(CommandList children: [ (Assignment keyword: Assign_None pairs: [ (assign_pair lhs: (LhsName name:tracing) op: Equal rhs: {(/sys/kernel/debug/tracing)} spids: [166] ) ] spids: [166] ) (Sentence child: (Assignment keyword: Assign_None pairs: [ (assign_pair lhs: (LhsName name:flock) op: Equal rhs: {(/var/tmp/.ftrace-lock)} spids: [169] ) ] spids: [169] ) terminator: <Op_Semi ";"> ) (Assignment keyword: Assign_None pairs: [(assign_pair lhs:(LhsName name:wroteflock) op:Equal rhs:{(0)} spids:[173])] spids: [173] ) (Sentence child: (Assignment keyword: Assign_None pairs: [(assign_pair lhs:(LhsName name:opt_duration) op:Equal rhs:{(0)} spids:[176])] spids: [176] ) terminator: <Op_Semi ";"> ) (Sentence child: (Assignment keyword: Assign_None pairs: [(assign_pair lhs:(LhsName name:duration) op:Equal rhs:{(SQ )} spids:[180])] spids: [180] ) terminator: <Op_Semi ";"> ) (Sentence child: (Assignment keyword: Assign_None pairs: [(assign_pair lhs:(LhsName name:opt_name) op:Equal rhs:{(0)} spids:[183])] spids: [183] ) terminator: <Op_Semi ";"> ) (Sentence child: (Assignment keyword: Assign_None pairs: [(assign_pair lhs:(LhsName name:name) op:Equal rhs:{(SQ )} spids:[187])] spids: [187] ) terminator: <Op_Semi ";"> ) (Sentence child: (Assignment keyword: Assign_None pairs: [(assign_pair lhs:(LhsName name:opt_time) op:Equal rhs:{(0)} spids:[190])] spids: [190] ) terminator: <Op_Semi ";"> ) (Assignment keyword: Assign_None pairs: [(assign_pair lhs:(LhsName name:opt_reexec) op:Equal rhs:{(0)} spids:[194])] spids: [194] ) (Sentence child: (Assignment keyword: Assign_None pairs: [(assign_pair lhs:(LhsName name:opt_argc) op:Equal rhs:{(0)} spids:[197])] spids: [197] ) terminator: <Op_Semi ";"> ) (Sentence child: (Assignment keyword: Assign_None pairs: [(assign_pair lhs:(LhsName name:argc) op:Equal rhs:{(8)} spids:[201])] spids: [201] ) terminator: <Op_Semi ";"> ) (Sentence child: (Assignment keyword: Assign_None pairs: [(assign_pair lhs:(LhsName name:max_argc) op:Equal rhs:{(16)} spids:[205])] spids: [205] ) terminator: <Op_Semi ";"> ) (Assignment keyword: Assign_None pairs: [(assign_pair lhs:(LhsName name:ftext) op:Equal rhs:{(SQ )} spids:[209])] spids: [209] ) (C {(trap)} {(SQ <":">)} {(INT)} {(QUIT)} {(TERM)} {(PIPE)} {(HUP)}) (FuncDef name: usage body: (BraceGroup children: [ (SimpleCommand words: [{(cat)}] redirects: [ (HereDoc op_id: Redir_DLessDash fd: -1 body: { (DQ ("USAGE: execsnoop [-hrt] [-a argc] [-d secs] [name]\n") (" -d seconds # trace duration, and use buffers\n") (" -a argc # max args to show (default 8)\n") (" -r # include re-execs\n") (" -t # include time (seconds)\n") (" -h # this usage message\n") (" name # process name to match (REs allowed)\n") (" eg,\n") (" execsnoop # watch exec()s live (unbuffered)\n") (" execsnoop -d 1 # trace 1 sec (buffered)\n") ( " execsnoop grep # trace process names containing grep\n" ) (" execsnoop 'log") (Lit_Other "$") ("' # filenames ending in ") (Right_DoubleQuote "\"") (log) (Right_DoubleQuote "\"") ("\n") ("\n") ("See the man page and example file for more info.