(CommandList
  children: [
    (Assignment
      keyword: Assign_None
      pairs: [
        (assign_pair
          lhs: (LhsName name:tracing)
          op: Equal
          rhs: {(/sys/kernel/debug/tracing)}
          spids: [166]
        )
      ]
      spids: [166]
    )
    (Sentence
      child: 
        (Assignment
          keyword: Assign_None
          pairs: [
            (assign_pair
              lhs: (LhsName name:flock)
              op: Equal
              rhs: {(/var/tmp/.ftrace-lock)}
              spids: [169]
            )
          ]
          spids: [169]
        )
      terminator: <Op_Semi ';'>
    )
    (Assignment
      keyword: Assign_None
      pairs: [(assign_pair lhs:(LhsName name:wroteflock) op:Equal rhs:{(0)} spids:[173])]
      spids: [173]
    )
    (Sentence
      child: 
        (Assignment
          keyword: Assign_None
          pairs: [(assign_pair lhs:(LhsName name:opt_duration) op:Equal rhs:{(0)} spids:[176])]
          spids: [176]
        )
      terminator: <Op_Semi ';'>
    )
    (Sentence
      child: 
        (Assignment
          keyword: Assign_None
          pairs: [(assign_pair lhs:(LhsName name:duration) op:Equal rhs:{(EmptyPart)} spids:[180])]
          spids: [180]
        )
      terminator: <Op_Semi ';'>
    )
    (Sentence
      child: 
        (Assignment
          keyword: Assign_None
          pairs: [(assign_pair lhs:(LhsName name:opt_name) op:Equal rhs:{(0)} spids:[183])]
          spids: [183]
        )
      terminator: <Op_Semi ';'>
    )
    (Sentence
      child: 
        (Assignment
          keyword: Assign_None
          pairs: [(assign_pair lhs:(LhsName name:name) op:Equal rhs:{(EmptyPart)} spids:[187])]
          spids: [187]
        )
      terminator: <Op_Semi ';'>
    )
    (Sentence
      child: 
        (Assignment
          keyword: Assign_None
          pairs: [(assign_pair lhs:(LhsName name:opt_time) op:Equal rhs:{(0)} spids:[190])]
          spids: [190]
        )
      terminator: <Op_Semi ';'>
    )
    (Assignment
      keyword: Assign_None
      pairs: [(assign_pair lhs:(LhsName name:opt_reexec) op:Equal rhs:{(0)} spids:[194])]
      spids: [194]
    )
    (Sentence
      child: 
        (Assignment
          keyword: Assign_None
          pairs: [(assign_pair lhs:(LhsName name:opt_argc) op:Equal rhs:{(0)} spids:[197])]
          spids: [197]
        )
      terminator: <Op_Semi ';'>
    )
    (Sentence
      child: 
        (Assignment
          keyword: Assign_None
          pairs: [(assign_pair lhs:(LhsName name:argc) op:Equal rhs:{(8)} spids:[201])]
          spids: [201]
        )
      terminator: <Op_Semi ';'>
    )
    (Sentence
      child: 
        (Assignment
          keyword: Assign_None
          pairs: [(assign_pair lhs:(LhsName name:max_argc) op:Equal rhs:{(16)} spids:[205])]
          spids: [205]
        )
      terminator: <Op_Semi ';'>
    )
    (Assignment
      keyword: Assign_None
      pairs: [(assign_pair lhs:(LhsName name:ftext) op:Equal rhs:{(EmptyPart)} spids:[209])]
      spids: [209]
    )
    (C {(trap)} {(SQ <':'>)} {(INT)} {(QUIT)} {(TERM)} {(PIPE)} {(HUP)})
    (FuncDef
      name: usage
      body: 
        (BraceGroup
          children: [
            (SimpleCommand
              words: [{(cat)}]
              redirects: [
                (HereDoc
                  op_id: Redir_DLessDash
                  fd: 16777215
                  body: 
                    {
                      (DQ ('USAGE: execsnoop [-hrt] [-a argc] [-d secs] [name]\n') 
                        ('                 -d seconds      # trace duration, and use buffers\n') ('                 -a argc         # max args to show (default 8)\n') 
                        ('                 -r              # include re-execs\n') ('                 -t              # include time (seconds)\n') 
                        ('                 -h              # this usage message\n') ('                 name            # process name to match (REs allowed)\n') ('  eg,\n') 
                        ('       execsnoop                 # watch exec()s live (unbuffered)\n') ('       execsnoop -d 1            # trace 1 sec (buffered)\n') 
                        (
'       execsnoop grep            # trace process names containing grep\n'
                        ) ("       execsnoop 'log") (Lit_Other '$') ("'          # filenames ending in ") (Right_DoubleQuote '"') 
                        (log) (Right_DoubleQuote '"') ('\n') ('\n') ('See the man page and example file for more info.\n')
                      )
                    }
                  do_expansion: True
                  here_end: END
                  was_filled: T
