(command.CommandList children: [ (command.Assignment keyword: Assign_None pairs: [ (assign_pair lhs: (lhs_expr.LhsName name:tracing spids:[174]) op: Equal rhs: {(/sys/kernel/debug/tracing)} spids: [174] ) ] spids: [174] ) (command.CommandList children: [ (command.Sentence child: (command.Assignment keyword: Assign_None pairs: [ (assign_pair lhs: (lhs_expr.LhsName name:flock spids:[177]) op: Equal rhs: {(/var/tmp/.ftrace-lock)} spids: [177] ) ] spids: [177] ) terminator: <Op_Semi ';'> ) (command.Assignment keyword: Assign_None pairs: [ (assign_pair lhs: (lhs_expr.LhsName name:wroteflock spids:[181]) op: Equal rhs: {(0)} spids: [181] ) ] spids: [181] ) ] ) (command.CommandList children: [ (command.Sentence child: (command.Assignment keyword: Assign_None pairs: [ (assign_pair lhs: (lhs_expr.LhsName name:opt_duration spids:[184]) op: Equal rhs: {(0)} spids: [184] ) ] spids: [184] ) terminator: <Op_Semi ';'> ) (command.Sentence child: (command.Assignment keyword: Assign_None pairs: [ (assign_pair lhs: (lhs_expr.LhsName name:duration spids:[188]) op: Equal rhs: (word.EmptyWord) spids: [188] ) ] spids: [188] ) terminator: <Op_Semi ';'> ) (command.Sentence child: (command.Assignment keyword: Assign_None pairs: [ (assign_pair lhs: (lhs_expr.LhsName name:opt_name spids:[191]) op: Equal rhs: {(0)} spids: [191] ) ] spids: [191] ) terminator: <Op_Semi ';'> ) (command.Sentence child: (command.Assignment keyword: Assign_None pairs: [ (assign_pair lhs: (lhs_expr.LhsName name:name spids:[195]) op: Equal rhs: (word.EmptyWord) spids: [195] ) ] spids: [195] ) terminator: <Op_Semi ';'> ) (command.Sentence child: (command.Assignment keyword: Assign_None pairs: [ (assign_pair lhs: (lhs_expr.LhsName name:opt_time spids:[198]) op: Equal rhs: {(0)} spids: [198] ) ] spids: [198] ) terminator: <Op_Semi ';'> ) (command.Assignment keyword: Assign_None pairs: [ (assign_pair lhs: (lhs_expr.LhsName name:opt_reexec spids:[202]) op: Equal rhs: {(0)} spids: [202] ) ] spids: [202] ) ] ) (command.CommandList children: [ (command.Sentence child: (command.Assignment keyword: Assign_None pairs: [ (assign_pair lhs: (lhs_expr.LhsName name:opt_argc spids:[205]) op: Equal rhs: {(0)} spids: [205] ) ] spids: [205] ) terminator: <Op_Semi ';'> ) (command.Sentence child: (command.Assignment keyword: Assign_None pairs: [ (assign_pair lhs: (lhs_expr.LhsName name:argc spids:[209]) op: Equal rhs: {(8)} spids: [209] ) ] spids: [209] ) terminator: <Op_Semi ';'> ) (command.Sentence child: (command.Assignment keyword: Assign_None pairs: [ (assign_pair lhs: (lhs_expr.LhsName name:max_argc spids:[213]) op: Equal rhs: {(16)} spids: [213] ) ] spids: [213] ) terminator: <Op_Semi ';'> ) (command.Assignment keyword: Assign_None pairs: [ (assign_pair lhs: (lhs_expr.LhsName name:ftext spids:[217]) op: Equal rhs: (word.EmptyWord) spids: [217] ) ] spids: [217] ) ] ) (C {(trap)} {(SQ <':'>)} {(INT)} {(QUIT)} {(TERM)} {(PIPE)} {(HUP)}) (command.FuncDef name: usage body: (command.BraceGroup