\n") ) } do_expansion: True here_end: END was_filled: True spids: [240] ) (Redir op_id:Redir_GreatAnd fd:-1 arg_word:{(2)} spids:[243]) ] ) (C {(exit)}) ] spids: [235] ) spids: [231 234] ) (FuncDef name: warn body: (BraceGroup children: [ (If arms: [ (if_arm cond: [ (Sentence child: (Pipeline children:[(C {(eval)} {(DQ ($ VSub_At "$@"))})] negated:True) terminator: <Op_Semi ";"> ) ] action: [ (SimpleCommand words: [ {(echo)} { (DQ ("WARNING: command failed ") (EscapedLiteralPart token: <Lit_EscapedChar "\\\""> ) ($ VSub_At "$@") (EscapedLiteralPart token:<Lit_EscapedChar "\\\"">) ) } ] redirects: [(Redir op_id:Redir_GreatAnd fd:-1 arg_word:{(2)} spids:[295])] ) ] spids: [-1 290] ) ] spids: [-1 306] ) ] spids: [276] ) spids: [272 275] ) (FuncDef name: end body: (BraceGroup children: [ (SimpleCommand words: [{(echo)}] redirects: [(Redir op_id:Redir_Great fd:2 arg_word:{(/dev/null)} spids:[324])] ) (SimpleCommand words: [{(echo)} {(DQ ("Ending tracing..."))}] redirects: [(Redir op_id:Redir_Great fd:2 arg_word:{(/dev/null)} spids:[334])] ) (C {(cd)} {($ VSub_Name "$tracing")}) (C {(warn)} {(DQ ("echo 0 > events/kprobes/") ($ VSub_Name "$kname") (/enable))}) (C {(warn)} {(DQ ("echo 0 > events/sched/sched_process_fork/enable"))}) (C {(warn)} {(DQ ("echo -:") ($ VSub_Name "$kname") (" >> kprobe_events"))}) (C {(warn)} {(DQ ("echo > trace"))}) (AndOr children: [ (DParen child:(ArithVarRef name:wroteflock)) (C {(warn)} {(DQ ("rm ") ($ VSub_Name "$flock"))}) ] op_id: Op_DAmp ) ] spids: [315] ) spids: [311 314] ) (FuncDef name: die body: (BraceGroup children: [ (SimpleCommand words: [{(echo)} {(DQ ($ VSub_At "$@"))}] redirects: [(Redir op_id:Redir_GreatAnd fd:-1 arg_word:{(2)} spids:[403])] ) (C {(exit)} {(1)}) ] spids: [398] ) spids: [394 397] ) (FuncDef name: edie body: (BraceGroup children: [ (SimpleCommand words: [{(echo)} {(DQ ($ VSub_At "$@"))}] redirects: [(Redir op_id:Redir_GreatAnd fd:-1 arg_word:{(2)} spids:[431])] ) (SimpleCommand words: [{(exec)}] redirects: [ (Redir op_id:Redir_Great fd:-1 arg_word:{(/dev/null)} spids:[441]) (Redir op_id:Redir_GreatAnd fd:2 arg_word:{(1)} spids:[444]) ] ) (C {(end)}) (C {(exit)} {(1)}) ] spids: [422] ) spids: [418 421] ) (While cond: [(C {(getopts)} {(a) (Lit_Other ":") (d) (Lit_Other ":") (hrt)} {(opt)})] body: (DoGroup children: [ (Case to_match: {($ VSub_Name "$opt")} arms: [ (case_arm pat_list: [{(a)}] action: [ (Sentence child: (Assignment keyword: Assign_None pairs: [ (assign_pair lhs: (LhsName name:opt_argc) op: Equal rhs: {(1)} spids: [486] ) ] spids: [486] ) terminator: <Op_Semi ";"> ) (Assignment keyword: Assign_None pairs: [ (assign_pair lhs: (LhsName name:argc) op: Equal rhs: {($ VSub_Name "$OPTARG")} spids: [490] ) ] spids: [490] ) ] spids: [483 484 493 -1] ) (case_arm pat_list: [{(d)}] action: [ (Sentence child: (Assignment keyword: Assign_None pairs: [ (assign_pair lhs: (LhsName name:opt_duration) op: Equal rhs: {(1)} spids: [499] ) ] spids: [499] ) terminator: <Op_Semi ";"> ) (Assignment keyword: Assign_None pairs: [ (assign_pair lhs: (LhsName name:duration) op: Equal rhs: {($ VSub_Name "$OPTARG")} spids: [503] ) ] spids: [503] ) ] spids: [496 497 506 -1] ) (case_arm pat_list: [{(r)}] action: [ (Assignment keyword: Assign_None pairs: [ (assign_pair lhs: (LhsName name:opt_reexec) op: Equal rhs: {(1)} spids: [512] ) ] spids: [512] ) ] spids: [509 510 515 -1] ) (case_arm pat_list: [{(t)}] action: [ (Assignment keyword: Assign_None pairs: [ (assign_pair lhs: (LhsName name:opt_time) op: Equal rhs: {(1)} spids: [521] ) ] spids: [521] ) ] spids: [518 519 524 -1] ) (case_arm pat_list: [{(h)} {(Lit_Other "?")}] action: [(C {(usage)})] spids: [527 530 534 -1] ) ] spids: [476 480 537] ) ] spids: [473 539] ) ) (C {(shift)} { (ArithSubPart anode: (ArithBinary op_id: Arith_Minus left: (ArithWord w:{($ VSub_Name "$OPTIND")}) right: (ArithWord w:{(Lit_Digits 1)}) ) spids: [543 552] ) } ) (If arms: [ (if_arm cond: [ (Sentence child: (DParen child:(ArithWord w:{($ VSub_Pound "$#")})) terminator: <Op_Semi ";"> ) ] action: [ (Assignment keyword: Assign_None pairs: [(assign_pair lhs:(LhsName name:opt_name) op:Equal rhs:{(1)} spids:[567])] spids: [567] ) (Assignment keyword: Assign_None pairs: [ (assign_pair lhs: (LhsName name:name) op: Equal rhs: {($ VSub_Number "$1")} spids: [571] ) ] spids: [571] ) (C {(shift)}) ] spids: [-1 564] ) ] spids: [-1 577] ) (AndOr children: [(DParen child:(ArithWord w:{($ VSub_Pound "$#")})) (C {(usage)})] op_id: Op_DAmp ) (AndOr children: [ (DParen child: (ArithBinary op_id: Arith_DAmp left: (ArithVarRef name:opt_pid) right: (ArithVarRef name:opt_name) ) ) (C {(die)} {(DQ ("ERROR: use either -p or -n."))}) ] op_id: Op_DAmp ) (AndOr children: [ (DParen child:(ArithVarRef name:opt_pid)) (Assignment keyword: Assign_None pairs: [ (assign_pair lhs: (LhsName name:ftext) op: Equal rhs: {(DQ (" issued by PID ") ($ VSub_Name "$pid"))} spids: [622] ) ] spids: [622] ) ] op_id: Op_DAmp ) (AndOr children: [ (DParen child:(ArithVarRef name:opt_name)) (Assignment keyword: Assign_None pairs: [ (assign_pair lhs: (LhsName name:ftext) op: Equal rhs: { (DQ (" issued by process name ") (EscapedLiteralPart token:<Lit_EscapedChar "\\\"">) ($ VSub_Name "$name") (EscapedLiteralPart token:<Lit_EscapedChar "\\\"">) ) } spids: [637] ) ] spids: [637] ) ] op_id: Op_DAmp ) (AndOr children: [ (DParen child:(ArithVarRef name:opt_file)) (Assignment keyword: Assign_None pairs: [ (assign_pair lhs: (LhsName name:ftext) op: Equal rhs: { (DQ ($ VSub_Name "$ftext") (" for filenames containing ") (EscapedLiteralPart