                  spids: [240]
                )
                (Redir op_id:Redir_GreatAnd fd:16777215 arg_word:{(2)} spids:[243])
              ]
            )
            (ControlFlow token:<ControlFlow_Exit exit>)
          ]
          spids: [235]
        )
      spids: [231 234]
    )
    (FuncDef
      name: warn
      body: 
        (BraceGroup
          children: [
            (If
              arms: [
                (if_arm
                  cond: [
                    (Sentence
                      child: (Pipeline children:[(C {(eval)} {(DQ ($ VSub_At '$@'))})] negated:T)
                      terminator: <Op_Semi ';'>
                    )
                  ]
                  action: [
                    (SimpleCommand
                      words: [
                        {(echo)}
                        {
                          (DQ ('WARNING: command failed ') 
                            (EscapedLiteralPart
                              token: <Lit_EscapedChar '\\"'>
                            ) ($ VSub_At '$@') (EscapedLiteralPart token:<Lit_EscapedChar '\\"'>)
                          )
                        }
                      ]
                      redirects: [(Redir op_id:Redir_GreatAnd fd:16777215 arg_word:{(2)} spids:[296])]
                    )
                  ]
                  spids: [16777215 291]
                )
              ]
              spids: [16777215 307]
            )
          ]
          spids: [277]
        )
      spids: [273 276]
    )
    (FuncDef
      name: end
      body: 
        (BraceGroup
          children: [
            (SimpleCommand
              words: [{(echo)}]
              redirects: [(Redir op_id:Redir_Great fd:2 arg_word:{(/dev/null)} spids:[325])]
            )
            (SimpleCommand
              words: [{(echo)} {(DQ ('Ending tracing...'))}]
              redirects: [(Redir op_id:Redir_Great fd:2 arg_word:{(/dev/null)} spids:[335])]
            )
            (C {(cd)} {($ VSub_Name '$tracing')})
            (C {(warn)} {(DQ ('echo 0 > events/kprobes/') ($ VSub_Name '$kname') (/enable))})
            (C {(warn)} {(DQ ('echo 0 > events/sched/sched_process_fork/enable'))})
            (C {(warn)} {(DQ ('echo -:') ($ VSub_Name '$kname') (' >> kprobe_events'))})
            (C {(warn)} {(DQ ('echo > trace'))})
            (AndOr
              ops: [Op_DAmp]
              children: [
                (DParen child:(ArithVarRef name:wroteflock))
                (C {(warn)} {(DQ ('rm ') ($ VSub_Name '$flock'))})
              ]
            )
          ]
          spids: [316]
        )
      spids: [312 315]
    )
    (FuncDef
      name: die
      body: 
        (BraceGroup
          children: [
            (SimpleCommand
              words: [{(echo)} {(DQ ($ VSub_At '$@'))}]
              redirects: [(Redir op_id:Redir_GreatAnd fd:16777215 arg_word:{(2)} spids:[404])]
            )
            (ControlFlow token:<ControlFlow_Exit exit> arg_word:{(1)})
          ]
          spids: [399]
        )
      spids: [395 398]
    )
    (FuncDef
      name: edie
      body: 
        (BraceGroup
          children: [
            (SimpleCommand
              words: [{(echo)} {(DQ ($ VSub_At '$@'))}]
              redirects: [(Redir op_id:Redir_GreatAnd fd:16777215 arg_word:{(2)} spids:[432])]
            )
            (SimpleCommand
              words: [{(exec)}]
              redirects: [
                (Redir
                  op_id: Redir_Great
                  fd: 16777215
                  arg_word: {(/dev/null)}
                  spids: [442]
                )
                (Redir op_id:Redir_GreatAnd fd:2 arg_word:{(1)} spids:[445])
              ]
            )
            (C {(end)})
            (ControlFlow token:<ControlFlow_Exit exit> arg_word:{(1)})
          ]
          spids: [423]
        )
      spids: [419 422]
    )
    (While
      cond: [(C {(getopts)} {(a) (Lit_Other ':') (d) (Lit_Other ':') (hrt)} {(opt)})]
      body: 
        (DoGroup
          children: [
            (Case
              to_match: {($ VSub_Name '$opt')}
              arms: [
                (case_arm
                  pat_list: [{(a)}]
                  action: [
                    (Sentence
                      child: 
                        (Assignment
                          keyword: Assign_None
                          pairs: [
                            (assign_pair
                              lhs: (LhsName name:opt_argc)
                              op: Equal
                              rhs: {(1)}
                              spids: [487]
                            )
                          ]
                          spids: [487]
