API tools faq
paste
Advertisement
devinteske

nfsiosnoop

devinteske
Jan 31st, 2020
1,321
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
Bash 13.17 KB | None | 0 0
raw download clone embed print report
  1. #!/bin/sh
  2. # vi: set ft=sh noet ts=8 sw=8 :: Vi/ViM
  3. ############################################################ IDENT(1)
  4. #
  5. # $Title: Script to snoop on NFS I/O under Linux $
  6. # $Copyright: 2020 Devin Teske. All rights reserved. $
  7. # $FrauBSD$
  8. #
  9. ############################################################ ENVIRONMENT
  10.  
  11. : "${USER:=$( id -nu )}" # Used to determine whether sudo(8) should be used
  12.  
  13. ############################################################ DEFAULTS
  14.  
  15. DEFAULT_TIME_FMT="%Y %b %e %T"
  16.  
  17. ############################################################ GLOBALS
  18.  
  19. VERSION='$Version: 3.0 $'
  20.  
  21. pgm="${0##*/}" # Program basename
  22.  
  23. #
  24. # Global exit status
  25. #
  26. SUCCESS=0
  27. FAILURE=1
  28.  
  29. #
  30. # Command-line options
  31. #
  32. DEBUG=              # -d
  33. QUIET=              # -q
  34. RAW_OUTPUT=         # -r
  35. TIME_FMT="$DEFAULT_TIME_FMT"    # -t fmt
  36. FILTER_GROUP=           # -g group
  37. FILTER_USER=            # -u user
  38. VERBOSE=            # -v
  39.  
  40. #
  41. # Miscellaneous
  42. #
  43. COMM=
  44. CONS=1
  45. [ -t 1 ] || CONS= # stdout is not a tty
  46. FILTER_GID=
  47. FILTER_UID=
  48. RAW_TIME_FMT='"%s"'
  49.  
  50. ############################################################ FUNCTIONS
  51.  
  52. if [ "$CONS" ]; then
  53. info(){ printf "\033[35mINFO\033[39m %s\n" "$*" >&2; }
  54. else
  55. info(){ printf "INFO %s\n" "$*" >&2; }
  56. fi
  57.  
  58. usage()
  59. {
  60.     local optfmt="\t%-11s %s\n"
  61.     exec >&2
  62.     printf "Usage: %s [OPTIONS] [comm]\n" "$pgm"
  63.     printf "Options:\n"
  64.     printf "$optfmt" "-d" "Debug. Print script and exit."
  65.     printf "$optfmt" "-h" "Print usage statement and exit."
  66.     printf "$optfmt" "-q" "Quiet. Hide dup*, open/close, and null r/w."
  67.     printf "$optfmt" "-r" "Show unformatted raw output."
  68.     printf "$optfmt" "-t fmt" "Time format. Default \`$DEFAULT_TIME_FMT'."
  69.     printf "$optfmt" "-u user" "Filter on user. Can be name or UID."
  70.     printf "$optfmt" "-g group" "Filter on group. Can be name or GID."
  71.     printf "$optfmt" "-V" "Print version and exit."
  72.     printf "$optfmt" "-v" "Verbose. Show filenames and hidden tracepoints."
  73.     exit $FAILURE
  74. }
  75.  
  76. lsofN()
  77. {
  78.     [ "$DEBUG" ] && return
  79.  
  80.     case "$USER" in
  81.     root) lsof -N +c 0 ;;
  82.     *) sudo lsof -N +c 0
  83.     esac
  84. }
  85.  
  86. run()
  87. {
  88.     if [ "$DEBUG" ]; then
  89.         cat
  90.         return
  91.     fi
  92.  
  93.     case "$USER" in
  94.     root) bpftrace -B none /dev/stdin "$@" ;;
  95.     *) sudo bpftrace -B none /dev/stdin "$@"
  96.     esac
  97. }
  98.  