token:<Lit_EscapedChar "\\\"">) ($ VSub_Name "$file") (EscapedLiteralPart token:<Lit_EscapedChar "\\\"">) ) } spids: [654] ) ] spids: [654] ) ] op_id: Op_DAmp ) (AndOr children: [ (DParen child: (ArithBinary op_id: Arith_DAmp left: (ArithVarRef name:opt_argc) right: (ArithBinary op_id: Arith_Great left: (ArithVarRef name:argc) right: (ArithVarRef name:max_argc) ) ) ) (C {(die)} {(DQ ("ERROR: max -a argc is ") ($ VSub_Name "$max_argc") (.))}) ] op_id: Op_DAmp ) (If arms: [ (if_arm cond: [ (Sentence child: (DParen child:(ArithVarRef name:opt_duration)) terminator: <Op_Semi ";"> ) ] action: [ (C {(echo)} { (DQ ("Tracing exec()s") ($ VSub_Name "$ftext") (" for ") ($ VSub_Name "$duration") (" seconds (buffered)...") ) } ) ] spids: [-1 698] ) ] else_action: [(C {(echo)} {(DQ ("Tracing exec()s") ($ VSub_Name "$ftext") (". Ctrl-C to end."))})] spids: [711 722] ) (If arms: [ (if_arm cond: [ (Sentence child: (DParen child:(ArithVarRef name:opt_duration)) terminator: <Op_Semi ";"> ) ] action: [ (AndOr children: [ (DBracket expr:(BoolUnary op_id:BoolUnary_x child:{(/usr/bin/mawk)})) (AndOr children: [ (Assignment keyword: Assign_None pairs: [(assign_pair lhs:(LhsName name:awk) op:Equal rhs:{(mawk)} spids:[751])] spids: [751] ) (Assignment keyword: Assign_None pairs: [(assign_pair lhs:(LhsName name:awk) op:Equal rhs:{(awk)} spids:[756])] spids: [756] ) ] op_id: Op_DPipe ) ] op_id: Op_DAmp ) ] spids: [-1 738] ) ] else_action: [ (If arms: [ (if_arm cond: [ (Sentence child: (DBracket expr:(BoolUnary op_id:BoolUnary_x child:{(/usr/bin/gawk)})) terminator: <Op_Semi ";"> ) ] action: [ (Assignment keyword: Assign_None pairs: [(assign_pair lhs:(LhsName name:awk) op:Equal rhs:{(gawk)} spids:[780])] spids: [780] ) ] spids: [-1 777] ) (if_arm cond: [ (Sentence child: (DBracket expr:(BoolUnary op_id:BoolUnary_x child:{(/usr/bin/mawk)})) terminator: <Op_Semi ";"> ) ] action: [ (Assignment keyword: Assign_None pairs: [ (assign_pair lhs: (LhsName name:awk) op: Equal rhs: {(DQ ("mawk -W interactive"))} spids: [798] ) ] spids: [798] ) ] spids: [784 795] ) ] else_action: [ (Assignment keyword: Assign_None pairs: [(assign_pair lhs:(LhsName name:awk) op:Equal rhs:{(awk)} spids:[807])] spids: [807] ) ] spids: [804 811] ) ] spids: [759 813] ) (AndOr children: [ (C {(cd)} {($ VSub_Name "$tracing")}) (C {(die)} { (DQ ("ERROR: accessing tracing. Root user? Kernel has FTRACE?\n") (" debugfs mounted? (mount -t debugfs debugfs /sys/kernel/debug)") ) } ) ] op_id: Op_DPipe ) (AndOr children: [ (DBracket expr:(BoolUnary op_id:BoolUnary_e child:{($ VSub_Name "$flock")})) (C {(die)} { (DQ ("ERROR: ftrace may be in use by PID ") (CommandSubPart command_list: (CommandList children:[(C {(cat)} {($ VSub_Name "$flock")})]) left_token: <Left_CommandSub "$("> spids: [850 854] ) (" ") ($ VSub_Name "$flock") ) } ) ] op_id: Op_DAmp ) (AndOr children: [ (SimpleCommand words: [{(echo)} {($ VSub_Dollar "$$")}] redirects: [(Redir op_id:Redir_Great fd:-1 arg_word:{($ VSub_Name "$flock")} spids:[863])] ) (C {(die)} {(DQ ("ERROR: unable to write ") ($ VSub_Name "$flock") (.))