(command.CommandList children: [ (command.Assignment keyword: Assign_None pairs: [ (assign_pair lhs: (lhs_expr.LhsName name:tracing spids:[150]) op: Equal rhs: {(/sys/kernel/debug/tracing)} spids: [150] ) ] spids: [150] ) (command.CommandList children: [ (command.Sentence child: (command.Assignment keyword: Assign_None pairs: [ (assign_pair lhs: (lhs_expr.LhsName name:flock spids:[153]) op: Equal rhs: {(/var/tmp/.ftrace-lock)} spids: [153] ) ] spids: [153] ) terminator: <Op_Semi ';'> ) (command.Assignment keyword: Assign_None pairs: [ (assign_pair lhs: (lhs_expr.LhsName name:wroteflock spids:[157]) op: Equal rhs: {(0)} spids: [157] ) ] spids: [157] ) ] ) (command.CommandList children: [ (command.Sentence child: (command.Assignment keyword: Assign_None pairs: [ (assign_pair lhs: (lhs_expr.LhsName name:opt_duration spids:[160]) op: Equal rhs: {(0)} spids: [160] ) ] spids: [160] ) terminator: <Op_Semi ';'> ) (command.Sentence child: (command.Assignment keyword: Assign_None pairs: [ (assign_pair lhs: (lhs_expr.LhsName name:duration spids:[164]) op: Equal rhs: (word.EmptyWord) spids: [164] ) ] spids: [164] ) terminator: <Op_Semi ';'> ) (command.Sentence child: (command.Assignment keyword: Assign_None pairs: [ (assign_pair lhs: (lhs_expr.LhsName name:opt_name spids:[167]) op: Equal rhs: {(0)} spids: [167] ) ] spids: [167] ) terminator: <Op_Semi ';'> ) (command.Sentence child: (command.Assignment keyword: Assign_None pairs: [ (assign_pair lhs: (lhs_expr.LhsName name:name spids:[171]) op: Equal rhs: (word.EmptyWord) spids: [171] ) ] spids: [171] ) terminator: <Op_Semi ';'> ) (command.Sentence child: (command.Assignment keyword: Assign_None pairs: [ (assign_pair lhs: (lhs_expr.LhsName name:opt_pid spids:[174]) op: Equal rhs: {(0)} spids: [174] ) ] spids: [174] ) terminator: <Op_Semi ';'> ) (command.Sentence child: (command.Assignment keyword: Assign_None pairs: [ (assign_pair lhs: (lhs_expr.LhsName name:pid spids:[178]) op: Equal rhs: (word.EmptyWord) spids: [178] ) ] spids: [178] ) terminator: <Op_Semi ';'> ) (command.Sentence child: (command.Assignment keyword: Assign_None pairs: [ (assign_pair lhs: (lhs_expr.LhsName name:opt_tid spids:[181]) op: Equal rhs: {(0)} spids: [181] ) ] spids: [181] ) terminator: <Op_Semi ';'> ) (command.Assignment keyword: Assign_None pairs: [ (assign_pair lhs: (lhs_expr.LhsName name:tid spids:[185]) op: Equal rhs: (word.EmptyWord) spids: [185] ) ] spids: [185] ) ] ) (command.CommandList children: [ (command.Sentence child: (command.Assignment keyword: Assign_None pairs: [ (assign_pair lhs: (lhs_expr.LhsName name:ftext spids:[187]) op: Equal rhs: (word.EmptyWord) spids: [187] ) ] spids: [187] ) terminator: <Op_Semi ';'> ) (command.Sentence child: (command.Assignment keyword: Assign_None pairs: [ (assign_pair lhs: (lhs_expr.LhsName name:opt_time spids:[190]) op: Equal rhs: {(0)} spids: [190] ) ] spids: [190] ) terminator: <Op_Semi ';'> ) (command.Sentence child: (command.Assignment keyword: Assign_None pairs: [ (assign_pair lhs: (lhs_expr.LhsName name:opt_fail spids:[194]) op: Equal rhs: {(0)} spids: [194] ) ] spids: [194] ) terminator: <Op_Semi ';'> ) (command.Sentence child: (command.Assignment keyword: Assign_None pairs: [ (assign_pair lhs: (lhs_expr.LhsName name:opt_file spids:[198]) op: Equal rhs: {(0)} spids: [198] ) ] spids: [198] ) terminator: <Op_Semi ';'> ) (command.Assignment keyword: Assign_None pairs: [ (assign_pair lhs: (lhs_expr.LhsName name:file spids:[202]) op: Equal rhs: (word.EmptyWord) spids: [202] ) ] spids: [202] ) ] ) (C {(trap)} {(SQ <':'>)} {(INT)} {(QUIT)} {(TERM)} {(PIPE)} {(HUP)}) (command.FuncDef name: usage body: (command.BraceGroup children: [ (command.SimpleCommand words: [{(cat)}] redirects: [ (redir.HereDoc op: <Redir_DLessDash '<<-'> fd: 16777215 here_begin: {(END)} here_end_span_id: 267 stdin_parts: [ ('USAGE: opensnoop [-htx] [-d secs] [-p PID] [-L TID] [-n name] [filename]\n') (' -d seconds # trace duration, and use buffers\n') (' -n name # process name to match on open\n') (' -p PID # PID to match on open\n') (' -L TID # PID to match on open\n') (' -t # include time (seconds)\n') (' -x # only show failed opens\n') (' -h # this usage message\n') (' filename # match filename (partials, REs, ok)\n') (' eg,\n') (' opensnoop # watch open()s live (unbuffered)\n') (' opensnoop -d 1 # trace 1 sec (buffered)\n') (' opensnoop -p 181 # trace I/O issued by PID 181 only\n') (' opensnoop conf # trace filenames containing ') (Right_DoubleQuote '"') (conf) (Right_DoubleQuote '"') ('\n') (" opensnoop 'log") (Lit_Other '$') ("' # filenames ending in ") (Right_DoubleQuote '"') (log) (Right_DoubleQuote '"') ('\n') ('\n') ('See the man page and example file for more info.\n') ] ) (redir.Redir op:<Redir_GreatAnd '>&'> fd:16777215 arg_word:{(2)}) ] ) (command.ControlFlow token:<ControlFlow_Exit exit>) ] spids: [228] ) spids: [224 227] ) (command.FuncDef name: warn body: (command.BraceGroup children: [ (command.If arms: [ (if_arm cond: [ (command.Sentence child: (command.Pipeline children: [(C {(eval)} {(DQ ($ VSub_At '$@'))})] negated: T ) terminator: <Op_Semi ';'> ) ] action: [ (command.SimpleCommand words: [ {(echo)} { (DQ ('WARNING: command failed ') (word_part.EscapedLiteralPart token: <Lit_EscapedChar '\\"'> ) ($ VSub_At '$@') (word_part.EscapedLiteralPart token:<Lit_EscapedChar '\\"'>) ) } ] redirects: [(redir.Redir op:<Redir_GreatAnd '>&'> fd:16777215 arg_word:{(2)})] ) ] spids: [16777215 292] ) ] spids: [16777215 308] ) ] spids: [278] ) spids: [274 277] ) (command.FuncDef name: end body: (command.BraceGroup children: [ (command.SimpleCommand words: [{(echo)}] redirects: [(redir.Redir op:<Redir_Great '2>'> fd:2 arg_word:{(/dev/null)})] ) (command.SimpleCommand words: [{(echo)} {(DQ ('Ending tracing...'))}] redirects: [(redir.Redir op:<Redir_Great '2>'> fd:2 arg_word:{(/dev/null)})] ) (C {(cd)} {($ VSub_Name '$tracing')}) (C {(warn)} {(DQ ('echo 0 > events/kprobes/getnameprobe/enable'))}) (C {(warn)} {(DQ ('echo 0 > events/syscalls/sys_exit_open/enable'))}) (command.If arms: [ (if_arm cond: [ (command.Sentence child: (command.DParen child: (arith_expr.ArithBinary op_id: Arith_DPipe left: (arith_expr.ArithVarRef token:<Lit_ArithVarLike opt_pid>) right: (arith_expr.ArithVarRef token:<Lit_ArithVarLike