(command.CommandList children: [ (command.Assignment keyword: Assign_None pairs: [ (assign_pair lhs: (lhs_expr.LhsName name:tracing spids:[142]) op: Equal rhs: {(/sys/kernel/debug/tracing)} spids: [142] ) ] spids: [142] ) (command.CommandList children: [ (command.Sentence child: (command.Assignment keyword: Assign_None pairs: [ (assign_pair lhs: (lhs_expr.LhsName name:flock spids:[145]) op: Equal rhs: {(/var/tmp/.ftrace-lock)} spids: [145] ) ] spids: [145] ) terminator: <Op_Semi ';'> ) (command.Assignment keyword: Assign_None pairs: [ (assign_pair lhs: (lhs_expr.LhsName name:wroteflock spids:[149]) op: Equal rhs: {(0)} spids: [149] ) ] spids: [149] ) ] ) (command.CommandList children: [ (command.Sentence child: (command.Assignment keyword: Assign_None pairs: [ (assign_pair lhs: (lhs_expr.LhsName name:opt_duration spids:[152]) op: Equal rhs: {(0)} spids: [152] ) ] spids: [152] ) terminator: <Op_Semi ';'> ) (command.Sentence child: (command.Assignment keyword: Assign_None pairs: [ (assign_pair lhs: (lhs_expr.LhsName name:duration spids:[156]) op: Equal rhs: (word.EmptyWord) spids: [156] ) ] spids: [156] ) terminator: <Op_Semi ';'> ) (command.Sentence child: (command.Assignment keyword: Assign_None pairs: [ (assign_pair lhs: (lhs_expr.LhsName name:opt_name spids:[159]) op: Equal rhs: {(0)} spids: [159] ) ] spids: [159] ) terminator: <Op_Semi ';'> ) (command.Sentence child: (command.Assignment keyword: Assign_None pairs: [ (assign_pair lhs: (lhs_expr.LhsName name:name spids:[163]) op: Equal rhs: (word.EmptyWord) spids: [163] ) ] spids: [163] ) terminator: <Op_Semi ';'> ) (command.Sentence child: (command.Assignment keyword: Assign_None pairs: [ (assign_pair lhs: (lhs_expr.LhsName name:opt_pid spids:[166]) op: Equal rhs: {(0)} spids: [166] ) ] spids: [166] ) terminator: <Op_Semi ';'> ) (command.Sentence child: (command.Assignment keyword: Assign_None pairs: [ (assign_pair lhs: (lhs_expr.LhsName name:pid spids:[170]) op: Equal rhs: (word.EmptyWord) spids: [170] ) ] spids: [170] ) terminator: <Op_Semi ';'> ) (command.Sentence child: (command.Assignment keyword: Assign_None pairs: [ (assign_pair lhs: (lhs_expr.LhsName name:opt_tid spids:[173]) op: Equal rhs: {(0)} spids: [173] ) ] spids: [173] ) terminator: <Op_Semi ';'> ) (command.Assignment keyword: Assign_None pairs: [ (assign_pair lhs: (lhs_expr.LhsName name:tid spids:[177]) op: Equal rhs: (word.EmptyWord) spids: [177] ) ] spids: [177] ) ] ) (command.CommandList children: [ (command.Sentence child: (command.Assignment keyword: Assign_None pairs: [ (assign_pair lhs: (lhs_expr.LhsName name:ftext spids:[179]) op: Equal rhs: (word.EmptyWord) spids: [179] ) ] spids: [179] ) terminator: <Op_Semi ';'> ) (command.Sentence child: (command.Assignment keyword: Assign_None pairs: [ (assign_pair lhs: (lhs_expr.LhsName name:opt_time spids:[182]) op: Equal rhs: {(0)} spids: [182] ) ] spids: [182] ) terminator: <Op_Semi ';'> ) (command.Sentence child: (command.Assignment keyword: Assign_None pairs: [ (assign_pair lhs: (lhs_expr.LhsName name:opt_fail spids:[186]) op: Equal rhs: {(0)} spids: [186] ) ] spids: [186] ) terminator: <Op_Semi ';'> ) (command.Sentence child: (command.Assignment keyword: Assign_None pairs: [ (assign_pair lhs: (lhs_expr.LhsName name:opt_file spids:[190]) op: Equal rhs: {(0)} spids: [190] ) ] spids: [190] ) terminator: <Op_Semi ';'> ) (command.Assignment keyword: Assign_None pairs: [ (assign_pair lhs: (lhs_expr.LhsName name:file spids:[194]) op: Equal rhs: (word.EmptyWord) spids: [194] ) ] spids: [194] ) ] ) (C {(trap)} {(SQ <':'>)} {(INT)} {(QUIT)} {(TERM)} {(PIPE)} {(HUP)}) (command.FuncDef name: usage body: (command.BraceGroup children: [ (command.SimpleCommand words: [{(cat)}] redirects: [ (redir.HereDoc op: <Redir_DLessDash '<<-'> fd: 16777215 here_begin: {(END)} here_end_span_id: 259 stdin_parts: [ ('USAGE: opensnoop [-htx] [-d secs] [-p PID] [-L TID] [-n name] [filename]\n') (' -d seconds # trace duration, and use buffers\n') (' -n name # process name to match on open\n') (' -p PID # PID to match on open\n') (' -L TID # PID to match on open\n') (' -t # include time (seconds)\n') (' -x # only show failed opens\n') (' -h # this usage message\n') (' filename # match filename (partials, REs, ok)\n') (' eg,\n') (' opensnoop # watch open()s live (unbuffered)\n') (' opensnoop -d 1 # trace 1 sec (buffered)\n') (' opensnoop -p 181 # trace I/O issued by PID 181 only\n') (' opensnoop conf # trace filenames containing ') (Right_DoubleQuote '"') (conf) (Right_DoubleQuote '"') ('\n') (" opensnoop 'log") (Lit_Other '$') ("' # filenames ending in ") (Right_DoubleQuote '"') (log) (Right_DoubleQuote '"') ('\n') ('\n') ('See the man page and example file for more info.\n') ] ) (redir.Redir op:<Redir_GreatAnd '>&'> fd:16777215 arg_word:{(2)}) ] ) (command.ControlFlow token:<ControlFlow_Exit exit>) ] spids: [220] ) spids: [216 219] ) (command.FuncDef name: warn body: (command.BraceGroup children: [ (command.If arms: [ (if_arm cond: [ (command.Sentence child: (command.Pipeline children: [(C {(eval)} {(DQ ($ VSub_At '$@'))})] negated: T ) terminator: <Op_Semi ';'> ) ] action: [ (command.SimpleCommand words: [ {(echo)} { (DQ ('WARNING: command failed ') (word_part.EscapedLiteralPart token: <Lit_EscapedChar '\\"'> ) ($ VSub_At '$@') (word_part.EscapedLiteralPart token:<Lit_EscapedChar '\\"'>) ) } ] redirects: [(redir.Redir op:<Redir_GreatAnd '>&'> fd:16777215 arg_word:{(2)})] ) ] spids: [16777215 284] ) ] spids: [16777215 300] ) ] spids: [270] ) spids: [266 269] ) (command.FuncDef name: end body: (command.BraceGroup children: [ (command.SimpleCommand words: [{(echo)}] redirects: [(redir.Redir op:<Redir_Great '2>'> fd:2 arg_word:{(/dev/null)})] ) (command.SimpleCommand words: [{(echo)} {(DQ ('Ending tracing...'))}] redirects: [(redir.Redir op:<Redir_Great '2>'> fd:2 arg_word:{(/dev/null)})] ) (C {(cd)} {($ VSub_DollarName '$tracing')}) (C {(warn)} {(DQ ('echo 0 > events/kprobes/getnameprobe/enable'))}) (C {(warn)} {(DQ ('echo 0 > events/syscalls/sys_exit_open/enable'))}) (command.If arms: [ (if_arm cond: [ (command.Sentence child: (command.DParen child: (arith_expr.ArithBinary op_id: Arith_DPipe left: (arith_expr.ArithVarRef token:<Lit_ArithVarLike opt_pid>) right: (arith_expr.ArithVarRef token:<Lit_ArithVarLike opt_tid>) ) spids: [353 362] ) terminator: <Op_Semi ';'> ) ] action: [ (C {(warn)} {(DQ ('echo 0 > events/kprobes/getnameprobe/filter'))}) (C {(warn)} {(DQ ('echo 0 > events/syscalls/sys_exit_open/filter'))}) ] spids: [16777215 365] ) ] spids: [16777215 382] ) (C {(warn)} {(DQ ('echo -:getnameprobe >> kprobe_events'))}) (C {(warn)} {(DQ ('echo > trace'))}) (command.AndOr ops: [Op_DAmp] children: [ (command.DParen child: (arith_expr.ArithVarRef token:<Lit_ArithVarLike wroteflock>) spids: [399 404] ) (C {(warn)} {(DQ ('rm ') ($ VSub_DollarName '$flock'))}) ] ) ] spids: [309] ) spids: [305 308] ) (command.FuncDef name: die body: (command.BraceGroup children: [ (command.SimpleCommand words: [{(echo)} {(DQ ($ VSub_At '$@'))}] redirects: [(redir.Redir op:<Redir_GreatAnd '>&'> fd:16777215 arg_word:{(2)})] ) (command.ControlFlow token:<ControlFlow_Exit exit> arg_word:{(1)}) ] spids: [422] ) spids: [418 421] ) (command.FuncDef name: edie body: (command.BraceGroup children: [ (command.SimpleCommand words: [{(echo)} {(DQ ($ VSub_At '$@'))}] redirects: [(redir.Redir op:<Redir_GreatAnd '>&'> fd:16777215 arg_word:{(2)})] ) (command.SimpleCommand words: [{(exec)}] redirects: [ (redir.Redir op:<Redir_Great '>'> fd:16777215 arg_word:{(/dev/null)}) (redir.Redir op:<Redir_GreatAnd '2>&'> fd:2 arg_word:{(1)}) ] ) (C {(end)}) (command.ControlFlow token:<ControlFlow_Exit exit> arg_word:{(1)}) ] spids: [446] ) spids: [442 445] ) (command.WhileUntil keyword: <KW_While while> cond: [ (C {(getopts)} {(d) (Lit_Other ':') (hn) (Lit_Other ':') (p) (Lit_Other ':') (L) (Lit_Other ':') (tx)} {(opt)} ) ] body: (command.DoGroup children: [ (command.Case to_match: {($ VSub_DollarName '$opt')} arms: [ (case_arm pat_list: [{(d)}] action: [ (command.Sentence child: (command.Assignment keyword: Assign_None pairs: [ (assign_pair lhs: (lhs_expr.LhsName name:opt_duration spids:[514]) op: Equal rhs: {(1)} spids: [514] ) ] spids: [514] ) terminator: <Op_Semi ';'> ) (command.Assignment keyword: Assign_None pairs: [ (assign_pair lhs: (lhs_expr.LhsName name:duration spids:[518]) op: Equal rhs: {($ VSub_DollarName '$OPTARG')} spids: [518] ) ] spids: [518] ) ] spids: [511 512 521 16777215] ) (case_arm pat_list: [{(n)}] action: [ (command.Sentence child: (command.Assignment keyword: Assign_None pairs: [ (assign_pair lhs: (lhs_expr.LhsName name:opt_name spids:[527]) op: Equal rhs: {(1)} spids: [527] ) ] spids: [527] ) terminator: <Op_Semi ';'> ) (command.Assignment keyword: Assign_None pairs: [ (assign_pair lhs: (lhs_expr.LhsName name:name spids:[531]) op: Equal rhs: {($ VSub_DollarName '$OPTARG')} spids: [531] ) ] spids: [531] ) ] spids: [524 525 534 16777215] ) (case_arm pat_list: [{(p)}] action: [ (command.Sentence child: (command.Assignment keyword: Assign_None pairs: [ (assign_pair lhs: (lhs_expr.LhsName name:opt_pid spids:[540]) op: Equal rhs: {(1)} spids: [540] ) ] spids: [540] ) terminator: <Op_Semi ';'> ) (command.Assignment keyword: Assign_None pairs: [ (assign_pair lhs: (lhs_expr.LhsName name:pid spids:[544]) op: Equal rhs: {($ VSub_DollarName '$OPTARG')} spids: [544] ) ] spids: [544] ) ] spids: [537 538 547 16777215] ) (case_arm pat_list: [{(L)}] action: [ (command.Sentence child: (command.Assignment