children: [ (command.SimpleCommand words: [{(cat)}] redirects: [ (redir.HereDoc op: <Redir_DLessDash '<<-'> fd: 16777215 here_begin: {(END)} here_end_span_id: 275 stdin_parts: [ ('USAGE: execsnoop [-hrt] [-a argc] [-d secs] [name]\n') (' -d seconds # trace duration, and use buffers\n') (' -a argc # max args to show (default 8)\n') (' -r # include re-execs\n') (' -t # include time (seconds)\n') (' -h # this usage message\n') (' name # process name to match (REs allowed)\n') (' eg,\n') (' execsnoop # watch exec()s live (unbuffered)\n') (' execsnoop -d 1 # trace 1 sec (buffered)\n') (' execsnoop grep # trace process names containing grep\n') (" execsnoop 'log") (Lit_Other '$') ("' # filenames ending in ") (Right_DoubleQuote '"') (log) (Right_DoubleQuote '"') ('\n') ('\n') ('See the man page and example file for more info.\n') ] ) (redir.Redir op:<Redir_GreatAnd '>&'> fd:16777215 arg_word:{(2)}) ] ) (command.ControlFlow token:<ControlFlow_Exit exit>) ] spids: [243] ) spids: [239 242] ) (command.FuncDef name: warn body: (command.BraceGroup children: [ (command.If arms: [ (if_arm cond: [ (command.Sentence child: (command.Pipeline children: [(C {(eval)} {(DQ ($ VSub_At '$@'))})] negated: T ) terminator: <Op_Semi ';'> ) ] action: [ (command.SimpleCommand words: [ {(echo)} { (DQ ('WARNING: command failed ') (word_part.EscapedLiteralPart token: <Lit_EscapedChar '\\"'> ) ($ VSub_At '$@') (word_part.EscapedLiteralPart token:<Lit_EscapedChar '\\"'>) ) } ] redirects: [(redir.Redir op:<Redir_GreatAnd '>&'> fd:16777215 arg_word:{(2)})] ) ] spids: [16777215 300] ) ] spids: [16777215 316] ) ] spids: [286] ) spids: [282 285] ) (command.FuncDef name: end body: (command.BraceGroup children: [ (command.SimpleCommand words: [{(echo)}] redirects: [(redir.Redir op:<Redir_Great '2>'> fd:2 arg_word:{(/dev/null)})] ) (command.SimpleCommand words: [{(echo)} {(DQ ('Ending tracing...'))}] redirects: [(redir.Redir op:<Redir_Great '2>'> fd:2 arg_word:{(/dev/null)})] ) (C {(cd)} {($ VSub_Name '$tracing')}) (C {(warn)} {(DQ ('echo 0 > events/kprobes/') ($ VSub_Name '$kname') (/enable))}) (C {(warn)} {(DQ ('echo 0 > events/sched/sched_process_fork/enable'))}) (C {(warn)} {(DQ ('echo -:') ($ VSub_Name '$kname') (' >> kprobe_events'))}) (C {(warn)} {(DQ ('echo > trace'))}) (command.AndOr ops: [Op_DAmp] children: [ (command.DParen child: (arith_expr.ArithVarRef token:<Lit_ArithVarLike wroteflock>) spids: [385 390] ) (C {(warn)} {(DQ ('rm ') ($ VSub_Name '$flock'))}) ] ) ] spids: [325] ) spids: [321 324] ) (command.FuncDef name: die body: (command.BraceGroup children: [ (command.SimpleCommand words: [{(echo)} {(DQ ($ VSub_At '$@'))}] redirects: [(redir.Redir op:<Redir_GreatAnd '>&'> fd:16777215 arg_word:{(2)})] ) (command.ControlFlow token:<ControlFlow_Exit exit> arg_word:{(1)}) ] spids: [408] ) spids: [404 407] ) (command.FuncDef name: edie body: (command.BraceGroup children: [ (command.SimpleCommand words: [{(echo)} {(DQ ($ VSub_At '$@'))}] redirects: [(redir.Redir