opt_tid>) ) spids: [361 370] ) terminator: <Op_Semi ';'> ) ] action: [ (C {(warn)} {(DQ ('echo 0 > events/kprobes/getnameprobe/filter'))}) (C {(warn)} {(DQ ('echo 0 > events/syscalls/sys_exit_open/filter'))}) ] spids: [16777215 373] ) ] spids: [16777215 390] ) (C {(warn)} {(DQ ('echo -:getnameprobe >> kprobe_events'))}) (C {(warn)} {(DQ ('echo > trace'))}) (command.AndOr ops: [Op_DAmp] children: [ (command.DParen child: (arith_expr.ArithVarRef token:<Lit_ArithVarLike wroteflock>) spids: [407 412] ) (C {(warn)} {(DQ ('rm ') ($ VSub_Name '$flock'))}) ] ) ] spids: [317] ) spids: [313 316] ) (command.FuncDef name: die body: (command.BraceGroup children: [ (command.SimpleCommand words: [{(echo)} {(DQ ($ VSub_At '$@'))}] redirects: [(redir.Redir op:<Redir_GreatAnd '>&'> fd:16777215 arg_word:{(2)})] ) (command.ControlFlow token:<ControlFlow_Exit exit> arg_word:{(1)}) ] spids: [430] ) spids: [426 429] ) (command.FuncDef name: edie body: (command.BraceGroup children: [ (command.SimpleCommand words: [{(echo)} {(DQ ($ VSub_At '$@'))}] redirects: [(redir.Redir op:<Redir_GreatAnd '>&'> fd:16777215 arg_word:{(2)})] ) (command.SimpleCommand words: [{(exec)}] redirects: [ (redir.Redir op:<Redir_Great '>'> fd:16777215 arg_word:{(/dev/null)}) (redir.Redir op:<Redir_GreatAnd '2>&'> fd:2 arg_word:{(1)}) ] ) (C {(end)}) (command.ControlFlow token:<ControlFlow_Exit exit> arg_word:{(1)}) ] spids: [454] ) spids: [450 453] ) (command.WhileUntil keyword: <KW_While while> cond: [ (C {(getopts)} {(d) (Lit_Other ':') (hn) (Lit_Other ':') (p) (Lit_Other ':') (L) (Lit_Other ':') (tx)} {(opt)} ) ] body: (command.DoGroup children: [ (command.Case to_match: {($ VSub_Name '$opt')} arms: [ (case_arm pat_list: [{(d)}] action: [ (command.Sentence child: (command.Assignment keyword: Assign_None pairs: [ (assign_pair lhs: (lhs_expr.LhsName name:opt_duration spids:[522]) op: Equal rhs: {(1)} spids: [522] ) ] spids: [522] ) terminator: <Op_Semi ';'> ) (command.Assignment keyword: Assign_None pairs: [ (assign_pair lhs: (lhs_expr.LhsName name:duration spids:[526]) op: Equal rhs: {($ VSub_Name '$OPTARG')} spids: [526] ) ] spids: [526] ) ] spids: [519 520 529 16777215] ) (case_arm pat_list: [{(n)}] action: [ (command.Sentence child: (command.Assignment keyword: Assign_None pairs: [ (assign_pair lhs: (lhs_expr.LhsName name:opt_name spids:[535]) op: Equal rhs: {(1)} spids: [535] ) ] spids: [535] ) terminator: <Op_Semi ';'> ) (command.Assignment keyword: Assign_None pairs: [ (assign_pair lhs: (lhs_expr.LhsName name:name spids:[539]) op: Equal rhs: {($ VSub_Name '$OPTARG')} spids: [539] ) ] spids: [539] ) ] spids: [532 533 542 16777215] ) (case_arm pat_list: [{(p)}] action: [ (command.Sentence child: (command.Assignment keyword: Assign_None pairs: [ (assign_pair lhs: (lhs_expr.LhsName name:opt_pid spids:[548]) op: Equal rhs: {(1)} spids: [548] ) ] spids: [548] ) terminator: <Op_Semi ';'> ) (command.Assignment keyword: Assign_None pairs: [ (assign_pair lhs: (lhs_expr.LhsName name:pid spids:[552]) op: Equal rhs: {($ VSub_Name '$OPTARG')} spids: [552] ) ] spids: [552] ) ] spids: [545 546 555 16777215] ) (case_arm