keyword: Assign_None pairs: [ (assign_pair lhs: (lhs_expr.LhsName name:opt_tid spids:[553]) op: Equal rhs: {(1)} spids: [553] ) ] spids: [553] ) terminator: <Op_Semi ';'> ) (command.Assignment keyword: Assign_None pairs: [ (assign_pair lhs: (lhs_expr.LhsName name:tid spids:[557]) op: Equal rhs: {($ VSub_DollarName '$OPTARG')} spids: [557] ) ] spids: [557] ) ] spids: [550 551 560 16777215] ) (case_arm pat_list: [{(t)}] action: [ (command.Assignment keyword: Assign_None pairs: [ (assign_pair lhs: (lhs_expr.LhsName name:opt_time spids:[566]) op: Equal rhs: {(1)} spids: [566] ) ] spids: [566] ) ] spids: [563 564 569 16777215] ) (case_arm pat_list: [{(x)}] action: [ (command.Assignment keyword: Assign_None pairs: [ (assign_pair lhs: (lhs_expr.LhsName name:opt_fail spids:[575]) op: Equal rhs: {(1)} spids: [575] ) ] spids: [575] ) ] spids: [572 573 578 16777215] ) (case_arm pat_list: [{(h)} {(Lit_Other '?')}] action: [(C {(usage)})] spids: [581 584 588 16777215] ) ] spids: [504 508 591] ) ] spids: [501 593] ) ) (C {(shift)} { (word_part.ArithSubPart anode: (arith_expr.ArithBinary op_id: Arith_Minus left: (arith_expr.ArithWord w:{($ VSub_DollarName '$OPTIND')}) right: (arith_expr.ArithWord w:{(Lit_Digits 1)}) ) spids: [597 606] ) } ) (command.If arms: [ (if_arm cond: [ (command.Sentence child: (command.DParen child: (arith_expr.ArithWord w:{($ VSub_Pound '$#')}) spids: [610 615] ) terminator: <Op_Semi ';'> ) ] action: [ (command.Assignment keyword: Assign_None pairs: [ (assign_pair lhs: (lhs_expr.LhsName name:opt_file spids:[621]) op: Equal rhs: {(1)} spids: [621] ) ] spids: [621] ) (command.Assignment keyword: Assign_None pairs: [ (assign_pair lhs: (lhs_expr.LhsName name:file spids:[625]) op: Equal rhs: {($ VSub_Number '$1')} spids: [625] ) ] spids: [625] ) (C {(shift)}) ] spids: [16777215 618] ) ] spids: [16777215 631] ) (command.AndOr ops: [Op_DAmp] children: [ (command.DParen child:(arith_expr.ArithWord w:{($ VSub_Pound '$#')}) spids:[633 638]) (C {(usage)}) ] ) (command.AndOr ops: [Op_DAmp] children: [ (command.DParen child: (arith_expr.ArithBinary op_id: Arith_Great left: (arith_expr.ArithBinary op_id: Arith_Plus left: (arith_expr.ArithBinary op_id: Arith_Plus left: (arith_expr.ArithVarRef token:<Lit_ArithVarLike opt_pid>) right: (arith_expr.ArithVarRef token:<Lit_ArithVarLike opt_name>) ) right: (arith_expr.ArithVarRef token:<Lit_ArithVarLike opt_tid>) ) right: (arith_expr.ArithWord w:{(Lit_Digits 1)}) ) spids: [648 665] ) (C {(die)} {(DQ ('ERROR: use at most one of -p, -n, -L.'))}) ] ) (command.AndOr ops: [Op_DAmp] children: [ (command.DParen child: (arith_expr.ArithVarRef token:<Lit_ArithVarLike opt_pid>) spids: [677 682] ) (command.Assignment keyword: Assign_None pairs: [ (assign_pair lhs: (lhs_expr.LhsName name:ftext spids:[686]) op: Equal rhs: {(DQ (' issued by PID ') ($ VSub_DollarName '$pid'))} spids: [686] ) ] spids: [686] ) ] ) (command.AndOr ops: [Op_DAmp] children: [ (command.DParen child: (arith_expr.ArithVarRef token:<Lit_ArithVarLike opt_tid>) spids: [692 697] ) (command.Assignment keyword: Assign_None pairs: [ (assign_pair lhs: (lhs_expr.LhsName name:ftext spids:[701]) op: Equal rhs: {(DQ (' issued by TID ') ($ VSub_DollarName '$tid'))} spids: [701] ) ] spids: [701] ) ] ) (command.AndOr ops: [Op_DAmp] children: [ (command.DParen child: (arith_expr.ArithVarRef token:<Lit_ArithVarLike opt_name>) spids: [707 712] ) (command.Assignment keyword: Assign_None pairs: [ (assign_pair lhs: (lhs_expr.LhsName name:ftext spids:[716]) op: Equal rhs: { (DQ (' issued by process name ') (word_part.EscapedLiteralPart token:<Lit_EscapedChar '\\"'>) ($ VSub_DollarName '$name') (word_part.EscapedLiteralPart token:<Lit_EscapedChar '\\"'>) ) } spids: [716] ) ] spids: [716] ) ] ) (command.AndOr ops: [Op_DAmp] children: [ (command.DParen child: (arith_expr.ArithVarRef token:<Lit_ArithVarLike opt_file>) spids: [724 729] ) (command.Assignment keyword: Assign_None pairs: [ (assign_pair lhs: (lhs_expr.LhsName name:ftext spids:[733]) op: Equal rhs: { (DQ ($ VSub_DollarName '$ftext') (' for filenames containing ') (word_part.EscapedLiteralPart token:<Lit_EscapedChar '\\"'>) ($ VSub_DollarName '$file') (word_part.EscapedLiteralPart token:<Lit_EscapedChar '\\"'>) ) } spids: [733] ) ] spids: [733] ) ] ) (command.If arms: [ (if_arm cond: [ (command.Sentence child: (command.DParen child: (arith_expr.ArithVarRef token:<Lit_ArithVarLike opt_duration>) spids: [744 749] ) terminator: <Op_Semi ';'> ) ] action: [ (C {(echo)} { (DQ ('Tracing open()s') ($ VSub_DollarName '$ftext') (' for ') ($ VSub_DollarName '$duration') (' seconds (buffered)...') ) } ) ] spids: [16777215 752] ) ] else_action: [ (C {(echo)} {(DQ ('Tracing open()s') ($ VSub_DollarName '$ftext') ('. Ctrl-C to end.'))}) ] spids: [765 776] ) (command.AndOr ops: [Op_DAmp Op_DPipe] children: [ (command.DParen child: (arith_expr.ArithVarRef token:<Lit_ArithVarLike opt_duration>) spids: [782 787] ) (command.Assignment keyword: Assign_None pairs: [ (assign_pair lhs: (lhs_expr.LhsName name:use spids:[791]) op: Equal rhs: {(mawk)} spids: [791] ) ] spids: [791] ) (command.Assignment keyword: Assign_None pairs: [ (assign_pair lhs: (lhs_expr.LhsName name:use spids:[796]) op: Equal rhs: {(gawk)} spids: [796] ) ] spids: [796] ) ] ) (command.AndOr ops: [Op_DAmp Op_DPipe] children: [ (command.DBracket expr: (bool_expr.BoolUnary op_id:BoolUnary_x child:{(/usr/bin/) ($ VSub_DollarName '$use')}) ) (command.Assignment keyword: Assign_None pairs: [ (assign_pair lhs: (lhs_expr.LhsName name:awk spids:[813]) op: Equal rhs: {($ VSub_DollarName '$use')} spids: [813] ) ] spids: [813] ) (command.Assignment keyword: Assign_None pairs: [ (assign_pair lhs: (lhs_expr.LhsName name:awk spids:[818]) op: Equal rhs: {(awk)} spids: [818] ) ] spids: [818] ) ] ) (command.AndOr ops: [Op_DPipe] children: [ (C {(cd)} {($ VSub_DollarName '$tracing')}) (C {(die)} { (DQ ('ERROR: accessing tracing. Root user? Kernel has FTRACE?