(command.CommandList children: [ (command.ShAssignment pairs: [ (assign_pair lhs: (sh_lhs_expr.Name name:tracing) op: Equal rhs: {(/sys/kernel/debug/tracing)} ) ] ) (command.CommandList children: [ (command.Sentence child: (command.ShAssignment pairs: [ (assign_pair lhs: (sh_lhs_expr.Name name:flock) op: Equal rhs: {(/var/tmp/.ftrace-lock)} ) ] ) terminator: <Op_Semi ';'> ) (command.ShAssignment pairs: [(assign_pair lhs:(sh_lhs_expr.Name name:wroteflock) op:Equal rhs:{(0)})] ) ] ) (command.CommandList children: [ (command.Sentence child: (command.ShAssignment pairs: [(assign_pair lhs:(sh_lhs_expr.Name name:opt_duration) op:Equal rhs:{(0)})] ) terminator: <Op_Semi ';'> ) (command.Sentence child: (command.ShAssignment pairs: [(assign_pair lhs:(sh_lhs_expr.Name name:duration) op:Equal rhs:(word.Empty))] ) terminator: <Op_Semi ';'> ) (command.Sentence child: (command.ShAssignment pairs: [(assign_pair lhs:(sh_lhs_expr.Name name:opt_name) op:Equal rhs:{(0)})] ) terminator: <Op_Semi ';'> ) (command.Sentence child: (command.ShAssignment pairs: [(assign_pair lhs:(sh_lhs_expr.Name name:name) op:Equal rhs:(word.Empty))] ) terminator: <Op_Semi ';'> ) (command.Sentence child: (command.ShAssignment pairs: [(assign_pair lhs:(sh_lhs_expr.Name name:opt_pid) op:Equal rhs:{(0)})] ) terminator: <Op_Semi ';'> ) (command.Sentence child: (command.ShAssignment pairs: [(assign_pair lhs:(sh_lhs_expr.Name name:pid) op:Equal rhs:(word.Empty))] ) terminator: <Op_Semi ';'> ) (command.Sentence child: (command.ShAssignment pairs: [(assign_pair lhs:(sh_lhs_expr.Name name:opt_tid) op:Equal rhs:{(0)})] ) terminator: <Op_Semi ';'> ) (command.ShAssignment pairs: [(assign_pair lhs:(sh_lhs_expr.Name name:tid) op:Equal rhs:(word.Empty))] ) ] ) (command.CommandList children: [ (command.Sentence child: (command.ShAssignment pairs: [(assign_pair lhs:(sh_lhs_expr.Name name:ftext) op:Equal rhs:(word.Empty))] ) terminator: <Op_Semi ';'> ) (command.Sentence child: (command.ShAssignment pairs: [(assign_pair lhs:(sh_lhs_expr.Name name:opt_time) op:Equal rhs:{(0)})] ) terminator: <Op_Semi ';'> ) (command.Sentence child: (command.ShAssignment pairs: [(assign_pair lhs:(sh_lhs_expr.Name name:opt_fail) op:Equal rhs:{(0)})] ) terminator: <Op_Semi ';'> ) (command.Sentence child: (command.ShAssignment pairs: [(assign_pair lhs:(sh_lhs_expr.Name name:opt_file) op:Equal rhs:{(0)})] ) terminator: <Op_Semi ';'> ) (command.ShAssignment pairs: [(assign_pair lhs:(sh_lhs_expr.Name name:file) op:Equal rhs:(word.Empty))] ) ] ) (C {(trap)} {(SQ <':'>)} {(INT)} {(QUIT)} {(TERM)} {(PIPE)} {(HUP)}) (command.ShFunction name: usage body: (command.BraceGroup children: [ (command.Simple words: [{(cat)}] redirects: [ (redir.HereDoc op: <Redir_DLessDash '<<-'> fd: 16777215 here_begin: {(END)} here_end_span_id: 259 stdin_parts: [ ('USAGE: opensnoop [-htx] [-d secs] [-p PID] [-L TID] [-n name] [filename]\n') (' -d seconds # trace duration, and use buffers\n') (' -n name # process name to match on open\n') (' -p PID # PID to match on open\n') (' -L TID # PID to match on open\n') (' -t # include time (seconds)\n') (' -x # only show failed opens\n') (' -h # this usage