  99. ############################################################ MAIN
  100.  
  101. #
  102. # Process command-line options
  103. #
  104. while getopts dg:hqrt:u:Vv flag; do
  105.     case "$flag" in
  106.     d) DEBUG=1 ;;
  107.     g) FILTER_GROUP="$OPTARG" ;;
  108.     q) QUIET=1 ;;
  109.     r) RAW_OUTPUT=1 ;;
  110.     t) TIME_FMT="$OPTARG" ;;
  111.     u) FILTER_USER="$OPTARG" ;;
  112.     V) VERSION="${VERSION#*: }"
  113.         echo "${VERSION% $}"
  114.         exit $SUCCESS ;;
  115.     v) VERBOSE=1 ;;
  116.     *) usage # NOTREACHED
  117.     esac
  118. done
  119. shift $(( $OPTIND - 1 ))
  120.  
  121. #
  122. # Process command-line arguments
  123. #
  124. COMM="$1"
  125.  
  126. #
  127. # Process user/group options
  128. #
  129. case "$FILTER_USER" in
  130. "") : leave-empty ;;
  131. *[!0-9]*) # Translate from name to UID
  132.     FILTER_UID=$(
  133.         getent passwd "$FILTER_USER" | awk -F: '{print $3}'
  134.     ) || exit
  135.     ;;
  136. *) # Translate from UID to name
  137.     FILTER_UID=$FILTER_USER
  138.     FILTER_USER=$(
  139.         getent passwd $FILTER_UID | awk -F: '{print $1}'
  140.     ) || exit
  141. esac
  142. case "$FILTER_GROUP" in
  143. "") : leave-empty ;;
  144. *[!0-9]*) # Translate from name to GID
  145.     FILTER_GID=$(
  146.         getent group "$FILTER_GROUP" | awk -F: '{print $3}'
  147.     ) || exit
  148.     ;;
  149. *) # Translate from GID to name
  150.     FILTER_GID=$FILTER_GROUP
  151.     FILTER_GROUP=$(
  152.         getent group $FILTER_GID | awk -F '{print $1}'
  153.     ) || exit
  154. esac
  155.  
  156. #
  157. # Inform the user what we are doing
  158. #
  159. [ "$DEBUG" ] || info "Tracing NFS... Hit Ctrl-C to end."
  160.  
  161. #
  162. # Run script
  163. # NB: M-x package-install [RET] dtrace-script-mode [RET]
  164. #
  165. {
  166.     # List current open connections
  167.     lsofN | awk \
  168.         -v filter_user="$FILTER_USER" \
  169.         -v timefmt="$TIME_FMT" \
  170.         -v verbose=${VERBOSE:-0} \
  171.     '################################################# BEGIN
  172.  
  173.     BEGIN {
  174.         if (timefmt != "") {
  175.             srand()
  176.             time = srand()
  177.         }
  178.     }
  179.  
  180.     ################################################## MAIN
  181.  
  182.     (type = $5) != "DIR" && (fd = $4) ~ /^[0-9]+[rwu-]$/ {
  183.         cmd = $1
  184.         pid = $2
  185.         user = $3
  186.         if (filter_user != "" && user != filter_user) next
  187.         filename = $0
  188.         sub("^[^/]*/", "/", filename)
  189.         sub(/ \([^)]+\)$/, "", filename)
  190.         if (verbose) {
  191.             printf "%s|enter_open|%s|%s|%u|%s\n",
  192.                 timefmt == "" ? "" : time,
  193.                 user, cmd, pid, filename
  194.         }
  195.         printf "%s|exit_open|%s|%s|%u|%d|1\n",
  196.             timefmt == "" ? "" : time, user, cmd, pid, fd
  197.     }
  198.     ' # END-QUOTE
  199.  
  200.     run "$@" <<EOF
  201.     /* -*- mode: dtrace-script; tab-width: 4 -*- ;; Emacs
  202.      * vi: set ft=dtrace noet ts=4 sw=4 :: Vi/ViM
  203.      */
  204.  