pat_list: [{(L)}] action: [ (command.Sentence child: (command.Assignment keyword: Assign_None pairs: [ (assign_pair lhs: (lhs_expr.LhsName name:opt_tid spids:[561]) op: Equal rhs: {(1)} spids: [561] ) ] spids: [561] ) terminator: <Op_Semi ';'> ) (command.Assignment keyword: Assign_None pairs: [ (assign_pair lhs: (lhs_expr.LhsName name:tid spids:[565]) op: Equal rhs: {($ VSub_Name '$OPTARG')} spids: [565] ) ] spids: [565] ) ] spids: [558 559 568 16777215] ) (case_arm pat_list: [{(t)}] action: [ (command.Assignment keyword: Assign_None pairs: [ (assign_pair lhs: (lhs_expr.LhsName name:opt_time spids:[574]) op: Equal rhs: {(1)} spids: [574] ) ] spids: [574] ) ] spids: [571 572 577 16777215] ) (case_arm pat_list: [{(x)}] action: [ (command.Assignment keyword: Assign_None pairs: [ (assign_pair lhs: (lhs_expr.LhsName name:opt_fail spids:[583]) op: Equal rhs: {(1)} spids: [583] ) ] spids: [583] ) ] spids: [580 581 586 16777215] ) (case_arm pat_list: [{(h)} {(Lit_Other '?')}] action: [(C {(usage)})] spids: [589 592 596 16777215] ) ] spids: [512 516 599] ) ] spids: [509 601] ) ) (C {(shift)} { (word_part.ArithSubPart anode: (arith_expr.ArithBinary op_id: Arith_Minus left: (arith_expr.ArithWord w:{($ VSub_Name '$OPTIND')}) right: (arith_expr.ArithWord w:{(Lit_Digits 1)}) ) spids: [605 614] ) } ) (command.If arms: [ (if_arm cond: [ (command.Sentence child: (command.DParen child: (arith_expr.ArithWord w:{($ VSub_Pound '$#')}) spids: [618 623] ) terminator: <Op_Semi ';'> ) ] action: [ (command.Assignment keyword: Assign_None pairs: [ (assign_pair lhs: (lhs_expr.LhsName name:opt_file spids:[629]) op: Equal rhs: {(1)} spids: [629] ) ] spids: [629] ) (command.Assignment keyword: Assign_None pairs: [ (assign_pair lhs: (lhs_expr.LhsName name:file spids:[633]) op: Equal rhs: {($ VSub_Number '$1')} spids: [633] ) ] spids: [633] ) (C {(shift)}) ] spids: [16777215 626] ) ] spids: [16777215 639] ) (command.AndOr ops: [Op_DAmp] children: [ (command.DParen child:(arith_expr.ArithWord w:{($ VSub_Pound '$#')}) spids:[641 646]) (C {(usage)}) ] ) (command.AndOr ops: [Op_DAmp] children: [ (command.DParen child: (arith_expr.ArithBinary op_id: Arith_Great left: (arith_expr.ArithBinary op_id: Arith_Plus left: (arith_expr.ArithBinary op_id: Arith_Plus left: (arith_expr.ArithVarRef token:<Lit_ArithVarLike opt_pid>) right: (arith_expr.ArithVarRef token:<Lit_ArithVarLike opt_name>) ) right: (arith_expr.ArithVarRef token:<Lit_ArithVarLike opt_tid>) ) right: (arith_expr.ArithWord w:{(Lit_Digits 1)}) ) spids: [656 673] ) (C {(die)} {(DQ ('ERROR: use at most one of -p, -n, -L.'))}) ] ) (command.AndOr ops: [Op_DAmp] children: [ (command.DParen child: (arith_expr.ArithVarRef token:<Lit_ArithVarLike opt_pid>) spids: [685 690] ) (command.Assignment keyword: Assign_None pairs: [ (assign_pair lhs: (lhs_expr.LhsName name:ftext spids:[694]) op: Equal rhs: {(DQ (' issued by PID ') ($ VSub_Name '$pid'))} spids: [694] ) ] spids: [694] ) ] ) (command.AndOr ops: [Op_DAmp] children: [ (command.DParen child: (arith_expr.ArithVarRef token:<Lit_ArithVarLike opt_tid>) spids: [700 705] ) (command.Assignment keyword: Assign_None