op:<Redir_GreatAnd '>&'> fd:16777215 arg_word:{(2)})] ) (command.SimpleCommand words: [{(exec)}] redirects: [ (redir.Redir op:<Redir_Great '>'> fd:16777215 arg_word:{(/dev/null)}) (redir.Redir op:<Redir_GreatAnd '2>&'> fd:2 arg_word:{(1)}) ] ) (C {(end)}) (command.ControlFlow token:<ControlFlow_Exit exit> arg_word:{(1)}) ] spids: [432] ) spids: [428 431] ) (command.WhileUntil keyword: <KW_While while> cond: [(C {(getopts)} {(a) (Lit_Other ':') (d) (Lit_Other ':') (hrt)} {(opt)})] body: (command.DoGroup children: [ (command.Case to_match: {($ VSub_Name '$opt')} arms: [ (case_arm pat_list: [{(a)}] action: [ (command.Sentence child: (command.Assignment keyword: Assign_None pairs: [ (assign_pair lhs: (lhs_expr.LhsName name:opt_argc spids:[496]) op: Equal rhs: {(1)} spids: [496] ) ] spids: [496] ) terminator: <Op_Semi ';'> ) (command.Assignment keyword: Assign_None pairs: [ (assign_pair lhs: (lhs_expr.LhsName name:argc spids:[500]) op: Equal rhs: {($ VSub_Name '$OPTARG')} spids: [500] ) ] spids: [500] ) ] spids: [493 494 503 16777215] ) (case_arm pat_list: [{(d)}] action: [ (command.Sentence child: (command.Assignment keyword: Assign_None pairs: [ (assign_pair lhs: (lhs_expr.LhsName name:opt_duration spids:[509]) op: Equal rhs: {(1)} spids: [509] ) ] spids: [509] ) terminator: <Op_Semi ';'> ) (command.Assignment keyword: Assign_None pairs: [ (assign_pair lhs: (lhs_expr.LhsName name:duration spids:[513]) op: Equal rhs: {($ VSub_Name '$OPTARG')} spids: [513] ) ] spids: [513] ) ] spids: [506 507 516 16777215] ) (case_arm pat_list: [{(r)}] action: [ (command.Assignment keyword: Assign_None pairs: [ (assign_pair lhs: (lhs_expr.LhsName name:opt_reexec spids:[522]) op: Equal rhs: {(1)} spids: [522] ) ] spids: [522] ) ] spids: [519 520 525 16777215] ) (case_arm pat_list: [{(t)}] action: [ (command.Assignment keyword: Assign_None pairs: [ (assign_pair lhs: (lhs_expr.LhsName name:opt_time spids:[531]) op: Equal rhs: {(1)} spids: [531] ) ] spids: [531] ) ] spids: [528 529 534 16777215] ) (case_arm pat_list: [{(h)} {(Lit_Other '?')}] action: [(C {(usage)})] spids: [537 540 544 16777215] ) ] spids: [486 490 547] ) ] spids: [483 549] ) ) (C {(shift)} { (word_part.ArithSubPart anode: (arith_expr.ArithBinary op_id: Arith_Minus left: (arith_expr.ArithWord w:{($ VSub_Name '$OPTIND')}) right: (arith_expr.ArithWord w:{(Lit_Digits 1)}) ) spids: [553 562] ) } ) (command.If arms: [ (if_arm cond: [ (command.Sentence child: (command.DParen child: (arith_expr.ArithWord w:{($ VSub_Pound '$#')}) spids: [566 571] ) terminator: <Op_Semi ';'> ) ] action: [ (command.Assignment keyword: Assign_None pairs: [ (assign_pair lhs: (lhs_expr.LhsName name:opt_name spids:[577]) op: Equal rhs: {(1)} spids: [577] ) ] spids: [577] ) (command.Assignment keyword: Assign_None pairs: [ (assign_pair lhs: (lhs_expr.LhsName name:name spids:[581]) op: Equal rhs: {($ VSub_Number '$1')} spids: [581] ) ] spids: [581] ) (C {(shift)}) ] spids: [16777215 574] ) ] spids: [16777215 