  205.     #include <linux/fs.h>
  206.     #include <linux/mount.h>
  207.  
  208.     /*
  209.      * open(2)/openat(2) [enter] probes
  210.      */
  211.  
  212. $( for func in sys_enter_open sys_enter_openat; do
  213.     name=${func#*enter_}
  214.     printf "\ttracepoint:syscalls:%s\n" $func
  215.     condition=
  216.     [ ! "$COMM" ] || condition="$condition && comm == str(\$1)"
  217.     [ ! "$FILTER_GID" ] || condition="$condition && gid == $FILTER_GID"
  218.     [ ! "$FILTER_UID" ] || condition="$condition && uid == $FILTER_UID"
  219.     [ ! "$condition" ] || printf "\t/%s/\n" "${condition# && }"
  220. cat <<PROBE
  221.     {
  222.         delete(@vfs_${name}_nfs[tid]); // Flag from vfs_open
  223.         @vfs_$name[tid] = 1; // Flag for vfs_open${VERBOSE:+
  224. `cat <<VERBOSE
  225. ${TIME_FMT:+
  226.         time($RAW_TIME_FMT);}
  227.         printf("|${func#sys_}|%d.%d|%s|%d|%s\n",
  228.             uid, gid, comm, pid, str(args->filename));
  229. VERBOSE`}
  230.     }
  231.  
  232. PROBE
  233. done )
  234.  
  235.     /*
  236.      * Kernel probes
  237.      * NB: vfs_open() always called after open(2)/openat(2)
  238.      */
  239.  
  240. $( for func in sys_enter_open sys_enter_openat; do
  241.     name=${func#*enter_}
  242.     exit_func=${func%%enter_*}exit_$name
  243. cat <<PROBE
  244.     kprobe:vfs_open
  245.     /@vfs_$name[tid]/
  246.     {
  247.         delete(@vfs_$name[tid]); // Flag from $func
  248.  
  249.         //
  250.         // Extract the filesystem type from mount superblock
  251.         //
  252.         \$path = (struct path *)arg0;
  253.         \$mnt = (struct vfsmount *)\$path->mnt;
  254.         \$mnt_sb = (struct super_block *)\$mnt->mnt_sb;
  255.         \$type = (struct file_system_type *)\$mnt_sb->s_type;
  256.         \$fstype = \$type->name;
  257.  
  258.         //
  259.         // Test for NFS
  260.         //
  261.         if (str(\$fstype) == "nfs") {
  262.             @vfs_${name}_nfs[tid] = 1; // Flag for $exit_func
  263.         }
  264.     }
  265.  
  266. PROBE
  267. done )
  268.  
  269.     /*
  270.      * open(2)/openat(2) [exit] probes
  271.      */
  272.  
  273. $( for func in sys_exit_open sys_exit_openat; do
  274.     name=${func#*exit_}
  275. cat <<PROBE
  276.     tracepoint:syscalls:$func
  277.     /@vfs_${name}_nfs[tid]/
  278.     {
  279.         delete(@vfs_${name}_nfs[tid]); // Flag from vfs_open
  280.  
  281.         \$ret = args->ret;
  282.         if (\$ret >= 0)
  283.         {
  284.             \$fd = (uint64)\$ret;
  285.  
  286.             // Set flag to trace read/write on fd
  287.             @trace[pid, \$fd] = 1;${VERBOSE:+
  288. `cat <<VERBOSE
  289. ${TIME_FMT:+
  290.             time($RAW_TIME_FMT);}
  291.             printf("|${func#sys_}|%d.%d|%s|%d|%d|1\n",
  292.                 uid, gid, comm, pid, \\\$fd);
  293.         }
  294.         else
  295.         {${TIME_FMT:+
  296.             time($RAW_TIME_FMT);}
  297.             printf("|${func#sys_}|%d.%d|%s|%d|%d|0\n",
  298.                 uid, gid, comm, pid, \\\$fd);
  299. VERBOSE`}
  300.         }
  301.     }
  302.  