pairs: [ (assign_pair lhs: (lhs_expr.LhsName name:ftext spids:[709]) op: Equal rhs: {(DQ (' issued by TID ') ($ VSub_Name '$tid'))} spids: [709] ) ] spids: [709] ) ] ) (command.AndOr ops: [Op_DAmp] children: [ (command.DParen child: (arith_expr.ArithVarRef token:<Lit_ArithVarLike opt_name>) spids: [715 720] ) (command.Assignment keyword: Assign_None pairs: [ (assign_pair lhs: (lhs_expr.LhsName name:ftext spids:[724]) op: Equal rhs: { (DQ (' issued by process name ') (word_part.EscapedLiteralPart token:<Lit_EscapedChar '\\"'>) ($ VSub_Name '$name') (word_part.EscapedLiteralPart token:<Lit_EscapedChar '\\"'>) ) } spids: [724] ) ] spids: [724] ) ] ) (command.AndOr ops: [Op_DAmp] children: [ (command.DParen child: (arith_expr.ArithVarRef token:<Lit_ArithVarLike opt_file>) spids: [732 737] ) (command.Assignment keyword: Assign_None pairs: [ (assign_pair lhs: (lhs_expr.LhsName name:ftext spids:[741]) op: Equal rhs: { (DQ ($ VSub_Name '$ftext') (' for filenames containing ') (word_part.EscapedLiteralPart token:<Lit_EscapedChar '\\"'>) ($ VSub_Name '$file') (word_part.EscapedLiteralPart token:<Lit_EscapedChar '\\"'>) ) } spids: [741] ) ] spids: [741] ) ] ) (command.If arms: [ (if_arm cond: [ (command.Sentence child: (command.DParen child: (arith_expr.ArithVarRef token:<Lit_ArithVarLike opt_duration>) spids: [752 757] ) terminator: <Op_Semi ';'> ) ] action: [ (C {(echo)} { (DQ ('Tracing open()s') ($ VSub_Name '$ftext') (' for ') ($ VSub_Name '$duration') (' seconds (buffered)...') ) } ) ] spids: [16777215 760] ) ] else_action: [(C {(echo)} {(DQ ('Tracing open()s') ($ VSub_Name '$ftext') ('. Ctrl-C to end.'))})] spids: [773 784] ) (command.AndOr ops: [Op_DAmp Op_DPipe] children: [ (command.DParen child: (arith_expr.ArithVarRef token:<Lit_ArithVarLike opt_duration>) spids: [790 795] ) (command.Assignment keyword: Assign_None pairs: [ (assign_pair lhs: (lhs_expr.LhsName name:use spids:[799]) op: Equal rhs: {(mawk)} spids: [799] ) ] spids: [799] ) (command.Assignment keyword: Assign_None pairs: [ (assign_pair lhs: (lhs_expr.LhsName name:use spids:[804]) op: Equal rhs: {(gawk)} spids: [804] ) ] spids: [804] ) ] ) (command.AndOr ops: [Op_DAmp Op_DPipe] children: [ (command.DBracket expr: (bool_expr.BoolUnary op_id:BoolUnary_x child:{(/usr/bin/) ($ VSub_Name '$use')}) ) (command.Assignment keyword: Assign_None pairs: [ (assign_pair lhs: (lhs_expr.LhsName name:awk spids:[821]) op: Equal rhs: {($ VSub_Name '$use')} spids: [821] ) ] spids: [821] ) (command.Assignment keyword: Assign_None pairs: [ (assign_pair lhs: (lhs_expr.LhsName name:awk spids:[826]) op: Equal rhs: {(awk)} spids: [826] ) ] spids: [826] ) ] ) (command.AndOr ops: [Op_DPipe] children: [ (C {(cd)} {($ VSub_Name '$tracing')}) (C {(die)} { (DQ ('ERROR: accessing tracing. Root user? Kernel has FTRACE?