}) ] op_id: Op_DPipe ) (Assignment keyword: Assign_None pairs: [(assign_pair lhs:(LhsName name:wroteflock) op:Equal rhs:{(1)} spids:[877])] spids: [877] ) (If arms: [ (if_arm cond: [ (Sentence child: (DBracket expr:(BoolUnary op_id:BoolUnary_x child:{(/usr/bin/getconf)})) terminator: <Op_Semi ";"> ) ] action: [ (Assignment keyword: Assign_None pairs: [ (assign_pair lhs: (LhsName name:bits) op: Equal rhs: { (CommandSubPart command_list: (CommandList children:[(C {(getconf)} {(LONG_BIT)})]) left_token: <Left_CommandSub "$("> spids: [899 903] ) } spids: [898] ) ] spids: [898] ) ] spids: [-1 895] ) ] else_action: [ (Assignment keyword: Assign_None pairs: [(assign_pair lhs:(LhsName name:bits) op:Equal rhs:{(64)} spids:[908])] spids: [908] ) (AndOr children: [ (DBracket expr: (BoolBinary op_id: BoolBinary_GlobDEqual left: { (CommandSubPart command_list: (CommandList children:[(C {(uname)} {(-m)})]) left_token: <Left_CommandSub "$("> spids: [914 918] ) } right: {(i) (Lit_Other "*")} ) ) (Assignment keyword: Assign_None pairs: [(assign_pair lhs:(LhsName name:bits) op:Equal rhs:{(32)} spids:[929])] spids: [929] ) ] op_id: Op_DAmp ) ] spids: [905 932] ) (DParen child: (BinaryAssign op_id: Arith_Equal left: (LhsName name:offset) right: (ArithBinary op_id: Arith_Slash left: (ArithVarRef name:bits) right: (ArithWord w:{(Lit_Digits 8)}) ) ) ) (FuncDef name: makeprobe body: (BraceGroup children: [ (Assignment keyword: Assign_None pairs: [ (assign_pair lhs: (LhsName name:func) op: Equal rhs: {($ VSub_Number "$1")} spids: [956] ) ] spids: [956] ) (Assignment keyword: Assign_None pairs: [ (assign_pair lhs: (LhsName name:kname) op: Equal rhs: {(execsnoop_) ($ VSub_Name "$func")} spids: [960] ) ] spids: [960] ) (Assignment keyword: Assign_None pairs: [ (assign_pair lhs: (LhsName name:kprobe) op: Equal rhs: {(DQ ("p:") ($ VSub_Name "$kname") (" ") ($ VSub_Name "$func"))} spids: [965] ) ] spids: [965] ) (Assignment keyword: Assign_None pairs: [(assign_pair lhs:(LhsName name:i) op:Equal rhs:{(0)} spids:[974])] spids: [974] ) (While cond: [ (Sentence child: (DParen child: (ArithBinary op_id: Arith_Less left: (ArithVarRef name:i) right: (ArithBinary op_id: Arith_Plus left: (ArithVarRef name:argc) right: (ArithWord w:{(Lit_Digits 1)}) ) ) ) terminator: <Op_Semi ";"> ) ] body: (DoGroup children: [ (Assignment keyword: Assign_None pairs: [ (assign_pair lhs: (LhsName name:kprobe) op: Equal rhs: { (DQ ($ VSub_Name "$kprobe") (" +0(+") (ArithSubPart anode: (ArithBinary op_id: Arith_Star left: (ArithVarRef name:i) right: (ArithVarRef name:offset) ) spids: [1007 1016] ) ("(%si)):string") ) } spids: [1003] ) ] spids: [1003] ) (DParen