587] ) (command.AndOr ops: [Op_DAmp] children: [ (command.DParen child:(arith_expr.ArithWord w:{($ VSub_Pound '$#')}) spids:[589 594]) (C {(usage)}) ] ) (command.AndOr ops: [Op_DAmp] children: [ (command.DParen child: (arith_expr.ArithBinary op_id: Arith_DAmp left: (arith_expr.ArithVarRef token:<Lit_ArithVarLike opt_pid>) right: (arith_expr.ArithVarRef token:<Lit_ArithVarLike opt_name>) ) spids: [604 613] ) (C {(die)} {(DQ ('ERROR: use either -p or -n.'))}) ] ) (command.AndOr ops: [Op_DAmp] children: [ (command.DParen child: (arith_expr.ArithVarRef token:<Lit_ArithVarLike opt_pid>) spids: [623 628] ) (command.Assignment keyword: Assign_None pairs: [ (assign_pair lhs: (lhs_expr.LhsName name:ftext spids:[632]) op: Equal rhs: {(DQ (' issued by PID ') ($ VSub_Name '$pid'))} spids: [632] ) ] spids: [632] ) ] ) (command.AndOr ops: [Op_DAmp] children: [ (command.DParen child: (arith_expr.ArithVarRef token:<Lit_ArithVarLike opt_name>) spids: [638 643] ) (command.Assignment keyword: Assign_None pairs: [ (assign_pair lhs: (lhs_expr.LhsName name:ftext spids:[647]) op: Equal rhs: { (DQ (' issued by process name ') (word_part.EscapedLiteralPart token:<Lit_EscapedChar '\\"'>) ($ VSub_Name '$name') (word_part.EscapedLiteralPart token:<Lit_EscapedChar '\\"'>) ) } spids: [647] ) ] spids: [647] ) ] ) (command.AndOr ops: [Op_DAmp] children: [ (command.DParen child: (arith_expr.ArithVarRef token:<Lit_ArithVarLike opt_file>) spids: [655 660] ) (command.Assignment keyword: Assign_None pairs: [ (assign_pair lhs: (lhs_expr.LhsName name:ftext spids:[664]) op: Equal rhs: { (DQ ($ VSub_Name '$ftext') (' for filenames containing ') (word_part.EscapedLiteralPart token:<Lit_EscapedChar '\\"'>) ($ VSub_Name '$file') (word_part.EscapedLiteralPart token:<Lit_EscapedChar '\\"'>) ) } spids: [664] ) ] spids: [664] ) ] ) (command.AndOr ops: [Op_DAmp] children: [ (command.DParen child: (arith_expr.ArithBinary op_id: Arith_DAmp left: (arith_expr.ArithVarRef token:<Lit_ArithVarLike opt_argc>) right: (arith_expr.ArithBinary op_id: Arith_Great left: (arith_expr.ArithVarRef token:<Lit_ArithVarLike argc>) right: (arith_expr.ArithVarRef token:<Lit_ArithVarLike max_argc>) ) ) spids: [673 686] ) (C {(die)} {(DQ ('ERROR: max -a argc is ') ($ VSub_Name '$max_argc') (.))}) ] ) (command.If arms: [ (if_arm cond: [ (command.Sentence child: (command.DParen child: (arith_expr.ArithVarRef token:<Lit_ArithVarLike opt_duration>) spids: [700 705] ) terminator: <Op_Semi ';'> ) ] action: [ (C {(echo)} { (DQ ('Tracing exec()s') ($ VSub_Name '$ftext') (' for ') ($ VSub_Name '$duration') (' seconds (buffered)...') ) } ) ] spids: [16777215 708] ) ] else_action: [(C {(echo)} {(DQ ('Tracing exec()s') ($ VSub_Name '$ftext') ('. Ctrl-C to end.'))