\n') (' debugfs mounted? (mount -t debugfs debugfs /sys/kernel/debug)') ) } ) ] ) (command.AndOr ops: [Op_DAmp] children: [ (command.DBracket expr: (bool_expr.BoolUnary op_id:BoolUnary_e child:{($ VSub_DollarName '$flock')}) ) (C {(die)} { (DQ ('ERROR: ftrace may be in use by PID ') (word_part.CommandSubPart command_list: (command.CommandList children: [(C {(cat)} {($ VSub_DollarName '$flock')})] ) left_token: <Left_CommandSub '$('> spids: [856 860] ) (' ') ($ VSub_DollarName '$flock') ) } ) ] ) (command.AndOr ops: [Op_DPipe] children: [ (command.SimpleCommand words: [{(echo)} {($ VSub_Dollar '$$')}] redirects: [ (redir.Redir op: <Redir_Great '>'> fd: 16777215 arg_word: {($ VSub_DollarName '$flock')} ) ] ) (C {(die)} {(DQ ('ERROR: unable to write ') ($ VSub_DollarName '$flock') (.))}) ] ) (command.Assignment keyword: Assign_None pairs: [ (assign_pair lhs: (lhs_expr.LhsName name:wroteflock spids:[883]) op: Equal rhs: {(1)} spids: [883] ) ] spids: [883] ) (command.SimpleCommand words: [{(echo)} {(nop)}] redirects: [(redir.Redir op:<Redir_Great '>'> fd:16777215 arg_word:{(current_tracer)})] ) (command.Assignment keyword: Assign_None pairs: [ (assign_pair lhs: (lhs_expr.LhsName name:ver spids:[898]) op: Equal rhs: { (word_part.CommandSubPart command_list: (command.CommandList children:[(C {(uname)} {(-r)})]) left_token: <Left_CommandSub '$('> spids: [899 903] ) } spids: [898] ) ] spids: [898] ) (command.If arms: [ (if_arm cond: [ (command.Sentence child: (command.DBracket expr: (bool_expr.LogicalOr left: (bool_expr.BoolBinary op_id: BoolBinary_GlobDEqual left: {(DQ ($ VSub_DollarName '$ver'))} right: {(2.) (Lit_Other '*')} ) right: (bool_expr.BoolBinary op_id: BoolBinary_GlobDEqual left: {(DQ ($ VSub_DollarName '$ver'))} right: {(3.) (Lit_Other '[') (1-6) (Lit_Other ']') (.) (Lit_Other '*')} ) ) ) terminator: <Op_Semi ';'> ) ] action: [ (command.Assignment keyword: Assign_None pairs: [ (assign_pair lhs: (lhs_expr.LhsName name:kprobe spids:[943]) op: Equal rhs: {(SQ <'r:getnameprobe getname +0($retval):string'>)} spids: [943] ) ] spids: [943] ) ] spids: [16777215 936] ) ] else_action: [ (command.Assignment keyword: Assign_None pairs: [ (assign_pair lhs: (lhs_expr.LhsName name:kprobe spids:[955]) op: Equal rhs: {(SQ <'r:getnameprobe getname +0(+0($retval)):string'>)} spids: [955] ) ] spids: [955] ) ] spids: [948 960] ) (command.If arms: [ (if_arm cond: [ (command.Sentence child: (command.Pipeline children: [ (command.SimpleCommand words: [{(echo)} {($ VSub_DollarName '$kprobe')}] redirects: [ (redir.Redir op: <Redir_DGreat '>>'> fd: 16777215 arg_word: {(kprobe_events)} ) ] ) ] negated: T ) terminator: <Op_Semi ';'> ) ] action: [(C {(edie)} {(DQ ('ERROR: adding a kprobe for getname(). Exiting.'))})] spids: [16777215 975] ) ] spids: [16777215 984] ) (command.If arms: [ (if_arm cond: [ (command.Sentence child: (command.DParen child: (arith_expr.ArithVarRef token:<Lit_ArithVarLike opt_pid>) spids: [988 993] ) terminator: <Op_Semi ';'> ) ] action: [ (command.Assignment keyword: Assign_None pairs: [ (assign_pair lhs: (lhs_expr.LhsName name:filter spids:[999]) op: Equal rhs: (word.EmptyWord) spids: [999] ) ] spids: [999] ) (command.ForEach iter_name: tid iter_words: [{(/proc/) ($ VSub_DollarName '$pid') (/task/) (Lit_Other '*')}] do_arg_iter: F body: (command.DoGroup children: [ (command.Assignment keyword: Assign_None pairs: [ (assign_pair lhs: (lhs_expr.LhsName name:filter spids:[1017]) op: Equal rhs: { (DQ ($ VSub_DollarName '$filter') (' || common_pid == ') (word_part.BracedVarSub token: <VSub_Name tid> suffix_op: (suffix_op.StringUnary op_id: VOp1_DPound arg_word: {('*') (Lit_Slash /)} ) spids: [1021 1026] ) ) } spids: [1017] ) ] spids: [1017] ) ] spids: [1014 1030] ) spids: [1007 1012] ) (command.Assignment keyword: Assign_None pairs: [ (assign_pair lhs: (lhs_expr.LhsName name:filter spids:[1033]) op: Equal rhs: { (word_part.BracedVarSub token: <VSub_Name filter> suffix_op: (suffix_op.Slice begin:(arith_expr.ArithWord w:{(Lit_Digits 3)})) spids: [1034 1038] ) } spids: [1033] ) ] spids: [1033] ) (command.If arms: [ (if_arm cond: [ (command.AndOr ops: [Op_DPipe] children: [ (command.Pipeline children: [ (command.SimpleCommand words: [{(echo)} {($ VSub_DollarName '$filter')}] redirects: [ (redir.Redir op: <Redir_Great '>'> fd: 16777215 arg_word: {(events/kprobes/getnameprobe/filter)} ) ] ) ] negated: T ) (command.Pipeline children: [ (command.SimpleCommand words: [{(echo)} {($ VSub_DollarName '$filter')}] redirects: [ (redir.Redir op: <Redir_Great '>'> fd: 16777215 arg_word: {(events/syscalls/sys_exit_open/filter)} ) ] ) ] negated: T ) ] ) ] action: [ (C {(edie)} {(DQ ('ERROR: setting -p ') ($ VSub_DollarName '$pid') ('. Exiting.'))}) ] spids: [16777215 1071] ) ] spids: [16777215 1083] ) ] spids: [16777215 996] ) ] spids: [16777215 1085] ) (command.If arms: [ (if_arm cond: [ (command.Sentence child: (command.DParen child: (arith_expr.ArithVarRef token:<Lit_ArithVarLike opt_tid>) spids: [1089 1094] ) terminator: <Op_Semi ';'> ) ] action: [ (command.If arms: [ (if_arm cond: [ (command.AndOr ops: [Op_DPipe] children: [ (command.Pipeline children: [ (command.SimpleCommand words: [{(echo)} {(DQ ('common_pid == ') ($ VSub_DollarName '$tid'))}] redirects: [ (redir.Redir op: <Redir_Great '>'> fd: 16777215 arg_word: {(events/kprobes/getnameprobe/filter)} ) ] ) ] negated: T ) (command.Pipeline children: [ (command.SimpleCommand words: [{(echo)} {(DQ ('common_pid == ') ($ VSub_DollarName '$tid'))}] redirects: [ (redir.Redir op: <Redir_Great '>'> fd: 16777215 arg_word: {(events/syscalls/sys_exit_open/filter)} ) ] ) ] negated: T ) ] ) ] action: [ (C {(edie)} {(DQ ('ERROR: setting -L ') ($ VSub_DollarName '$tid') ('. Exiting.'))}) ] spids: [16777215 1133] ) ] spids: [16777215 1145] ) ] spids: [16777215 1097] ) ] spids: [16777215 1147] ) (command.If arms: [ (if_arm cond: [ (command.Sentence child: (command.Pipeline children: [ (command.SimpleCommand words: [{(echo)} {(1)}] redirects: [ (redir.Redir op: <Redir_Great '>'> fd: 16777215 arg_word: {(events/kprobes/getnameprobe/enable)} ) ] ) ] negated: T ) terminator: <Op_Semi ';'> ) ] action: [(C {(edie)} {(DQ ('ERROR: enabling kprobe for getname(). Exiting.'))})] spids: [16777215 1162] ) ] spids: [16777215 1171] ) (command.If arms: [ (if_arm cond: [ (command.Sentence child: (command.Pipeline children: [ (command.SimpleCommand words: [{(echo)} {(1)}] redirects: [ (redir.Redir op: <Redir_Great '>'> fd: 16777215 arg_word: {(events/syscalls/sys_exit_open/enable)} ) ] ) ] negated: T ) terminator: <Op_Semi ';'> ) ] action: [(C {(edie)} {(DQ ('ERROR: enabling open() exit tracepoint. Exiting.'))