\n') (' debugfs mounted? (mount -t debugfs debugfs /sys/kernel/debug)') ) } ) ] ) (command.AndOr ops: [Op_DAmp] children: [ (command.DBracket expr: (bool_expr.BoolUnary op_id:BoolUnary_e child:{($ VSub_Name '$flock')}) ) (C {(die)} { (DQ ('ERROR: ftrace may be in use by PID ') (word_part.CommandSubPart command_list: (command.CommandList children:[(C {(cat)} {($ VSub_Name '$flock')})]) left_token: <Left_CommandSub '$('> spids: [864 868] ) (' ') ($ VSub_Name '$flock') ) } ) ] ) (command.AndOr ops: [Op_DPipe] children: [ (command.SimpleCommand words: [{(echo)} {($ VSub_Dollar '$$')}] redirects: [(redir.Redir op:<Redir_Great '>'> fd:16777215 arg_word:{($ VSub_Name '$flock')})] ) (C {(die)} {(DQ ('ERROR: unable to write ') ($ VSub_Name '$flock') (.))}) ] ) (command.Assignment keyword: Assign_None pairs: [ (assign_pair lhs: (lhs_expr.LhsName name:wroteflock spids:[891]) op: Equal rhs: {(1)} spids: [891] ) ] spids: [891] ) (command.SimpleCommand words: [{(echo)} {(nop)}] redirects: [(redir.Redir op:<Redir_Great '>'> fd:16777215 arg_word:{(current_tracer)})] ) (command.Assignment keyword: Assign_None pairs: [ (assign_pair lhs: (lhs_expr.LhsName name:ver spids:[906]) op: Equal rhs: { (word_part.CommandSubPart command_list: (command.CommandList children:[(C {(uname)} {(-r)})]) left_token: <Left_CommandSub '$('> spids: [907 911] ) } spids: [906] ) ] spids: [906] ) (command.If arms: [ (if_arm cond: [ (command.Sentence child: (command.DBracket expr: (bool_expr.LogicalOr left: (bool_expr.BoolBinary op_id: BoolBinary_GlobDEqual left: {(DQ ($ VSub_Name '$ver'))} right: {(2.) (Lit_Other '*')} ) right: (bool_expr.BoolBinary op_id: BoolBinary_GlobDEqual left: {(DQ ($ VSub_Name '$ver'))} right: {(3.) (Lit_Other '[') (1-6) (Lit_Other ']') (.) (Lit_Other '*')} ) ) ) terminator: <Op_Semi ';'> ) ] action: [ (command.Assignment keyword: Assign_None pairs: [ (assign_pair lhs: (lhs_expr.LhsName name:kprobe spids:[951]) op: Equal rhs: {(SQ <'r:getnameprobe getname +0($retval):string'>)} spids: [951] ) ] spids: [951] ) ] spids: [16777215 944] ) ] else_action: [ (command.Assignment keyword: Assign_None pairs: [ (assign_pair lhs: (lhs_expr.LhsName name:kprobe spids:[963]) op: Equal rhs: {(SQ <'r:getnameprobe getname +0(+0($retval)):string'>)} spids: [963] ) ] spids: [963] ) ] spids: [956 968] ) (command.If arms: [ (if_arm cond: [ (command.Sentence child: (command.Pipeline children: [ (command.SimpleCommand words: [{(echo)} {($ VSub_Name '$kprobe')}] redirects: [ (redir.Redir op: <Redir_DGreat '>>'> fd: 16777215 arg_word: {(kprobe_events)} ) ] ) ] negated: T ) terminator: <Op_Semi ';'> ) ] action: [(C {(edie)} {(DQ ('ERROR: adding a kprobe for getname(). Exiting.'))})] spids: [16777215 983] ) ] spids: [16777215 992] ) (command.If arms: [ (if_arm cond: [ (command.Sentence child: (command.DParen child: (arith_expr.ArithVarRef token:<Lit_ArithVarLike opt_pid>) spids: [996 1001] ) terminator: <Op_Semi ';'> ) ] action: [ (command.Assignment keyword: Assign_None pairs: [ (assign_pair lhs: (lhs_expr.LhsName name:filter spids:[1007]) op: Equal rhs: (word.EmptyWord) spids: [1007] ) ] spids: [1007] ) (command.ForEach iter_name: tid iter_words: [{(/proc/) ($ VSub_Name '$pid') (/task/) (Lit_Other '*')}] do_arg_iter: F body: (command.DoGroup children: [ (command.Assignment keyword: Assign_None pairs: [ (assign_pair lhs: (lhs_expr.LhsName name:filter spids:[1025]) op: Equal rhs: { (DQ ($ VSub_Name '$filter') (' || common_pid == ') (word_part.BracedVarSub token: <VSub_Name tid> suffix_op: (suffix_op.StringUnary op_id: VOp1_DPound arg_word: {('*') (Lit_Slash /)} ) spids: [1029 1034] ) ) } spids: [1025] ) ] spids: [1025] ) ] spids: [1022 1038] ) spids: [1015 1020] ) (command.Assignment keyword: Assign_None pairs: [ (assign_pair lhs: (lhs_expr.LhsName name:filter spids:[1041]) op: Equal rhs: { (word_part.BracedVarSub token: <VSub_Name filter> suffix_op: (suffix_op.Slice begin:(arith_expr.ArithWord w:{(Lit_Digits 3)})) spids: [1042 1046] ) } spids: [1041] ) ] spids: [1041] ) (command.If arms: [ (if_arm cond: [ (command.AndOr ops: [Op_DPipe] children: [ (command.Pipeline children: [ (command.SimpleCommand words: [{(echo)} {($ VSub_Name '$filter')}] redirects: [ (redir.Redir op: <Redir_Great '>'> fd: 16777215 arg_word: {(events/kprobes/getnameprobe/filter)} ) ] ) ] negated: T ) (command.Pipeline children: [ (command.SimpleCommand words: [{(echo)} {($ VSub_Name '$filter')}] redirects: [ (redir.Redir op: <Redir_Great '>'> fd: 16777215 arg_word: {(events/syscalls/sys_exit_open/filter)} ) ] ) ] negated: T ) ] ) ] action: [ (C {(edie)} {(DQ ('ERROR: setting -p ') ($ VSub_Name '$pid') ('. Exiting.'))}) ] spids: [16777215 1079] ) ] spids: [16777215 1091] ) ] spids: [16777215 1004] ) ] spids: [16777215 1093] ) (command.If arms: [ (if_arm cond: [ (command.Sentence child: (command.DParen child: (arith_expr.ArithVarRef token:<Lit_ArithVarLike opt_tid>) spids: [1097 1102] ) terminator: <Op_Semi ';'> ) ] action: [ (command.If arms: [ (if_arm cond: [ (command.AndOr ops: [Op_DPipe] children: [ (command.Pipeline children: [ (command.SimpleCommand words: [{(echo)} {(DQ ('common_pid == ') ($ VSub_Name '$tid'))}] redirects: [ (redir.Redir op: <Redir_Great '>'> fd: 16777215 arg_word: {(events/kprobes/getnameprobe/filter)} ) ] ) ] negated: T ) (command.Pipeline children: [ (command.SimpleCommand words: [{(echo)} {(DQ ('common_pid == ') ($ VSub_Name '$tid'))}] redirects: [ (redir.Redir op: <Redir_Great '>'> fd: 16777215 arg_word: {(events/syscalls/sys_exit_open/filter)} ) ] ) ] negated: T ) ] ) ] action: [ (C {(edie)} {(DQ ('ERROR: setting -L ') ($ VSub_Name '$tid') ('. Exiting.'))}) ] spids: [16777215 1141] ) ] spids: [16777215 1153] ) ] spids: [16777215 1105] ) ] spids: [16777215 1155] ) (command.If arms: [ (if_arm cond: [ (command.Sentence child: (command.Pipeline children: [ (command.SimpleCommand words: [{(echo)} {(1)}] redirects: [ (redir.Redir op: <Redir_Great '>'> fd: 16777215 arg_word: {(events/kprobes/getnameprobe/enable)} ) ] ) ] negated: T ) terminator: <Op_Semi ';'> ) ] action: [(C {(edie)} {(DQ ('ERROR: enabling kprobe for getname(). Exiting.'))})] spids: [16777215 1170] ) ] spids: [16777215 1179] ) (command.If arms: [ (if_arm cond: [ (command.Sentence child: (command.Pipeline children: [ (command.SimpleCommand words: [{(echo)} {(1)}] redirects: [ (redir.Redir op: <Redir_Great '>'> fd: 16777215 arg_word: {(events/syscalls/sys_exit_open/enable)} ) ] ) ] negated: T ) terminator: <Op_Semi ';'> ) ] action: [(C {(edie)} {(DQ ('ERROR: enabling open() exit tracepoint. Exiting.'))