})] spids: [721 732] ) (command.If arms: [ (if_arm cond: [ (command.Sentence child: (command.DParen child: (arith_expr.ArithVarRef token:<Lit_ArithVarLike opt_duration>) spids: [740 745] ) terminator: <Op_Semi ';'> ) ] action: [ (command.AndOr ops: [Op_DAmp Op_DPipe] children: [ (command.DBracket expr: (bool_expr.BoolUnary op_id:BoolUnary_x child:{(/usr/bin/mawk)}) ) (command.Assignment keyword: Assign_None pairs: [ (assign_pair lhs: (lhs_expr.LhsName name:awk spids:[761]) op: Equal rhs: {(mawk)} spids: [761] ) ] spids: [761] ) (command.Assignment keyword: Assign_None pairs: [ (assign_pair lhs: (lhs_expr.LhsName name:awk spids:[766]) op: Equal rhs: {(awk)} spids: [766] ) ] spids: [766] ) ] ) ] spids: [16777215 748] ) ] else_action: [ (command.If arms: [ (if_arm cond: [ (command.Sentence child: (command.DBracket expr: (bool_expr.BoolUnary op_id:BoolUnary_x child:{(/usr/bin/gawk)}) ) terminator: <Op_Semi ';'> ) ] action: [ (command.Assignment keyword: Assign_None pairs: [ (assign_pair lhs: (lhs_expr.LhsName name:awk spids:[790]) op: Equal rhs: {(gawk)} spids: [790] ) ] spids: [790] ) ] spids: [16777215 787] ) (if_arm cond: [ (command.Sentence child: (command.DBracket expr: (bool_expr.BoolUnary op_id:BoolUnary_x child:{(/usr/bin/mawk)}) ) terminator: <Op_Semi ';'> ) ] action: [ (command.Assignment keyword: Assign_None pairs: [ (assign_pair lhs: (lhs_expr.LhsName name:awk spids:[808]) op: Equal rhs: {(DQ ('mawk -W interactive'))} spids: [808] ) ] spids: [808] ) ] spids: [794 805] ) ] else_action: [ (command.Assignment keyword: Assign_None pairs: [ (assign_pair lhs: (lhs_expr.LhsName name:awk spids:[817]) op: Equal rhs: {(awk)} spids: [817] ) ] spids: [817] ) ] spids: [814 821] ) ] spids: [769 823] ) (command.AndOr ops: [Op_DPipe] children: [ (C {(cd)} {($ VSub_Name '$tracing')}) (C {(die)} { (DQ ('ERROR: accessing tracing. Root user? Kernel has FTRACE?\n') (' debugfs mounted? (mount -t debugfs debugfs /sys/kernel/debug)') ) } ) ] ) (command.AndOr ops: [Op_DAmp] children: [ (command.DBracket expr: (bool_expr.BoolUnary op_id:BoolUnary_e child:{($ VSub_Name '$flock')}) ) (C {(die)} { (DQ ('ERROR: ftrace may be in use by PID ') (word_part.CommandSubPart command_list: (command.CommandList children:[(C {(cat)} {($ VSub_Name '$flock')})]) left_token: <Left_CommandSub '$('> spids: [860 864] ) (' ') ($ VSub_Name '$flock') ) } ) ] ) (command.AndOr ops: [Op_DPipe] children: [ (command.SimpleCommand words: [{(echo)} {($ VSub_Dollar '$$')}] redirects: [(redir.Redir op:<Redir_Great '>'> fd:16777215 arg_word:{($ VSub_Name '$flock')})] ) (C {(die)} {(DQ ('ERROR: unable to write ') ($ VSub_Name '$flock') (.))}) ] ) (command.Assignment keyword: Assign_None pairs: [ (assign_pair lhs: (lhs_expr.LhsName name:wroteflock spids:[887]) op: Equal rhs: {(1)} spids: [887] ) ] spids: [887] ) (command.If arms: [ (if_arm cond: [ (command.Sentence child: (command.DBracket expr: (bool_expr.BoolUnary op_id:BoolUnary_x child:{(/usr/bin/getconf)}) ) terminator: <Op_Semi ';'> ) ] action: [ (command.Assignment keyword: Assign_None pairs: [ (assign_pair lhs: (lhs_expr.LhsName name:bits spids:[908]) op: Equal rhs: { (word_part.CommandSubPart command_list: (command.CommandList children:[(C {(getconf)} {(LONG_BIT)})]) left_token: <Left_CommandSub '$('> spids: [909 913] ) } spids: [908] ) ] spids: [908] ) ] spids: [16777215 905] ) ] else_action: [ (command.Assignment keyword: Assign_None pairs: [ (assign_pair lhs: (lhs_expr.LhsName name:bits spids:[918]) op: Equal rhs: {(64)} spids: [918] ) ] spids: [918] ) (command.AndOr ops: [Op_DAmp] children: [ (command.DBracket expr: (bool_expr.BoolBinary op_id: BoolBinary_GlobDEqual left: { (word_part.CommandSubPart command_list: (command.CommandList children:[(C {(uname)} {(-m)})]) left_token: <Left_CommandSub '$('> spids: [924 928] ) } right: {(i) (Lit_Other '*')} ) ) (command.Assignment keyword: Assign_None pairs: [ (assign_pair lhs: (lhs_expr.LhsName name:bits spids:[939]) op: Equal rhs: {(32)} spids: [939] ) ] spids: [939] ) ] ) ] spids: [915 942] ) (command.DParen child: (arith_expr.BinaryAssign op_id: Arith_Equal left: (lhs_expr.LhsName name:offset spids:[946]) right: (arith_expr.ArithBinary op_id: Arith_Slash left: (arith_expr.ArithVarRef token:<Lit_ArithVarLike bits>) right: (arith_expr.ArithWord w:{(Lit_Digits 8)}) ) ) spids: [944 957] ) (command.FuncDef name: makeprobe body: (command.BraceGroup children: [ (command.Assignment keyword: Assign_None pairs: [ (assign_pair lhs: (lhs_expr.LhsName name:func spids:[966]) op: Equal rhs: {($ VSub_Number '$1')} spids: [966] ) ] spids: [966] ) (command.Assignment keyword: Assign_None pairs: [ (assign_pair lhs: (lhs_expr.LhsName name:kname spids:[970]) op: Equal rhs: {(execsnoop_) ($ VSub_Name '$func')} spids: [970] ) ] spids: [970] ) (command.Assignment keyword: Assign_None pairs: [ (assign_pair lhs: (lhs_expr.LhsName name:kprobe spids:[975]) op: Equal rhs: {(DQ ('p:') ($ VSub_Name '$kname') (' ') ($ VSub_Name '$func'))} spids: [975] ) ] spids: [975] ) (command.Assignment keyword: Assign_None pairs: [ (assign_pair lhs: (lhs_expr.LhsName name:i spids:[984]) op: Equal rhs: {(0)} spids: [984] ) ] spids: [984] ) (command.WhileUntil keyword: <KW_While while> cond: [ (command.Sentence child: (command.DParen child: (arith_expr.ArithBinary op_id: Arith_Less left: (arith_expr.ArithVarRef token:<Lit_ArithVarLike i>) right: (arith_expr.ArithBinary op_id: Arith_Plus left: (arith_expr.ArithVarRef token:<Lit_ArithVarLike argc>) right: (arith_expr.ArithWord w:{(Lit_Digits 1)}) ) ) spids: [990 1003] ) terminator: <Op_Semi ';'> ) ] body: (command.DoGroup children: [ (command.Assignment keyword: Assign_None pairs: [ (assign_pair lhs: (lhs_expr.LhsName name:kprobe spids:[1013]) op: Equal rhs: { (DQ ($ VSub_Name '$kprobe') (' +0(+') (word_part.ArithSubPart anode: (arith_expr.ArithBinary op_id: Arith_Star left: (arith_expr.ArithVarRef token:<Lit_ArithVarLike i>) right: (arith_expr.ArithVarRef token:<Lit_ArithVarLike offset>) ) spids: [1017 1026] ) ('(%si)):string') ) } spids: [1013] ) ] spids: [1013] ) (command.DParen child: (arith_expr.UnaryAssign op_id: Node_PostDPlus child: (lhs_expr.LhsName name:i spids:[1033]) ) spids: [1031 1037] ) ] spids: [1006 1040] ) ) ] spids: [963] ) spids: [959 962] ) (C {(makeprobe)} {(sys_execve)}) (command.SimpleCommand words: [{(echo)} {(nop)}] redirects: [(redir.Redir op:<Redir_Great '>'> fd:16777215 arg_word:{(current_tracer)})] ) (command.If arms: [ (if_arm cond: [ (command.Sentence child: (command.Pipeline children: [ (command.SimpleCommand words: [{(echo)} {($ VSub_Name '$kprobe')}] redirects: [ (redir.Redir op: <Redir_DGreat '>>'> fd: 16777215 arg_word: {(kprobe_events)} ) (redir.Redir op: <Redir_Great '2>'> fd: 2 arg_word: {(/dev/null)} ) ] ) ] negated: T ) terminator: <Op_Semi ';'> ) ] action: [ (C {(makeprobe)} {(stub_execve)}) (command.If arms: [ (if_arm cond: [ (command.Sentence child: (command.Pipeline children: [ (command.SimpleCommand words: [{(echo)} {($ VSub_Name '$kprobe')}] redirects: [ (redir.Redir op: <Redir_DGreat '>>'> fd: 16777215 arg_word: {(kprobe_events)} ) (redir.Redir op: <Redir_Great '2>'> fd: 2 arg_word: {(/dev/null)} ) ] ) ] negated: T ) terminator: <Op_Semi ';'> ) ] action: [ (C {(makeprobe)} {(do_execve)}) (command.If arms: [ (if_arm cond: [ (command.Sentence child: (command.Pipeline children: [ (command.SimpleCommand words: [{(echo)} {($ VSub_Name '$kprobe')}] redirects: [ (redir.Redir op: <Redir_DGreat '>>'> fd: 16777215 arg_word: {(kprobe_events)} ) (redir.Redir op: <Redir_Great '2>'> fd: 2 arg_word: {(/dev/null)} ) ] ) ] negated: T ) terminator: <Op_Semi ';'> ) ] action: [(C {(edie)} {(DQ ('ERROR: adding a kprobe for execve. Exiting.'))})] spids: [16777215 1127] ) ] spids: [16777215 1137] ) ] spids: [16777215 1103] ) ] spids: [16777215 1140] ) ] spids: [16777215 1079] ) ] spids: [16777215 1142] ) (command.If arms: [ (if_arm cond: [ (command.Sentence child: (command.Pipeline children: [ (command.SimpleCommand words: [{(echo)} {(1)}] redirects: [ (redir.Redir op: <Redir_Great '>'> fd: 16777215 arg_word: {(events/kprobes/) ($ VSub_Name '$kname') (/enable)} ) ] ) ] negated: T ) terminator: <Op_Semi ';'> ) ] action: [(C {(edie)} {(DQ ('ERROR: enabling kprobe for execve. Exiting.'))})] spids: [16777215 1159] ) ] spids: [16777215 1168] ) (command.If arms: [ (if_arm cond: [ (command.Sentence child: (command.Pipeline children: [ (command.SimpleCommand words: [{(echo)} {(1)}] redirects: [ (redir.Redir op: <Redir_Great '>'> fd: 16777215 arg_word: {(events/sched/sched_process_fork/enable)} ) ] ) ] negated: T ) terminator: <Op_Semi ';'> ) ] action: [(C {(edie)} {(DQ ('ERROR: enabling sched:sched_process_fork tracepoint. Exiting.'))})] spids: [16777215 1183] ) ] spids: [16777215 1192] ) (C {(echo)} {(DQ ('Instrumenting ') ($ VSub_Name '$func'))}) (command.AndOr ops: [Op_DAmp] children: [ (command.DParen child: (arith_expr.ArithVarRef token:<Lit_ArithVarLike opt_time>) spids: [1201 1206] ) (C {(printf)} {(DQ ('%-16s '))} {(DQ (TIMEs))}) ] ) (C {(printf)} {(DQ ('%6s %6s %s') (Lit_Other '\\') (n))} {(DQ (PID))} {(DQ (PPID))} {(DQ (ARGS))}) (command.Assignment keyword: Assign_None pairs: [ (assign_pair lhs: (lhs_expr.LhsName