message\n') (' filename # match filename (partials, REs, ok)\n') (' eg,\n') (' opensnoop # watch open()s live (unbuffered)\n') (' opensnoop -d 1 # trace 1 sec (buffered)\n') (' opensnoop -p 181 # trace I/O issued by PID 181 only\n') (' opensnoop conf # trace filenames containing ') (Right_DoubleQuote '"') (conf) (Right_DoubleQuote '"') ('\n') (" opensnoop 'log") (Lit_Other '$') ("' # filenames ending in ") (Right_DoubleQuote '"') (log) (Right_DoubleQuote '"') ('\n') ('\n') ('See the man page and example file for more info.\n') ] ) (redir.Redir op:<Redir_GreatAnd '>&'> fd:16777215 arg_word:{(2)}) ] ) (command.ControlFlow token:<ControlFlow_Exit exit>) ] ) ) (command.ShFunction name: warn body: (command.BraceGroup children: [ (command.If arms: [ (if_arm cond: [ (command.Sentence child: (command.Pipeline children: [(C {(eval)} {(DQ ($ VSub_At '$@'))})] negated: T ) terminator: <Op_Semi ';'> ) ] action: [ (command.Simple words: [ {(echo)} { (DQ ('WARNING: command failed ') (word_part.EscapedLiteral token: <Lit_EscapedChar '\\"'> ) ($ VSub_At '$@') (word_part.EscapedLiteral token:<Lit_EscapedChar '\\"'>) ) } ] redirects: [(redir.Redir op:<Redir_GreatAnd '>&'> fd:16777215 arg_word:{(2)})] ) ] ) ] ) ] ) ) (command.ShFunction name: end body: (command.BraceGroup children: [ (command.Simple words: [{(echo)}] redirects: [(redir.Redir op:<Redir_Great '2>'> fd:2 arg_word:{(/dev/null)})] ) (command.Simple words: [{(echo)} {(DQ ('Ending tracing...'))}] redirects: [(redir.Redir op:<Redir_Great '2>'> fd:2 arg_word:{(/dev/null)})] ) (C {(cd)} {($ VSub_DollarName '$tracing')}) (C {(warn)} {(DQ ('echo 0 > events/kprobes/getnameprobe/enable'))}) (C {(warn)} {(DQ ('echo 0 > events/syscalls/sys_exit_open/enable'))}) (command.If arms: [ (if_arm cond: [ (command.Sentence child: (command.DParen child: (arith_expr.Binary op_id: Arith_DPipe left: (arith_expr.VarRef token:<Lit_ArithVarLike opt_pid>) right: (arith_expr.VarRef token:<Lit_ArithVarLike opt_tid>) ) ) terminator: <Op_Semi ';'> ) ] action: [ (C {(warn)} {(DQ ('echo 0 > events/kprobes/getnameprobe/filter'))}) (C {(warn)} {(DQ ('echo 0 > events/syscalls/sys_exit_open/filter'))}) ] ) ] ) (C {(warn)} {(DQ ('echo -:getnameprobe >> kprobe_events'))}) (C {(warn)} {(DQ ('echo > trace'))}) (command.AndOr ops: [Op_DAmp] children: [ (command.DParen child: (arith_expr.VarRef token:<Lit_ArithVarLike wroteflock>) ) (C {(warn)} {(DQ ('rm ') ($ VSub_DollarName '$flock'))}) ] ) ] ) ) (command.ShFunction name: die body: (command.BraceGroup children: [ (command.Simple words: [{(echo)} {(DQ ($ VSub_At '$@'))}] redirects: [(redir.Redir op:<Redir_GreatAnd '>&'> fd:16777215 arg_word:{(2)})] ) (command.ControlFlow token:<ControlFlow_Exit exit> arg_word:{(1)}) ] ) ) (command.ShFunction name: edie body: (command.BraceGroup children: [ (command.Simple words: [{(echo)} {(DQ ($ VSub_At '$@'))}] redirects: [(redir.Redir op:<Redir_GreatAnd '>&'> fd:16777215 arg_word:{(2)})] ) (command.Simple words: [{(exec)}] redirects: [ (redir.Redir op:<Redir_Great '>'> fd:16777215 arg_word:{(/dev/null)}) (redir.Redir op:<Redir_GreatAnd '2>&'> fd:2 arg_word:{(1)}) ] ) (C {(end)}) (command.ControlFlow