                        )
                      terminator: <Op_Semi ';'>
                    )
                    (Assignment
                      keyword: Assign_None
                      pairs: [
                        (assign_pair
                          lhs: (LhsName name:argc)
                          op: Equal
                          rhs: {($ VSub_Name '$OPTARG')}
                          spids: [491]
                        )
                      ]
                      spids: [491]
                    )
                  ]
                  spids: [484 485 494 16777215]
                )
                (case_arm
                  pat_list: [{(d)}]
                  action: [
                    (Sentence
                      child: 
                        (Assignment
                          keyword: Assign_None
                          pairs: [
                            (assign_pair
                              lhs: (LhsName name:opt_duration)
                              op: Equal
                              rhs: {(1)}
                              spids: [500]
                            )
                          ]
                          spids: [500]
                        )
                      terminator: <Op_Semi ';'>
                    )
                    (Assignment
                      keyword: Assign_None
                      pairs: [
                        (assign_pair
                          lhs: (LhsName name:duration)
                          op: Equal
                          rhs: {($ VSub_Name '$OPTARG')}
                          spids: [504]
                        )
                      ]
                      spids: [504]
                    )
                  ]
                  spids: [497 498 507 16777215]
                )
                (case_arm
                  pat_list: [{(r)}]
                  action: [
                    (Assignment
                      keyword: Assign_None
                      pairs: [
                        (assign_pair
                          lhs: (LhsName name:opt_reexec)
                          op: Equal
                          rhs: {(1)}
                          spids: [513]
                        )
                      ]
                      spids: [513]
                    )
                  ]
                  spids: [510 511 516 16777215]
                )
                (case_arm
                  pat_list: [{(t)}]
                  action: [
                    (Assignment
                      keyword: Assign_None
                      pairs: [
                        (assign_pair
                          lhs: (LhsName name:opt_time)
                          op: Equal
                          rhs: {(1)}
                          spids: [522]
                        )
                      ]
                      spids: [522]
                    )
                  ]
                  spids: [519 520 525 16777215]
                )
                (case_arm
                  pat_list: [{(h)} {(Lit_Other '?')}]
                  action: [(C {(usage)})]
                  spids: [528 531 535 16777215]
                )
              ]
              spids: [477 481 538]
            )
          ]
          spids: [474 540]
        )
    )
    (C {(shift)} 
      {
        (ArithSubPart
          anode: 
            (ArithBinary
              op_id: Arith_Minus
              left: (ArithWord w:{($ VSub_Name '$OPTIND')})
              right: (ArithWord w:{(Lit_Digits 1)})
            )
          spids: [544 553]
        )
      }
    )
    (If
      arms: [
        (if_arm
          cond: [
            (Sentence
              child: (DParen child:(ArithWord w:{($ VSub_Pound '$#')}))
              terminator: <Op_Semi ';'>
            )
          ]
          action: [
            (Assignment
              keyword: Assign_None
              pairs: [(assign_pair lhs:(LhsName name:opt_name) op:Equal rhs:{(1)} spids:[568])]
              spids: [568]
            )
            (Assignment
              keyword: Assign_None
              pairs: [
                (assign_pair
                  lhs: (LhsName name:name)
                  op: Equal
                  rhs: {($ VSub_Number '$1')}
                  spids: [572]
                )
              ]
              spids: [572]
            )
            (C {(shift)})
          ]
          spids: [16777215 565]
        )
      ]
      spids: [16777215 578]
    )
    (AndOr
      ops: [Op_DAmp]
      children: [(DParen child:(ArithWord w:{($ VSub_Pound '$#')})) (C {(usage)})]
    )
    (AndOr
      ops: [Op_DAmp]
