G     0  1.5G   0% /run/user/0
# ^C

What we're seeing is another shell session. The first line was "date" without
the shell prompt ("#") because we began tracing after the prompt was printed.
The other commands appeared, keystroke by keystroke, as the user was typing
them. Spooky!

Remember to Ctrl-C to exit ttysnoop.

To figure out which pts device number to use, you can check your own with "ps"
and other's with "w". For example:

# ps -p $$
  PID TTY          TIME CMD
 9605 pts/1    00:00:00 bash
# w
 01:26:37 up 9 days, 35 min,  2 users,  load average: 0.22, 0.22, 0.15
USER     TTY      FROM             LOGIN@   IDLE   JCPU   PCPU WHAT
root     pts/1    100.127.65.241   00:39    2.00s  0.33s  0.33s -bash
root     pts/2    100.127.65.241   00:40   16.00s  1.06s  1.06s -bash

So I'm pts/1, and there's another session that's pts/2.

This can also snoop tty devices using their full path. Eg, snooping the system
console:

# ./ttysnoop /dev/console
Oct 16 01:32:06 bgregg-xenial-bpf-i-xxx kernel: [780087.407428] bash (9888): drop_caches: 1
Oct 16 01:32:38 bgregg-xenial-bpf-i-xxx snmpd[2708]: Cannot statfs /sys/kernel/debug/tracing: Permission denied
Oct 16 01:33:32 bgregg-xenial-bpf-i-xxx snmpd[2708]: Cannot statfs /sys/kernel/debug/tracing: Permission denied
Oct 16 01:34:26 bgregg-xenial-bpf-i-xxx snmpd[2708]: Cannot statfs /sys/kernel/debug/tracing: Permission denied
^C

Neat!

USAGE:

# ./ttysnoop.py -h
usage: ttysnoop.py [-h] [-C] device

Snoop output from a pts or tty device, eg, a shell

positional arguments:
  device         path to a tty device (eg, /dev/tty0) or pts number

optional arguments:
  -h, --help      show this help message and exit
  -C, --noclear   don't clear the screen
  -s, --datasize  size of the transmitting buffer (default 256)
  -c, --datacount number of times ttysnop checks for data (default 16)

examples:
    ./ttysnoop /dev/pts/2          # snoop output from /dev/pts/2
    ./ttysnoop 2                   # snoop output from /dev/pts/2 (shortcut)
    ./ttysnoop /dev/console        # snoop output from the system console
    ./ttysnoop /dev/tty0           # snoop output from /dev/tty0
    ./ttysnoop /dev/pts/2 -s 1024  # snoop output from /dev/pts/2 with data size 1024
    ./ttysnoop /dev/pts/2 -c 2     # snoop output from /dev/pts/2 with 2 checks for 256 bytes of data in buffer
                                     (potentionaly retrieving 512 bytes)