  303. PROBE
  304. done )
  305.  
  306.     /*
  307.      * dup*(2) probes
  308.      */
  309.  
  310.     tracepoint:syscalls:sys_enter_dup
  311.     /@trace[pid, args->fildes]/
  312.     {
  313.         \$fd = (int64)args->fildes;
  314.  
  315.         @dup_fd[tid] = \$fd; // Pass to sys_exit_dup
  316.     }
  317.  
  318.     tracepoint:syscalls:sys_exit_dup
  319.     /@dup_fd[tid]/
  320.     {
  321.         \$oldfd = (int64)@dup_fd[tid];
  322.         \$newfd = (int64)args->ret;
  323.  
  324.         delete(@dup_fd[tid]); // Arg from sys_enter_dup
  325.  
  326.         if (\$oldfd != \$newfd)
  327.         {
  328.             // Set flag to trace read/write on fd
  329.             @trace[pid, \$newfd] = 1;
  330. ${TIME_FMT:+
  331.             time($RAW_TIME_FMT);}
  332.             printf("|dup|%d.%d|%s|%d|%d|",
  333.                 uid, gid, comm, pid, \$oldfd);
  334.             printf("%d\n", \$newfd);
  335.         }
  336.  
  337.     }
  338.  
  339.     tracepoint:syscalls:sys_enter_dup2
  340.     /@trace[pid, args->oldfd]/
  341.     {
  342.         \$oldfd = (int64)args->oldfd;
  343.         \$newfd = (int64)args->newfd;
  344.  
  345.         if (\$oldfd != \$newfd)
  346.         {
  347.             // Set flag to trace read/write on fd
  348.             @trace[pid, \$newfd] = 1;
  349. ${TIME_FMT:+
  350.             time($RAW_TIME_FMT);}
  351.             printf("|dup2|%d.%d|%s|%d|%d|",
  352.                 uid, gid, comm, pid, \$oldfd);
  353.             printf("%d\n", \$newfd);
  354.         }
  355.     }
  356.  
  357.     tracepoint:syscalls:sys_enter_dup3
  358.     /@trace[pid, args->oldfd]/
  359.     {
  360.         \$oldfd = (int64)args->oldfd;
  361.         \$newfd = (int64)args->newfd;
  362.  
  363.         if (\$oldfd != \$newfd)
  364.         {
  365.             // Set flag to trace read/write on fd
  366.             @trace[pid, \$newfd] = 1;
  367. ${TIME_FMT:+
  368.             time($RAW_TIME_FMT);}
  369.             printf("|dup3|%d.%d|%s|%d|%d|",
  370.                 uid, gid, comm, pid, \$oldfd);
  371.             printf("%d\n", \$newfd);
  372.         }
  373.     }
  374.  
  375.     /*
  376.      * close(2) probe
  377.      */
  378.  
  379.     tracepoint:syscalls:sys_enter_close
  380.     /@trace[pid, args->fd]/
  381.     {
  382.         \$fd = args->fd;
  383.  
  384.         delete(@trace[pid, \$fd]); // Stop tracing read/write on fd
  385. ${VERBOSE:+
  386. `cat <<VERBOSE
  387. ${TIME_FMT:+
  388.         time($RAW_TIME_FMT);}
  389.         printf("|close|%d.%d|%s|%d|%d\n", uid, gid, comm, pid, \\\$fd);
  390. VERBOSE`}
  391.     }
  392.  
  393.     /*
  394.      * Read/Write probes
  395.      */
  396.  
  397.     tracepoint:syscalls:sys_enter_read
  398.     /@trace[pid, args->fd]/
  399.     {
  400.         \$fd = args->fd;
  401.         \$count = args->count;
  402.  