      children: [
        (DParen
          child: 
            (ArithBinary
              op_id: Arith_DAmp
              left: (ArithVarRef name:opt_pid)
              right: (ArithVarRef name:opt_name)
            )
        )
        (C {(die)} {(DQ ('ERROR: use either -p or -n.'))})
      ]
    )
    (AndOr
      ops: [Op_DAmp]
      children: [
        (DParen child:(ArithVarRef name:opt_pid))
        (Assignment
          keyword: Assign_None
          pairs: [
            (assign_pair
              lhs: (LhsName name:ftext)
              op: Equal
              rhs: {(DQ (' issued by PID ') ($ VSub_Name '$pid'))}
              spids: [623]
            )
          ]
          spids: [623]
        )
      ]
    )
    (AndOr
      ops: [Op_DAmp]
      children: [
        (DParen child:(ArithVarRef name:opt_name))
        (Assignment
          keyword: Assign_None
          pairs: [
            (assign_pair
              lhs: (LhsName name:ftext)
              op: Equal
              rhs: 
                {
                  (DQ (' issued by process name ') (EscapedLiteralPart token:<Lit_EscapedChar '\\"'>) 
                    ($ VSub_Name '$name') (EscapedLiteralPart token:<Lit_EscapedChar '\\"'>)
                  )
                }
              spids: [638]
            )
          ]
          spids: [638]
        )
      ]
    )
    (AndOr
      ops: [Op_DAmp]
      children: [
        (DParen child:(ArithVarRef name:opt_file))
        (Assignment
          keyword: Assign_None
          pairs: [
            (assign_pair
              lhs: (LhsName name:ftext)
              op: Equal
              rhs: 
                {
                  (DQ ($ VSub_Name '$ftext') (' for filenames containing ') 
                    (EscapedLiteralPart token:<Lit_EscapedChar '\\"'>) ($ VSub_Name '$file') (EscapedLiteralPart token:<Lit_EscapedChar '\\"'>)
                  )
                }
              spids: [655]
            )
          ]
          spids: [655]
        )
      ]
    )
    (AndOr
      ops: [Op_DAmp]
      children: [
        (DParen
          child: 
            (ArithBinary
              op_id: Arith_DAmp
              left: (ArithVarRef name:opt_argc)
              right: 
                (ArithBinary
                  op_id: Arith_Great
                  left: (ArithVarRef name:argc)
                  right: (ArithVarRef name:max_argc)
                )
            )
        )
        (C {(die)} {(DQ ('ERROR: max -a argc is ') ($ VSub_Name '$max_argc') (.))})
      ]
    )
    (If
      arms: [
        (if_arm
          cond: [
            (Sentence
              child: (DParen child:(ArithVarRef name:opt_duration))
              terminator: <Op_Semi ';'>
            )
          ]
          action: [
            (C {(echo)} 
              {
                (DQ ('Tracing exec()s') ($ VSub_Name '$ftext') (' for ') ($ VSub_Name '$duration') 
                  (' seconds (buffered)...')
                )
              }
            )
          ]
          spids: [16777215 699]
        )
      ]
      else_action: [(C {(echo)} {(DQ ('Tracing exec()s') ($ VSub_Name '$ftext') ('. Ctrl-C to end.'))})]
      spids: [712 723]
    )
    (If
      arms: [
        (if_arm
          cond: [
            (Sentence
              child: (DParen child:(ArithVarRef name:opt_duration))
              terminator: <Op_Semi ';'>
            )
          ]
          action: [
            (AndOr
              ops: [Op_DAmp Op_DPipe]
              children: [
                (DBracket expr:(BoolUnary op_id:BoolUnary_x child:{(/usr/bin/mawk)}))
                (Assignment
                  keyword: Assign_None
                  pairs: [(assign_pair lhs:(LhsName name:awk) op:Equal rhs:{(mawk)} spids:[752])]
                  spids: [752]
                )
                (Assignment
                  keyword: Assign_None
                  pairs: [(assign_pair lhs:(LhsName name:awk) op:Equal rhs:{(awk)} spids:[757])]
                  spids: [757]
                )
              ]
            )
          ]
          spids: [16777215 739]
        )
      ]
      else_action: [
        (If
          arms: [
            (if_arm
              cond: [
                (Sentence
                  child: (DBracket expr:(BoolUnary op_id:BoolUnary_x child:{(/usr/bin/gawk)}))
                  terminator: <Op_Semi ';'>
                )
              ]
              action: [
                (Assignment
                  keyword: Assign_None
                  pairs: [(assign_pair lhs:(LhsName name:awk) op:Equal rhs:{(gawk)} spids:[781])]
                  spids: [781]
                )
              ]
              spids: [16777215 778]