})] spids: [16777215 1186] ) ] spids: [16777215 1195] ) (command.AndOr ops: [Op_DAmp] children: [ (command.DParen child: (arith_expr.ArithVarRef token:<Lit_ArithVarLike opt_time>) spids: [1197 1202] ) (C {(printf)} {(DQ ('%-16s '))} {(DQ (TIMEs))}) ] ) (C {(printf)} {(DQ ('%-16.16s %-6s %4s %s') (Lit_Other '\\') (n))} {(DQ (COMM))} {(DQ (PID))} {(DQ (FD))} {(DQ (FILE))} ) (command.Assignment keyword: Assign_None pairs: [ (assign_pair lhs: (lhs_expr.LhsName name:offset spids:[1262]) op: Equal rhs: { (word_part.CommandSubPart command_list: (command.CommandList children: [ (C {($ VSub_DollarName '$awk')} { (SQ <'BEGIN { o = 0; }\n'> <'\t$1 == "#" && $2 ~ /TASK/ && NF == 6 { o = 1; }\n'> <'\t$2 ~ /TASK/ { print o; exit }'> ) } {(trace)} ) ] ) left_token: <Left_CommandSub '$('> spids: [1263 1273] ) } spids: [1262] ) ] spids: [1262] ) (C {(warn)} {(DQ ('echo > trace'))}) (command.Pipeline children: [ (command.Subshell child: (command.If arms: [ (if_arm cond: [ (command.Sentence child: (command.DParen child: (arith_expr.ArithVarRef token:<Lit_ArithVarLike opt_duration>) spids: [1289 1294] ) terminator: <Op_Semi ';'> ) ] action: [(C {(sleep)} {($ VSub_DollarName '$duration')}) (C {(cat)} {(trace)})] spids: [16777215 1297] ) ] else_action: [(C {(cat)} {(trace_pipe)})] spids: [1313 1324] ) spids: [1285 1326] ) (C {($ VSub_DollarName '$awk')} {(-v)} {(Lit_VarLike 'o=') ($ VSub_DollarName '$offset')} {(-v)} {(Lit_VarLike 'opt_name=') ($ VSub_DollarName '$opt_name')} {(-v)} {(Lit_VarLike 'name=') ($ VSub_DollarName '$name')} {(-v)} {(Lit_VarLike 'opt_duration=') ($ VSub_DollarName '$opt_duration')} {(-v)} {(Lit_VarLike 'opt_time=') ($ VSub_DollarName '$opt_time')} {(-v)} {(Lit_VarLike 'opt_fail=') ($ VSub_DollarName '$opt_fail')} {(-v)} {(Lit_VarLike 'opt_file=') ($ VSub_DollarName '$opt_file')} {(-v)} {(Lit_VarLike 'file=') ($ VSub_DollarName '$file')} { (SQ <'\n'> <'\t# common fields\n'> <'\t$1 != "#" {\n'> <'\t\t# task name can contain dashes and space\n'> <'\t\tsplit($0, line, "-")\n'> <'\t\tsub(/^[ \\t\\r\\n]+/, "", line[1])\n'> <'\t\tcomm = line[1]\n'> <'\t\tif (opt_name && match(comm, name) == 0)\n'> <'\t\t\tnext\n'> <'\t\tsub(/ .*$/, "", line[2])\n'> <'\t\tpid = line[2]\n'> <'\t}\n'> <'\n'> <'\t# do_sys_open()\n'> <'\t$1 != "#" && $(5+o) ~ /do_sys_open/ {\n'> <'\t\t#\n'> <'\t\t# eg: ... (do_sys_open+0xc3/0x220 <- getname) arg1="file1"\n'> <'\t\t#\n'> <'\t\tfilename = $NF\n'> <'\t\tsub(/"$/, "", filename)\n'> <'\t\tsub(/.*"/, "", filename)\n'> <'\t\tlastfile[pid] = filename\n'> <'\t}\n'> <'\n'> <'\t# sys_open()\n'> <'\t$1 != "#" && $(4+o) == "sys_open" {\n'> <'\t\tfilename = lastfile[pid]\n'> <'\t\tdelete lastfile[pid]\n'> <'\t\tif (opt_file && filename !~ file)\n'> <'\t\t\tnext\n'> <'\t\trval = $NF\n'> <'\t\t# matched failed as beginning with 0xfffff\n'> <'\t\tif (opt_fail && rval !~ /0xfffff/)\n'> <'\t\t\tnext\n'> <'\t\tif (rval ~ /0xfffff/)\n'> <'\t\t\trval = -1\n'> <'\n'> <'\t\tif (opt_time) {\n'> <'\t\t\ttime = $(3+o); sub(":", "", time)\n'> <'\t\t\tprintf "%-16s ", time\n'> <'\t\t}\n'> <'\t\tprintf "%-16.16s %-6s %4s %s\\n", comm, pid, rval, filename\n'> <'\t}\n'> <'\n'> <'\t$0 ~ /LOST.*EVENTS/ { print "WARNING: " $0 > "/dev/stderr" }\n'> ) } ) ] negated: F ) (C {(end)}) ] )