  403.         // Pass args to sys_exit_read
  404.         @read_fd[tid] = \$fd;
  405.         @read_count[pid, \$fd] = \$count;
  406.     }
  407.  
  408.     tracepoint:syscalls:sys_exit_read
  409.     /@read_fd[tid]/
  410.     {
  411.         \$fd = @read_fd[tid];
  412.         \$count = @read_count[pid, \$fd];
  413.         \$ret = args->ret;
  414.  
  415.         // Args from sys_enter_read
  416.         delete(@read_fd[tid]);
  417.         delete(@read_count[pid, \$fd]);
  418. ${TIME_FMT:+
  419.         time($RAW_TIME_FMT);}
  420.         printf("|read|%d.%d|%s|%d|%d|", uid, gid, comm, pid, \$fd);
  421.         printf("%ld|%ld\n", \$count, \$ret);
  422.     }
  423.  
  424.     tracepoint:syscalls:sys_enter_write
  425.     /@trace[pid, args->fd]/
  426.     {
  427.         \$fd = args->fd;
  428.         \$count = args->count;
  429.  
  430.         // Pass args to sys_exit_write
  431.         @write_fd[tid] = \$fd;
  432.         @write_count[pid, \$fd] = \$count;
  433.     }
  434.  
  435.     tracepoint:syscalls:sys_exit_write
  436.     /@write_fd[tid]/
  437.     {
  438.         \$fd = @write_fd[tid];
  439.         \$count = @write_count[pid, \$fd];
  440.         \$ret = args->ret;
  441.  
  442.         // Args from sys_enter_write
  443.         delete(@write_fd[tid]);
  444.         delete(@write_count[pid, \$fd]);
  445. ${TIME_FMT:+
  446.         time($RAW_TIME_FMT);}
  447.         printf("|write|%d.%d|%s|%d|%d|", uid, gid, comm, pid, \$fd);
  448.         printf("%ld|%ld\n", \$count, \$ret);
  449.     }
  450.  
  451.     END {
  452.         clear(@dup_fd);
  453.         clear(@read_count);
  454.         clear(@read_fd);
  455.         clear(@trace);
  456.         clear(@vfs_open);
  457.         clear(@vfs_open_nfs);
  458.         clear(@vfs_openat);
  459.         clear(@vfs_openat_nfs);
  460.         clear(@write_count);
  461.         clear(@write_fd);
  462.     }
  463. EOF
  464. } | awk -F'|' \
  465.     -v cons=${CONS:-0} \
  466.     -v debug=${DEBUG:-0} \
  467.     -v quiet=${QUIET:-0} \
  468.     -v raw=${RAW_OUTPUT:-0} \
  469.     -v verbose=${VERBOSE:-0} \
  470.     -v stderr=/dev/stderr \
  471.     -v timefmt="$TIME_FMT" \
  472.     '################################################# BEGIN
  473.  
  474.     BEGIN {
  475.         red   = "\033[31m"
  476.         green = "\033[32m"
  477.         cyan  = "\033[36m"
  478.         frset = "\033[39m"
  479.  
  480.         srand() # Seed clock
  481.         tlim = srand() * 2 # limit time outliers
  482.     }
  483.  
  484.     ################################################## FUNCTIONS
  485.  
  486.     function key(a, b) { return a "," b }
  487.     function fprint() { print; fflush() }
  488.     function eprint() { print > stderr; fflush(stderr) }
  489.  
  490.     function emit(color, str)
  491.     {
  492.         if (timefmt != "") {
  493.             if (time !~ /^[0-9]+$/ || time > tlim || time < 0)
  494.                 return
  495.             printf "%s%s%s %s %s[%u]: %s\n",
  496.                 cons ? color : "", strftime(timefmt, time),
  497.                 cons ? frset : "", user, cmd, pid, str;
  498.         } else {
  499.             printf "%s %s[%u]: %s\n", user, cmd, pid, str;
  500.         }
  501.         fflush()
  502.     }
  503.  