            )
            (if_arm
              cond: [
                (Sentence
                  child: (DBracket expr:(BoolUnary op_id:BoolUnary_x child:{(/usr/bin/mawk)}))
                  terminator: <Op_Semi ';'>
                )
              ]
              action: [
                (Assignment
                  keyword: Assign_None
                  pairs: [
                    (assign_pair
                      lhs: (LhsName name:awk)
                      op: Equal
                      rhs: {(DQ ('mawk -W interactive'))}
                      spids: [799]
                    )
                  ]
                  spids: [799]
                )
              ]
              spids: [785 796]
            )
          ]
          else_action: [
            (Assignment
              keyword: Assign_None
              pairs: [(assign_pair lhs:(LhsName name:awk) op:Equal rhs:{(awk)} spids:[808])]
              spids: [808]
            )
          ]
          spids: [805 812]
        )
      ]
      spids: [760 814]
    )
    (AndOr
      ops: [Op_DPipe]
      children: [
        (C {(cd)} {($ VSub_Name '$tracing')})
        (C {(die)} 
          {
            (DQ ('ERROR: accessing tracing. Root user? Kernel has FTRACE?\n') 
              ('    debugfs mounted? (mount -t debugfs debugfs /sys/kernel/debug)')
            )
          }
        )
      ]
    )
    (AndOr
      ops: [Op_DAmp]
      children: [
        (DBracket expr:(BoolUnary op_id:BoolUnary_e child:{($ VSub_Name '$flock')}))
        (C {(die)} 
          {
            (DQ ('ERROR: ftrace may be in use by PID ') 
              (CommandSubPart
                command_list: (CommandList children:[(C {(cat)} {($ VSub_Name '$flock')})])
                left_token: <Left_CommandSub '$('>
                spids: [851 855]
              ) (' ') ($ VSub_Name '$flock')
            )
          }
        )
      ]
    )
    (AndOr
      ops: [Op_DPipe]
      children: [
        (SimpleCommand
          words: [{(echo)} {($ VSub_Dollar '$$')}]
          redirects: [
            (Redir
              op_id: Redir_Great
              fd: 16777215
              arg_word: {($ VSub_Name '$flock')}
              spids: [864]
            )
          ]
        )
        (C {(die)} {(DQ ('ERROR: unable to write ') ($ VSub_Name '$flock') (.))})
      ]
    )
    (Assignment
      keyword: Assign_None
      pairs: [(assign_pair lhs:(LhsName name:wroteflock) op:Equal rhs:{(1)} spids:[878])]
      spids: [878]
    )
    (If
      arms: [
        (if_arm
          cond: [
            (Sentence
              child: (DBracket expr:(BoolUnary op_id:BoolUnary_x child:{(/usr/bin/getconf)}))
              terminator: <Op_Semi ';'>
            )
          ]
          action: [
            (Assignment
              keyword: Assign_None
              pairs: [
                (assign_pair
                  lhs: (LhsName name:bits)
                  op: Equal
                  rhs: 
                    {
                      (CommandSubPart
                        command_list: (CommandList children:[(C {(getconf)} {(LONG_BIT)})])
                        left_token: <Left_CommandSub '$('>
                        spids: [900 904]
                      )
                    }
                  spids: [899]
                )
              ]
              spids: [899]
            )
          ]
          spids: [16777215 896]
        )
      ]
      else_action: [
        (Assignment
          keyword: Assign_None
          pairs: [(assign_pair lhs:(LhsName name:bits) op:Equal rhs:{(64)} spids:[909])]
          spids: [909]
        )
        (AndOr
          ops: [Op_DAmp]
          children: [
            (DBracket
              expr: 
                (BoolBinary
                  op_id: BoolBinary_GlobDEqual
                  left: 
                    {
                      (CommandSubPart
                        command_list: (CommandList children:[(C {(uname)} {(-m)})])
                        left_token: <Left_CommandSub '$('>
                        spids: [915 919]
                      )
                    }
                  right: {(i) (Lit_Other '*')}
                )
            )
            (Assignment
              keyword: Assign_None
              pairs: [(assign_pair lhs:(LhsName name:bits) op:Equal rhs:{(32)} spids:[930])]
              spids: [930]
            )
          ]
        )
      ]
      spids: [906 933]
    )
    (DParen
      child: 
        (BinaryAssign
          op_id: Arith_Equal
          left: (LhsName name:offset)
          right: 
            (ArithBinary
              op_id: Arith_Slash
              left: (ArithVarRef name:bits)