token:<ControlFlow_Exit exit> arg_word:{(1)}) ] ) ) (command.WhileUntil keyword: <KW_While while> cond: [ (C {(getopts)} {(d) (Lit_Other ':') (hn) (Lit_Other ':') (p) (Lit_Other ':') (L) (Lit_Other ':') (tx)} {(opt)} ) ] body: (command.DoGroup children: [ (command.Case to_match: {($ VSub_DollarName '$opt')} arms: [ (case_arm pat_list: [{(d)}] action: [ (command.Sentence child: (command.ShAssignment pairs: [ (assign_pair lhs: (sh_lhs_expr.Name name:opt_duration) op: Equal rhs: {(1)} ) ] ) terminator: <Op_Semi ';'> ) (command.ShAssignment pairs: [ (assign_pair lhs: (sh_lhs_expr.Name name:duration) op: Equal rhs: {($ VSub_DollarName '$OPTARG')} ) ] ) ] ) (case_arm pat_list: [{(n)}] action: [ (command.Sentence child: (command.ShAssignment pairs: [(assign_pair lhs:(sh_lhs_expr.Name name:opt_name) op:Equal rhs:{(1)})] ) terminator: <Op_Semi ';'> ) (command.ShAssignment pairs: [ (assign_pair lhs: (sh_lhs_expr.Name name:name) op: Equal rhs: {($ VSub_DollarName '$OPTARG')} ) ] ) ] ) (case_arm pat_list: [{(p)}] action: [ (command.Sentence child: (command.ShAssignment pairs: [(assign_pair lhs:(sh_lhs_expr.Name name:opt_pid) op:Equal rhs:{(1)})] ) terminator: <Op_Semi ';'> ) (command.ShAssignment pairs: [ (assign_pair lhs: (sh_lhs_expr.Name name:pid) op: Equal rhs: {($ VSub_DollarName '$OPTARG')} ) ] ) ] ) (case_arm pat_list: [{(L)}] action: [ (command.Sentence child: (command.ShAssignment pairs: [(assign_pair lhs:(sh_lhs_expr.Name name:opt_tid) op:Equal rhs:{(1)})] ) terminator: <Op_Semi ';'> ) (command.ShAssignment pairs: [ (assign_pair lhs: (sh_lhs_expr.Name name:tid) op: Equal rhs: {($ VSub_DollarName '$OPTARG')} ) ] ) ] ) (case_arm pat_list: [{(t)}] action: [ (command.ShAssignment pairs: [(assign_pair lhs:(sh_lhs_expr.Name name:opt_time) op:Equal rhs:{(1)})] ) ] ) (case_arm pat_list: [{(x)}] action: [ (command.ShAssignment pairs: [(assign_pair lhs:(sh_lhs_expr.Name name:opt_fail) op:Equal rhs:{(1)})] ) ] ) (case_arm pat_list:[{(h)} {(Lit_QMark '?')}] action:[(C {(usage)})]) ] ) ] ) ) (C {(shift)} { (word_part.ArithSub anode: (arith_expr.Binary op_id: Arith_Minus left: (arith_expr.ArithWord w:{($ VSub_DollarName '$OPTIND')}) right: (arith_expr.ArithWord w:{(Lit_Digits 1)}) ) ) } ) (command.If arms: [ (if_arm cond: [ (command.Sentence child: (command.DParen child:(arith_expr.ArithWord w:{($ VSub_Pound '$#')})) terminator: <Op_Semi ';'> ) ] action: [ (command.ShAssignment pairs: [(assign_pair lhs:(sh_lhs_expr.Name name:opt_file) op:Equal rhs:{(1)})] ) (command.ShAssignment pairs: [ (assign_pair lhs: (sh_lhs_expr.Name name:file) op: Equal rhs: {($ VSub_Number '$1')} ) ] ) (C {(shift)}) ] ) ] ) (command.AndOr ops: [Op_DAmp] children: [(command.DParen child:(arith_expr.ArithWord w:{($ VSub_Pound '$#')})) (C {(usage)})] ) (command.AndOr ops: [Op_DAmp] children: [ (command.DParen child: (arith_expr.Binary op_id: Arith_Great left: (arith_expr.Binary op_id: Arith_Plus left: (arith_expr.Binary op_id: Arith_Plus left: (arith_expr.VarRef token:<Lit_ArithVarLike opt_pid>) right: (arith_expr.VarRef token:<Lit_ArithVarLike opt_name>) ) right: (arith_expr.VarRef token:<Lit_ArithVarLike opt_tid>) ) right: (arith_expr.ArithWord w:{(Lit_Digits 1)}) ) ) (C {(die)} {(DQ ('ERROR: use at most one of -p, -n, -L.'))