})] spids: [16777215 1194] ) ] spids: [16777215 1203] ) (command.AndOr ops: [Op_DAmp] children: [ (command.DParen child: (arith_expr.ArithVarRef token:<Lit_ArithVarLike opt_time>) spids: [1205 1210] ) (C {(printf)} {(DQ ('%-16s '))} {(DQ (TIMEs))}) ] ) (C {(printf)} {(DQ ('%-16.16s %-6s %4s %s') (Lit_Other '\\') (n))} {(DQ (COMM))} {(DQ (PID))} {(DQ (FD))} {(DQ (FILE))} ) (command.Assignment keyword: Assign_None pairs: [ (assign_pair lhs: (lhs_expr.LhsName name:offset spids:[1270]) op: Equal rhs: { (word_part.CommandSubPart command_list: (command.CommandList children: [ (C {($ VSub_Name '$awk')} { (SQ <'BEGIN { o = 0; }\n'> <'\t$1 == "#" && $2 ~ /TASK/ && NF == 6 { o = 1; }\n'> <'\t$2 ~ /TASK/ { print o; exit }'> ) } {(trace)} ) ] ) left_token: <Left_CommandSub '$('> spids: [1271 1281] ) } spids: [1270] ) ] spids: [1270] ) (C {(warn)} {(DQ ('echo > trace'))}) (command.Pipeline children: [ (command.Subshell child: (command.If arms: [ (if_arm cond: [ (command.Sentence child: (command.DParen child: (arith_expr.ArithVarRef token:<Lit_ArithVarLike opt_duration>) spids: [1297 1302] ) terminator: <Op_Semi ';'> ) ] action: [(C {(sleep)} {($ VSub_Name '$duration')}) (C {(cat)} {(trace)})] spids: [16777215 1305] ) ] else_action: [(C {(cat)} {(trace_pipe)})] spids: [1321 1332] ) spids: [1293 1334] ) (C {($ VSub_Name '$awk')} {(-v)} {(Lit_VarLike 'o=') ($ VSub_Name '$offset')} {(-v)} {(Lit_VarLike 'opt_name=') ($ VSub_Name '$opt_name')} {(-v)} {(Lit_VarLike 'name=') ($ VSub_Name '$name')} {(-v)} {(Lit_VarLike 'opt_duration=') ($ VSub_Name '$opt_duration')} {(-v)} {(Lit_VarLike 'opt_time=') ($ VSub_Name '$opt_time')} {(-v)} {(Lit_VarLike 'opt_fail=') ($ VSub_Name '$opt_fail')} {(-v)} {(Lit_VarLike 'opt_file=') ($ VSub_Name '$opt_file')} {(-v)} {(Lit_VarLike 'file=') ($ VSub_Name '$file')} { (SQ <'\n'> <'\t# common fields\n'> <'\t$1 != "#" {\n'> <'\t\t# task name can contain dashes and space\n'> <'\t\tsplit($0, line, "-")\n'> <'\t\tsub(/^[ \\t\\r\\n]+/, "", line[1])\n'> <'\t\tcomm = line[1]\n'> <'\t\tif (opt_name && match(comm, name) == 0)\n'> <'\t\t\tnext\n'> <'\t\tsub(/ .*$/, "", line[2])\n'> <'\t\tpid = line[2]\n'> <'\t}\n'> <'\n'> <'\t# do_sys_open()\n'> <'\t$1 != "#" && $(5+o) ~ /do_sys_open/ {\n'> <'\t\t#\n'> <'\t\t# eg: ... (do_sys_open+0xc3/0x220 <- getname) arg1="file1"\n'> <'\t\t#\n'> <'\t\tfilename = $NF\n'> <'\t\tsub(/"$/, "", filename)\n'> <'\t\tsub(/.*"/, "", filename)\n'> <'\t\tlastfile[pid] = filename\n'> <'\t}\n'> <'\n'> <'\t# sys_open()\n'> <'\t$1 != "#" && $(4+o) == "sys_open" {\n'> <'\t\tfilename = lastfile[pid]\n'> <'\t\tdelete lastfile[pid]\n'> <'\t\tif (opt_file && filename !~ file)\n'> <'\t\t\tnext\n'> <'\t\trval = $NF\n'> <'\t\t# matched failed as beginning with 0xfffff\n'> <'\t\tif (opt_fail && rval !~ /0xfffff/)\n'> <'\t\t\tnext\n'> <'\t\tif (rval ~ /0xfffff/)\n'> <'\t\t\trval = -1\n'> <'\n'> <'\t\tif (opt_time) {\n'> <'\t\t\ttime = $(3+o); sub(":", "", time)\n'> <'\t\t\tprintf "%-16s ", time\n'> <'\t\t}\n'> <'\t\tprintf "%-16.16s %-6s %4s %s\\n", comm, pid, rval, filename\n'> <'\t}\n'> <'\n'> <'\t$0 ~ /LOST.*EVENTS/ { print "WARNING: " $0 > "/dev/stderr" }\n'> ) } ) ] negated: F ) (C {(end)}) ] )