              right: (ArithWord w:{(Lit_Digits 8)})
            )
        )
    )
    (FuncDef
      name: makeprobe
      body: 
        (BraceGroup
          children: [
            (Assignment
              keyword: Assign_None
              pairs: [
                (assign_pair
                  lhs: (LhsName name:func)
                  op: Equal
                  rhs: {($ VSub_Number '$1')}
                  spids: [957]
                )
              ]
              spids: [957]
            )
            (Assignment
              keyword: Assign_None
              pairs: [
                (assign_pair
                  lhs: (LhsName name:kname)
                  op: Equal
                  rhs: {(execsnoop_) ($ VSub_Name '$func')}
                  spids: [961]
                )
              ]
              spids: [961]
            )
            (Assignment
              keyword: Assign_None
              pairs: [
                (assign_pair
                  lhs: (LhsName name:kprobe)
                  op: Equal
                  rhs: {(DQ ('p:') ($ VSub_Name '$kname') (' ') ($ VSub_Name '$func'))}
                  spids: [966]
                )
              ]
              spids: [966]
            )
            (Assignment
              keyword: Assign_None
              pairs: [(assign_pair lhs:(LhsName name:i) op:Equal rhs:{(0)} spids:[975])]
              spids: [975]
            )
            (While
              cond: [
                (Sentence
                  child: 
                    (DParen
                      child: 
                        (ArithBinary
                          op_id: Arith_Less
                          left: (ArithVarRef name:i)
                          right: 
                            (ArithBinary
                              op_id: Arith_Plus
                              left: (ArithVarRef name:argc)
                              right: (ArithWord w:{(Lit_Digits 1)})
                            )
                        )
                    )
                  terminator: <Op_Semi ';'>
                )
              ]
              body: 
                (DoGroup
                  children: [
                    (Assignment
                      keyword: Assign_None
                      pairs: [
                        (assign_pair
                          lhs: (LhsName name:kprobe)
                          op: Equal
                          rhs: 
                            {
                              (DQ ($ VSub_Name '$kprobe') (' +0(+') 
                                (ArithSubPart
                                  anode: 
                                    (ArithBinary
                                      op_id: Arith_Star
                                      left: (ArithVarRef name:i)
                                      right: (ArithVarRef name:offset)
                                    )
                                  spids: [1008 1017]
                                ) ('(%si)):string')
                              )
                            }
                          spids: [1004]
                        )
                      ]
                      spids: [1004]
                    )
                    (DParen
                      child: (UnaryAssign op_id:Node_PostDPlus child:(LhsName name:i))
                    )
                  ]
                  spids: [997 1031]
                )
            )
          ]
          spids: [954]
        )
      spids: [950 953]
    )
    (C {(makeprobe)} {(sys_execve)})
    (SimpleCommand
      words: [{(echo)} {(nop)}]
      redirects: [(Redir op_id:Redir_Great fd:16777215 arg_word:{(current_tracer)} spids:[1050])]
    )
    (If
      arms: [
        (if_arm
          cond: [
            (Sentence
              child: 
                (Pipeline
                  children: [
                    (SimpleCommand
                      words: [{(echo)} {($ VSub_Name '$kprobe')}]
                      redirects: [
                        (Redir
                          op_id: Redir_DGreat
                          fd: 16777215
                          arg_word: {(kprobe_events)}
                          spids: [1062]
                        )
                        (Redir
                          op_id: Redir_Great
                          fd: 2
                          arg_word: {(/dev/null)}
                          spids: [1066]
                        )
                      ]
                    )
                  ]
                  negated: T
                )
              terminator: <Op_Semi ';'>
            )
          ]
          action: [