  504.     ################################################## MAIN
  505.  
  506.     debug { sub(/^\t/, ""); fprint(); next }
  507.     raw { fprint(); next }
  508.     /^Attaching [0-9]+ probes/ { eprint(); next }
  509.  
  510.     # Fields
  511.     { time = $1 }
  512.     timefmt != "" {
  513.         if (time == "" || time < 0) next
  514.     }
  515.     NF < 6 { next }
  516.     {
  517.         call = $2
  518.         user = $3
  519.         cmd = $4
  520.         pid = $5
  521.         if (call == "enter_open" || call == "enter_openat") {
  522.             filename = $6
  523.         } else {
  524.             fd = $6
  525.         }
  526.     }
  527.  
  528.     call == "enter_open" || call == "enter_openat" {
  529.         filename_cache[pid] = filename
  530.         next
  531.     }
  532.  
  533.     call == "exit_open" || call == "exit_openat" {
  534.         callname = substr(call, 6)
  535.         if ($7 == 1) { # NFS
  536.             filename = filename_cache[pid]
  537.             delete filename_cache[pid]
  538.             filename_cache[key(pid, fd)] = filename
  539.             if (verbose && !quiet) {
  540.                 emit(green, sprintf("%s(filename=%s) = %d",
  541.                     callname, filename, fd))
  542.             }
  543.         } else {
  544.             delete filename_cache[pid]
  545.         }
  546.         next
  547.     }
  548.  
  549.     call == "dup" {
  550.         if (!verbose) next
  551.         filename = filename_cache[key(pid, fd)]
  552.         newfd = $7
  553.         filename_cache[key(pid, newfd)] = filename
  554.         if (!quiet) {
  555.             emit(green, sprintf("dup(fd=%d <%s>) = %d",
  556.                 fd, filename, newfd))
  557.         }
  558.         next
  559.     }
  560.  
  561.     call == "dup2" || call == "dup3" {
  562.         if (!verbose) next
  563.         filename = filename_cache[key(pid, fd)]
  564.         newfd = $7
  565.         filename_cache[key(pid, newfd)] = filename
  566.         if (!quiet) {
  567.             emit(green, sprintf("%s(oldfd=%d <%s>, newfd=%d)",
  568.                 call, fd, filename, newfd))
  569.         }
  570.         next
  571.     }
  572.  
  573.     call == "close" {
  574.         if (!verbose) next
  575.         k = key(pid, fd)
  576.         filename = filename_cache[k]
  577.         delete filename_cache[k]
  578.         if (!quiet) {
  579.             emit(green, sprintf("close(fd=%d <%s>)", fd, filename))
  580.         }
  581.         next
  582.     }
  583.  
  584.     call == "read" || call == "write" {
  585.         ret = $8
  586.         if (quiet && ret == 0) next
  587.         count = $7
  588.         filename = filename_cache[key(pid, fd)]
  589.         if (verbose) {
  590.             emit(call == "read" ? cyan : red,
  591.                 sprintf("%s(fd=%d <%s>, count=%ld) = %ld",
  592.                 call, fd, filename, count, ret))
  593.         } else if (ret > 0) {
  594.             emit(call == "read" ? cyan : red,
  595.                 sprintf("%s(fd=%d, count=%ld) = %ld",
  596.                 call, fd, count, ret))
  597.         }
  598.         next
  599.     }
  600. ' # END-QUOTE
  601.  
  602. ################################################################################
  603. # END
  604. ################################################################################
  605. # Local Variables:
  606. # mode: sh
  607. # tab-width: 8
  608. # sh-basic-offset: 8
  609. # indent-tabs-mode: t
  610. # backward-delete-char-untabify-method: nil
  611. # End:
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement
Public Pastes
Advertisement
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!