}) ] ) (command.AndOr ops: [Op_DAmp] children: [ (command.DParen child:(arith_expr.VarRef token:<Lit_ArithVarLike opt_pid>)) (command.ShAssignment pairs: [ (assign_pair lhs: (sh_lhs_expr.Name name:ftext) op: Equal rhs: {(DQ (' issued by PID ') ($ VSub_DollarName '$pid'))} ) ] ) ] ) (command.AndOr ops: [Op_DAmp] children: [ (command.DParen child:(arith_expr.VarRef token:<Lit_ArithVarLike opt_tid>)) (command.ShAssignment pairs: [ (assign_pair lhs: (sh_lhs_expr.Name name:ftext) op: Equal rhs: {(DQ (' issued by TID ') ($ VSub_DollarName '$tid'))} ) ] ) ] ) (command.AndOr ops: [Op_DAmp] children: [ (command.DParen child:(arith_expr.VarRef token:<Lit_ArithVarLike opt_name>)) (command.ShAssignment pairs: [ (assign_pair lhs: (sh_lhs_expr.Name name:ftext) op: Equal rhs: { (DQ (' issued by process name ') (word_part.EscapedLiteral token:<Lit_EscapedChar '\\"'>) ($ VSub_DollarName '$name') (word_part.EscapedLiteral token:<Lit_EscapedChar '\\"'>) ) } ) ] ) ] ) (command.AndOr ops: [Op_DAmp] children: [ (command.DParen child:(arith_expr.VarRef token:<Lit_ArithVarLike opt_file>)) (command.ShAssignment pairs: [ (assign_pair lhs: (sh_lhs_expr.Name name:ftext) op: Equal rhs: { (DQ ($ VSub_DollarName '$ftext') (' for filenames containing ') (word_part.EscapedLiteral token:<Lit_EscapedChar '\\"'>) ($ VSub_DollarName '$file') (word_part.EscapedLiteral token:<Lit_EscapedChar '\\"'>) ) } ) ] ) ] ) (command.If arms: [ (if_arm cond: [ (command.Sentence child: (command.DParen child:(arith_expr.VarRef token:<Lit_ArithVarLike opt_duration>)) terminator: <Op_Semi ';'> ) ] action: [ (C {(echo)} { (DQ ('Tracing open()s') ($ VSub_DollarName '$ftext') (' for ') ($ VSub_DollarName '$duration') (' seconds (buffered)...') ) } ) ] ) ] else_action: [ (C {(echo)} {(DQ ('Tracing open()s') ($ VSub_DollarName '$ftext') ('. Ctrl-C to end.'))}) ] ) (command.AndOr ops: [Op_DAmp Op_DPipe] children: [ (command.DParen child:(arith_expr.VarRef token:<Lit_ArithVarLike opt_duration>)) (command.ShAssignment pairs: [(assign_pair lhs:(sh_lhs_expr.Name name:use) op:Equal rhs:{(mawk)})] ) (command.ShAssignment pairs: [(assign_pair lhs:(sh_lhs_expr.Name name:use) op:Equal rhs:{(gawk)})] ) ] ) (command.AndOr ops: [Op_DAmp Op_DPipe] children: [ (command.DBracket expr: (bool_expr.Unary op_id:BoolUnary_x child:{(/usr/bin/) ($ VSub_DollarName '$use')}) ) (command.ShAssignment pairs: [ (assign_pair lhs: (sh_lhs_expr.Name name:awk) op: Equal rhs: {($ VSub_DollarName '$use')} ) ] ) (command.ShAssignment pairs: [(assign_pair lhs:(sh_lhs_expr.Name name:awk) op:Equal rhs:{(awk)})] ) ] ) (command.AndOr ops: [Op_DPipe] children: [ (C {(cd)} {($ VSub_DollarName '$tracing')}) (C {(die)} { (DQ ('ERROR: accessing tracing. Root user? Kernel has FTRACE?