            (C {(makeprobe)} {(stub_execve)})
            (If
              arms: [
                (if_arm
                  cond: [
                    (Sentence
                      child: 
                        (Pipeline
                          children: [
                            (SimpleCommand
                              words: [{(echo)} {($ VSub_Name '$kprobe')}]
                              redirects: [
                                (Redir
                                  op_id: Redir_DGreat
                                  fd: 16777215
                                  arg_word: {(kprobe_events)}
                                  spids: [1086]
                                )
                                (Redir
                                  op_id: Redir_Great
                                  fd: 2
                                  arg_word: {(/dev/null)}
                                  spids: [1090]
                                )
                              ]
                            )
                          ]
                          negated: T
                        )
                      terminator: <Op_Semi ';'>
                    )
                  ]
                  action: [
                    (C {(makeprobe)} {(do_execve)})
                    (If
                      arms: [
                        (if_arm
                          cond: [
                            (Sentence
                              child: 
                                (Pipeline
                                  children: [
                                    (SimpleCommand
                                      words: [{(echo)} {($ VSub_Name '$kprobe')}]
                                      redirects: [
                                        (Redir
                                          op_id: Redir_DGreat
                                          fd: 16777215
                                          arg_word: {(kprobe_events)}
                                          spids: [1110]
                                        )
                                        (Redir
                                          op_id: Redir_Great
                                          fd: 2
                                          arg_word: {(/dev/null)}
                                          spids: [1114]
                                        )
                                      ]
                                    )
                                  ]
                                  negated: T
                                )
                              terminator: <Op_Semi ';'>
                            )
                          ]
                          action: [(C {(edie)} {(DQ ('ERROR: adding a kprobe for execve. Exiting.'))})]
                          spids: [16777215 1118]
                        )
                      ]
                      spids: [16777215 1128]
                    )
                  ]
                  spids: [16777215 1094]
                )
              ]
              spids: [16777215 1131]
            )
          ]
          spids: [16777215 1070]
        )
      ]
      spids: [16777215 1133]
    )
    (If
      arms: [
        (if_arm
          cond: [
            (Sentence
              child: 
                (Pipeline
                  children: [
                    (SimpleCommand
                      words: [{(echo)} {(1)}]
                      redirects: [
                        (Redir
                          op_id: Redir_Great
                          fd: 16777215
                          arg_word: {(events/kprobes/) ($ VSub_Name '$kname') (/enable)}
                          spids: [1143]
                        )
                      ]
                    )
                  ]
                  negated: T
                )
              terminator: <Op_Semi ';'>
            )
          ]
          action: [(C {(edie)} {(DQ ('ERROR: enabling kprobe for execve. Exiting.'))})]
          spids: [16777215 1150]
        )
      ]
      spids: [16777215 1159]
    )
    (If
      arms: [
        (if_arm
          cond: [
            (Sentence
              child: 
                (Pipeline
                  children: [
                    (SimpleCommand
                      words: [{(echo)} {(1)}]
                      redirects: [
                        (Redir
                          op_id: Redir_Great
                          fd: 16777215
                          arg_word: {(events/sched/sched_process_fork/enable)}
                          spids: [1169]
                        )
                      ]