name:offset spids:[1262]) op: Equal rhs: { (word_part.CommandSubPart command_list: (command.CommandList children: [ (C {($ VSub_Name '$awk')} { (SQ <'BEGIN { o = 0; }\n'> <'\t$1 == "#" && $2 ~ /TASK/ && NF == 6 { o = 1; }\n'> <'\t$2 ~ /TASK/ { print o; exit }'> ) } {(trace)} ) ] ) left_token: <Left_CommandSub '$('> spids: [1263 1273] ) } spids: [1262] ) ] spids: [1262] ) (C {(warn)} {(DQ ('echo > trace'))}) (command.Pipeline children: [ (command.Subshell child: (command.If arms: [ (if_arm cond: [ (command.Sentence child: (command.DParen child: (arith_expr.ArithVarRef token:<Lit_ArithVarLike opt_duration>) spids: [1289 1294] ) terminator: <Op_Semi ';'> ) ] action: [(C {(sleep)} {($ VSub_Name '$duration')}) (C {(cat)} {(-v)} {(trace)})] spids: [16777215 1297] ) ] else_action: [(C {(cat)} {(-v)} {(trace_pipe)})] spids: [1315 1328] ) spids: [1285 1330] ) (C {($ VSub_Name '$awk')} {(-v)} {(Lit_VarLike 'o=') ($ VSub_Name '$offset')} {(-v)} {(Lit_VarLike 'opt_name=') ($ VSub_Name '$opt_name')} {(-v)} {(Lit_VarLike 'name=') ($ VSub_Name '$name')} {(-v)} {(Lit_VarLike 'opt_duration=') ($ VSub_Name '$opt_duration')} {(-v)} {(Lit_VarLike 'opt_time=') ($ VSub_Name '$opt_time')} {(-v)} {(Lit_VarLike 'kname=') ($ VSub_Name '$kname')} {(-v)} {(Lit_VarLike 'opt_reexec=') ($ VSub_Name '$opt_reexec')} { (SQ <'\n'> <'\t# common fields\n'> <'\t$1 != "#" {\n'> <'\t\t# task name can contain dashes\n'> <'\t\tcomm = pid = $1\n'> <'\t\tsub(/-[0-9][0-9]*/, "", comm)\n'> <'\t\tsub(/.*-/, "", pid)\n'> <'\t}\n'> <'\n'> <'\t$1 != "#" && $(4+o) ~ /sched_process_fork/ {\n'> <'\t\tcpid=$0\n'> <'\t\tsub(/.* child_pid=/, "", cpid)\n'> <'\t\tsub(/ .*/, "", cpid)\n'> <'\t\tgetppid[cpid] = pid\n'> <'\t\tdelete seen[pid]\n'> <'\t}\n'> <'\n'> <'\t$1 != "#" && $(4+o) ~ kname {\n'> <'\t\tif (seen[pid])\n'> <'\t\t\tnext\n'> <'\t\tif (opt_name && comm !~ name)\n'> <'\t\t\tnext\n'> <'\n'> <'\t\t#\n'> <'\t\t# examples:\n'> <'\t\t# ... arg1="/bin/echo" arg2="1" arg3="2" arg4="3" ...\n'> <'\t\t# ... arg1="sleep" arg2="2" arg3=(fault) arg4="" ...\n'> <'\t\t# ... arg1="" arg2=(fault) arg3="" arg4="" ...\n'> <'\t\t# the last example is uncommon, and may be a race.\n'> <'\t\t#\n'> <'\t\tif ($0 ~ /arg1=""/) {\n'> <'\t\t\targs = comm " [?]"\n'> <'\t\t} else {\n'> <'\t\t\targs=$0\n'> <'\t\t\tsub(/ arg[0-9]*=\\(fault\\).*/, "", args)\n'> <'\t\t\tsub(/.*arg1="/, "", args)\n'> <'\t\t\tgsub(/" arg[0-9]*="/, " ", args)\n'> <'\t\t\tsub(/"$/, "", args)\n'> <'\t\t\tif ($0 !~ /\\(fault\\)/)\n'> <'\t\t\t\targs = args " [...]"\n'> <'\t\t}\n'> <'\n'> <'\t\tif (opt_time) {\n'> <'\t\t\ttime = $(3+o); sub(":", "", time)\n'> <'\t\t\tprintf "%-16s ", time\n'> <'\t\t}\n'> <'\t\tprintf "%6s %6d %s\\n", pid, getppid[pid], args\n'> <'\t\tif (!opt_duration)\n'> <'\t\t\tfflush()\n'> <'\t\tif (!opt_reexec) {\n'> <'\t\t\tseen[pid] = 1\n'> <'\t\t\tdelete getppid[pid]\n'> <'\t\t}\n'> <'\t}\n'> <'\n'> <'\t$0 ~ /LOST.*EVENT[S]/ { print "WARNING: " $0 > "/dev/stderr" }\n'> ) } ) ] negated: F ) (C {(end)}) ] )