child: (UnaryAssign op_id:Node_PostDPlus child:(LhsName name:i)) ) ] spids: [996 1030] ) ) ] spids: [953] ) spids: [949 952] ) (C {(makeprobe)} {(sys_execve)}) (SimpleCommand words: [{(echo)} {(nop)}] redirects: [(Redir op_id:Redir_Great fd:-1 arg_word:{(current_tracer)} spids:[1049])] ) (If arms: [ (if_arm cond: [ (Sentence child: (Pipeline children: [ (SimpleCommand words: [{(echo)} {($ VSub_Name "$kprobe")}] redirects: [ (Redir op_id: Redir_DGreat fd: -1 arg_word: {(kprobe_events)} spids: [1061] ) (Redir op_id: Redir_Great fd: 2 arg_word: {(/dev/null)} spids: [1065] ) ] ) ] negated: True ) terminator: <Op_Semi ";"> ) ] action: [ (C {(makeprobe)} {(stub_execve)}) (If arms: [ (if_arm cond: [ (Sentence child: (Pipeline children: [ (SimpleCommand words: [{(echo)} {($ VSub_Name "$kprobe")}] redirects: [ (Redir op_id: Redir_DGreat fd: -1 arg_word: {(kprobe_events)} spids: [1085] ) (Redir op_id: Redir_Great fd: 2 arg_word: {(/dev/null)} spids: [1089] ) ] ) ] negated: True ) terminator: <Op_Semi ";"> ) ] action: [ (C {(makeprobe)} {(do_execve)}) (If arms: [ (if_arm cond: [ (Sentence child: (Pipeline children: [ (SimpleCommand words: [{(echo)} {($ VSub_Name "$kprobe")}] redirects: [ (Redir op_id: Redir_DGreat fd: -1 arg_word: {(kprobe_events)} spids: [1109] ) (Redir op_id: Redir_Great fd: 2 arg_word: {(/dev/null)} spids: [1113] ) ] ) ] negated: True ) terminator: <Op_Semi ";"> ) ] action: [(C {(edie)} {(DQ ("ERROR: adding a kprobe for execve. Exiting."))})] spids: [-1 1117] ) ] spids: [-1 1127] ) ] spids: [-1 1093] ) ] spids: [-1 1130] ) ] spids: [-1 1069] ) ] spids: [-1 1132] ) (If arms: [ (if_arm cond: [ (Sentence child: (Pipeline children: [ (SimpleCommand words: [{(echo)} {(1)}] redirects: [ (Redir op_id: Redir_Great fd: -1 arg_word: {(events/kprobes/) ($ VSub_Name "$kname") (/enable)} spids: [1142] ) ] ) ] negated: True ) terminator: <Op_Semi ";"> ) ] action: [(C {(edie)} {(DQ ("ERROR: enabling kprobe for execve. Exiting."))})] spids: [-1 1149] ) ] spids: [-1 1158] ) (If arms: [ (if_arm cond: [ (Sentence child: (Pipeline children: [ (SimpleCommand words: [{(echo)} {(1)}] redirects: [ (Redir op_id: Redir_Great fd: -1 arg_word: {(events/sched/sched_process_fork/enable)} spids: [1168] ) ] ) ] negated: True ) terminator: <Op_Semi ";"> ) ] action: [(C {(edie)} {(DQ ("ERROR: enabling sched:sched_process_fork tracepoint. Exiting."))})] spids: [-1 1173] ) ] spids: [-1 1182] ) (C {(echo)} {(DQ ("Instrumenting ") ($ VSub_Name "$func"))}) (AndOr children: [ (DParen child:(ArithVarRef name:opt_time)) (C {(printf)} {(DQ ("%-16s "))} {(DQ (TIMEs))}) ] op_id: Op_DAmp ) (C {(printf)} {(DQ ("%6s %6s %s") (EscapedLiteralPart token:<Lit_EscapedChar "\\n">))} {(DQ (PID))} {(DQ (PPID))} {(DQ (ARGS))} ) (Assignment keyword: Assign_None pairs: [ (assign_pair lhs: (LhsName name:offset) op: Equal rhs: { (CommandSubPart command_list: (CommandList children: [ (C {($ VSub_Name "$awk")} { (SQ <"BEGIN { o = 0; }\n"> <"\t$1 == \"#\" && $2 ~ /TASK/ && NF == 6 { o = 1; }\n"> <"\t$2 ~ /TASK/ { print o; exit }"> ) } {(trace)} ) ] ) left_token: <Left_CommandSub "$("> spids: [1252 1262] ) } spids: [1251] ) ] spids: [1251] ) (C {(warn)} {(DQ ("echo > trace"))}) (Pipeline children: [ (Subshell child: (If arms: [ (if_arm cond: [ (Sentence child: (DParen child:(ArithVarRef name:opt_duration)) terminator: <Op_Semi ";"> ) ] action: [(C {(sleep)} {($ VSub_Name "$duration")}) (C {(cat)} {(-v)} {(trace)})] spids: [-1 1286] ) ] else_action: [(C {(cat)} {(-v)} {(trace_pipe)})] spids: [1304 1317] ) spids: [1274 1319] ) (C {($ VSub_Name "$awk")} {(-v)} {(Lit_VarLike "o=") ($ VSub_Name "$offset")} {(-v)} {(Lit_VarLike "opt_name=") ($ VSub_Name "$opt_name")} {(-v)} {(Lit_VarLike "name=") ($ VSub_Name "$name")} {(-v)} {(Lit_VarLike "opt_duration=") ($ VSub_Name "$opt_duration")} {(-v)} {(Lit_VarLike "opt_time=") ($ VSub_Name "$opt_time")} {(-v)} {(Lit_VarLike "kname=") ($ VSub_Name "$kname")} {(-v)} {(Lit_VarLike "opt_reexec=") ($ VSub_Name "$opt_reexec")} { (SQ <"\n"> <"\t# common fields\n"> <"\t$1 != \"#\" {\n"> <"\t\t# task name can contain dashes\n"> <"\t\tcomm = pid = $1\n"> <"\t\tsub(/-[0-9][0-9]*/, \"\", comm)\n"> <"\t\tsub(/.*-/, \"\", pid)\n"> <"\t}\n"> <"\n"> <"\t$1 != \"#\" && $(4+o) ~ /sched_process_fork/ {\n"> <"\t\tcpid=$0\n"> <"\t\tsub(/.* child_pid=/, \"\", cpid)\n"> <"\t\tsub(/ .*/, \"\", cpid)\n"> <"\t\tgetppid[cpid] = pid\n"> <"\t\tdelete seen[pid]\n"> <"\t}\n"> <"\n"> <"\t$1 != \"#\" && $(4+o) ~ kname {\n"> <"\t\tif (seen[pid])\n"> <"\t\t\tnext\n"> <"\t\tif (opt_name && comm !~ name)\n"> <"\t\t\tnext\n"> <"\n"> <"\t\t#\n"> <"\t\t# examples:\n"> <"\t\t# ... arg1=\"/bin/echo\" arg2=\"1\" arg3=\"2\" arg4=\"3\" ...\n"> <"\t\t# ... arg1=\"sleep\" arg2=\"2\" arg3=(fault) arg4=\"\" ...\n"> <"\t\t# ... arg1=\"\" arg2=(fault) arg3=\"\" arg4=\"\" ...\n"> <"\t\t# the last example is uncommon, and may be a race.\n"> <"\t\t#\n"> <"\t\tif ($0 ~ /arg1=\"\"/) {\n"> <"\t\t\targs = comm \" [?]\"\n"> <"\t\t} else {\n"> <"\t\t\targs=$0\n"> <"\t\t\tsub(/ arg[0-9]*=\\(fault\\).*/, \"\", args)\n"> <"\t\t\tsub(/.*arg1=\"/, \"\", args)\n"> <"\t\t\tgsub(/\" arg[0-9]*=\"/, \" \", args)\n"> <"\t\t\tsub(/\"$/, \"\", args)\n"> <"\t\t\tif ($0 !~ /\\(fault\\)/)\n"> <"\t\t\t\targs = args \" [...]\"\n"> <"\t\t}\n"> <"\n"> <"\t\tif (opt_time) {\n"> <"\t\t\ttime = $(3+o); sub(\":\", \"\", time)\n"> <"\t\t\tprintf \"%-16s \", time\n"> <"\t\t}\n"> <"\t\tprintf \"%6s %6d %s\\n\", pid, getppid[pid], args\n"> <"\t\tif (!opt_duration)\n"> <"\t\t\tfflush()\n"> <"\t\tif (!opt_reexec) {\n"> <"\t\t\tseen[pid] = 1\n"> <"\t\t\tdelete getppid[pid]\n"> <"\t\t}\n"> <"\t}\n"> <"\n"> <"\t$0 ~ /LOST.*EVENT[S]/ { print \"WARNING: \" $0 > \"/dev/stderr\" }\n"> ) } ) ] negated: False ) (C {(end)}) ] )