                    )
                  ]
                  negated: T
                )
              terminator: <Op_Semi ';'>
            )
          ]
          action: [(C {(edie)} {(DQ ('ERROR: enabling sched:sched_process_fork tracepoint. Exiting.'))})]
          spids: [16777215 1174]
        )
      ]
      spids: [16777215 1183]
    )
    (C {(echo)} {(DQ ('Instrumenting ') ($ VSub_Name '$func'))})
    (AndOr
      ops: [Op_DAmp]
      children: [
        (DParen child:(ArithVarRef name:opt_time))
        (C {(printf)} {(DQ ('%-16s '))} {(DQ (TIMEs))})
      ]
    )
    (C {(printf)} {(DQ ('%6s %6s %s') (Lit_Other '\\') (n))} {(DQ (PID))} {(DQ (PPID))} {(DQ (ARGS))})
    (Assignment
      keyword: Assign_None
      pairs: [
        (assign_pair
          lhs: (LhsName name:offset)
          op: Equal
          rhs: 
            {
              (CommandSubPart
                command_list: 
                  (CommandList
                    children: [
                      (C {($ VSub_Name '$awk')} 
                        {
                          (SQ <'BEGIN { o = 0; }\n'> 
                            <'\t$1 == "#" && $2 ~ /TASK/ && NF == 6 { o = 1; }\n'> <'\t$2 ~ /TASK/ { print o; exit }'>
                          )
                        } {(trace)}
                      )
                    ]
                  )
                left_token: <Left_CommandSub '$('>
                spids: [1254 1264]
              )
            }
          spids: [1253]
        )
      ]
      spids: [1253]
    )
    (C {(warn)} {(DQ ('echo > trace'))})
    (Pipeline
      children: [
        (Subshell
          child: 
            (If
              arms: [
                (if_arm
                  cond: [
                    (Sentence
                      child: (DParen child:(ArithVarRef name:opt_duration))
                      terminator: <Op_Semi ';'>
                    )
                  ]
                  action: [(C {(sleep)} {($ VSub_Name '$duration')}) (C {(cat)} {(-v)} {(trace)})]
                  spids: [16777215 1288]
                )
              ]
              else_action: [(C {(cat)} {(-v)} {(trace_pipe)})]
              spids: [1306 1319]
            )
          spids: [1276 1321]
        )
        (C {($ VSub_Name '$awk')} {(-v)} {(Lit_VarLike 'o=') ($ VSub_Name '$offset')} {(-v)} 
          {(Lit_VarLike 'opt_name=') ($ VSub_Name '$opt_name')} {(-v)} {(Lit_VarLike 'name=') ($ VSub_Name '$name')} {(-v)} 
          {(Lit_VarLike 'opt_duration=') ($ VSub_Name '$opt_duration')} {(-v)} {(Lit_VarLike 'opt_time=') ($ VSub_Name '$opt_time')} {(-v)} 
          {(Lit_VarLike 'kname=') ($ VSub_Name '$kname')} {(-v)} {(Lit_VarLike 'opt_reexec=') ($ VSub_Name '$opt_reexec')} 
          {
            (SQ <'\n'> <'\t# common fields\n'> <'\t$1 != "#" {\n'> 
              <'\t\t# task name can contain dashes\n'> <'\t\tcomm = pid = $1\n'> <'\t\tsub(/-[0-9][0-9]*/, "", comm)\n'> <'\t\tsub(/.*-/, "", pid)\n'> 
              <'\t}\n'> <'\n'> <'\t$1 != "#" && $(4+o) ~ /sched_process_fork/ {\n'> <'\t\tcpid=$0\n'> 
              <'\t\tsub(/.* child_pid=/, "", cpid)\n'> <'\t\tsub(/ .*/, "", cpid)\n'> <'\t\tgetppid[cpid] = pid\n'> <'\t\tdelete seen[pid]\n'> <'\t}\n'> <'\n'> 
              <'\t$1 != "#" && $(4+o) ~ kname {\n'> <'\t\tif (seen[pid])\n'> <'\t\t\tnext\n'> <'\t\tif (opt_name && comm !~ name)\n'> <'\t\t\tnext\n'> <'\n'> 
              <'\t\t#\n'> <'\t\t# examples:\n'> <'\t\t# ... arg1="/bin/echo" arg2="1" arg3="2" arg4="3" ...\n'> 
              <'\t\t# ... arg1="sleep" arg2="2" arg3=(fault) arg4="" ...\n'> <'\t\t# ... arg1="" arg2=(fault) arg3="" arg4="" ...\n'> 
              <'\t\t# the last example is uncommon, and may be a race.\n'> <'\t\t#\n'> <'\t\tif ($0 ~ /arg1=""/) {\n'> <'\t\t\targs = comm " [?]"\n'> <'\t\t} else {\n'> 
              <'\t\t\targs=$0\n'> <'\t\t\tsub(/ arg[0-9]*=\\(fault\\).*/, "", args)\n'> <'\t\t\tsub(/.*arg1="/, "", args)\n'> 
              <'\t\t\tgsub(/" arg[0-9]*="/, " ", args)\n'> <'\t\t\tsub(/"$/, "", args)\n'> <'\t\t\tif ($0 !~ /\\(fault\\)/)\n'> <'\t\t\t\targs = args " [...]"\n'> 
              <'\t\t}\n'> <'\n'> <'\t\tif (opt_time) {\n'> <'\t\t\ttime = $(3+o); sub(":", "", time)\n'> 
              <'\t\t\tprintf "%-16s ", time\n'> <'\t\t}\n'> <'\t\tprintf "%6s %6d %s\\n", pid, getppid[pid], args\n'> <'\t\tif (!opt_duration)\n'> 
              <'\t\t\tfflush()\n'> <'\t\tif (!opt_reexec) {\n'> <'\t\t\tseen[pid] = 1\n'> <'\t\t\tdelete getppid[pid]\n'> <'\t\t}\n'> 
              <'\t}\n'> <'\n'> <'\t$0 ~ /LOST.*EVENT[S]/ { print "WARNING: " $0 > "/dev/stderr" }\n'>
            )
          }
        )
      ]
      negated: F
    )
    (C {(end)})
  ]
)