\n') (' debugfs mounted? (mount -t debugfs debugfs /sys/kernel/debug)') ) } ) ] ) (command.AndOr ops: [Op_DAmp] children: [ (command.DBracket expr: (bool_expr.Unary op_id:BoolUnary_e child:{($ VSub_DollarName '$flock')}) ) (C {(die)} { (DQ ('ERROR: ftrace may be in use by PID ') (command_sub left_token: <Left_DollarParen '$('> command_list: (command.CommandList children: [(C {(cat)} {($ VSub_DollarName '$flock')})] ) ) (' ') ($ VSub_DollarName '$flock') ) } ) ] ) (command.AndOr ops: [Op_DPipe] children: [ (command.Simple words: [{(echo)} {($ VSub_Dollar '$$')}] redirects: [ (redir.Redir op: <Redir_Great '>'> fd: 16777215 arg_word: {($ VSub_DollarName '$flock')} ) ] ) (C {(die)} {(DQ ('ERROR: unable to write ') ($ VSub_DollarName '$flock') (.))}) ] ) (command.ShAssignment pairs: [(assign_pair lhs:(sh_lhs_expr.Name name:wroteflock) op:Equal rhs:{(1)})] ) (command.Simple words: [{(echo)} {(nop)}] redirects: [(redir.Redir op:<Redir_Great '>'> fd:16777215 arg_word:{(current_tracer)})] ) (command.ShAssignment pairs: [ (assign_pair lhs: (sh_lhs_expr.Name name:ver) op: Equal rhs: { (command_sub left_token: <Left_DollarParen '$('> command_list: (command.CommandList children:[(C {(uname)} {(-r)})]) ) } ) ] ) (command.If arms: [ (if_arm cond: [ (command.Sentence child: (command.DBracket expr: (bool_expr.LogicalOr left: (bool_expr.Binary op_id: BoolBinary_GlobDEqual left: {(DQ ($ VSub_DollarName '$ver'))} right: {(2.) (Lit_Other '*')} ) right: (bool_expr.Binary op_id: BoolBinary_GlobDEqual left: {(DQ ($ VSub_DollarName '$ver'))} right: {(3.) (Lit_Other '[') (1-6) (Lit_Other ']') (.) (Lit_Other '*')} ) ) ) terminator: <Op_Semi ';'> ) ] action: [ (command.ShAssignment pairs: [ (assign_pair lhs: (sh_lhs_expr.Name name:kprobe) op: Equal rhs: {(SQ <'r:getnameprobe getname +0($retval):string'>)} ) ] ) ] ) ] else_action: [ (command.ShAssignment pairs: [ (assign_pair lhs: (sh_lhs_expr.Name name:kprobe) op: Equal rhs: {(SQ <'r:getnameprobe getname +0(+0($retval)):string'>)} ) ] ) ] ) (command.If arms: [ (if_arm cond: [ (command.Sentence child: (command.Pipeline children: [ (command.Simple words: [{(echo)} {($ VSub_DollarName '$kprobe')}] redirects: [ (redir.Redir op: <Redir_DGreat '>>'> fd: 16777215 arg_word: {(kprobe_events)} ) ] ) ] negated: T ) terminator: <Op_Semi ';'> ) ] action: [(C {(edie)} {(DQ ('ERROR: adding a kprobe for getname(). Exiting.'))})] ) ] ) (command.If arms: [ (if_arm cond: [ (command.Sentence child: (command.DParen child:(arith_expr.VarRef token:<Lit_ArithVarLike opt_pid>)) terminator: <Op_Semi ';'> ) ] action: [ (command.ShAssignment pairs: [(assign_pair lhs:(sh_lhs_expr.Name name:filter) op:Equal rhs:(word.Empty))] ) (command.ForEach iter_name: tid iter_words: [{(/proc/) ($ VSub_DollarName '$pid') (/task/) (Lit_Star '*')}] do_arg_iter: F body: (command.DoGroup children: [ (command.ShAssignment pairs: [ (assign_pair lhs: (sh_lhs_expr.Name name:filter) op: Equal rhs: { (DQ ($ VSub_DollarName '$filter') (' || common_pid == ') (braced_var_sub token: <VSub_Name tid> suffix_op: (suffix_op.Unary op_id: VOp1_DPound arg_word: {('*') (Lit_Slash /)} ) ) ) } ) ] ) ] ) ) (command.ShAssignment pairs: [ (assign_pair lhs: (sh_lhs_expr.Name name:filter) op: Equal rhs: { (braced_var_sub token: <VSub_Name filter> suffix_op: (suffix_op.Slice begin:(arith_expr.ArithWord w:{(Lit_Digits 3)})) ) } ) ] ) (command.If arms: [ (if_arm cond: [ (command.AndOr ops: [Op_DPipe] children: [ (command.Pipeline children: [ (command.Simple words: [{(echo)} {($ VSub_DollarName '$filter')}] redirects: [ (redir.Redir op: <Redir_Great '>'> fd: 16777215 arg_word: {(events/kprobes/getnameprobe/filter)} ) ] ) ] negated: T ) (command.Pipeline children: [ (command.Simple words: [{(echo)} {($ VSub_DollarName '$filter')}] redirects: [ (redir.Redir op: <Redir_Great '>'> fd: 16777215 arg_word: {(events/syscalls/sys_exit_open/filter)} ) ] ) ] negated: T ) ] ) ] action: [ (C {(edie)} {(DQ ('ERROR: setting -p ') ($ VSub_DollarName '$pid') ('. Exiting.'))}) ] ) ] ) ] ) ] ) (command.If arms: [ (if_arm cond: [ (command.Sentence child: (command.DParen child:(arith_expr.VarRef token:<Lit_ArithVarLike opt_tid>)) terminator: <Op_Semi ';'> ) ] action: [ (command.If arms: [ (if_arm cond: [ (command.AndOr ops: [Op_DPipe] children: [ (command.Pipeline children: [ (command.Simple words: [{(echo)} {(DQ ('common_pid == ') ($ VSub_DollarName '$tid'))}] redirects: [ (redir.Redir op: <Redir_Great '>'> fd: 16777215 arg_word: {(events/kprobes/getnameprobe/filter)} ) ] ) ] negated: T ) (command.Pipeline children: [ (command.Simple words: [{(echo)} {(DQ ('common_pid == ') ($ VSub_DollarName '$tid'))}] redirects: [ (redir.Redir op: <Redir_Great '>'> fd: 16777215 arg_word: {(events/syscalls/sys_exit_open/filter)} ) ] ) ] negated: T ) ] ) ] action: [ (C {(edie)} {(DQ ('ERROR: setting -L ') ($ VSub_DollarName '$tid') ('. Exiting.'))}) ] ) ] ) ] ) ] ) (command.If arms: [ (if_arm cond: [ (command.Sentence child: (command.Pipeline children: [ (command.Simple words: [{(echo)} {(1)}] redirects: [ (redir.Redir op: <Redir_Great '>'> fd: 16777215 arg_word: {(events/kprobes/getnameprobe/enable)} ) ] ) ] negated: T ) terminator: <Op_Semi ';'> ) ] action: [(C {(edie)} {(DQ ('ERROR: enabling kprobe for getname(). Exiting.'))})] ) ] ) (command.If arms: [ (if_arm cond: [ (command.Sentence child: (command.Pipeline children: [ (command.Simple words: [{(echo)} {(1)}] redirects: [ (redir.Redir op: <Redir_Great '>'> fd: 16777215 arg_word: {(events/syscalls/sys_exit_open/enable)} ) ] ) ] negated: T ) terminator: <Op_Semi ';'> ) ] action: [(C {(edie)} {(DQ ('ERROR: enabling open() exit tracepoint. Exiting.'))})] ) ] ) (command.AndOr ops: [Op_DAmp] children: [ (command.DParen child:(arith_expr.VarRef token:<Lit_ArithVarLike opt_time>)) (C {(printf)} {(DQ ('%-16s '))} {(DQ (TIMEs))}) ] ) (C {(printf)} {(DQ ('%-16.16s %-6s %4s %s') (Lit_Other '\\') (n))} {(DQ (COMM))} {(DQ (PID))} {(DQ (FD))} {(DQ (FILE))} ) (command.ShAssignment pairs: [ (assign_pair lhs: (sh_lhs_expr.Name name:offset) op: Equal rhs: { (command_sub left_token: <Left_DollarParen '$('> command_list: (command.CommandList children: [ (C {($ VSub_DollarName '$awk')} { (SQ <'BEGIN { o = 0; }\n'> <'\t$1 == "#" && $2 ~ /TASK/ && NF == 6 { o = 1; }\n'> <'\t$2 ~ /TASK/ { print o; exit }'> ) } {(trace)} ) ] ) ) } ) ] ) (C {(warn)} {(DQ ('echo > trace'))}) (command.Pipeline children: [ (command.Subshell command_list: (command.CommandList children: [ (command.If arms: [ (if_arm cond: [ (command.Sentence child: (command.DParen child: (arith_expr.VarRef token:<Lit_ArithVarLike opt_duration>) ) terminator: <Op_Semi ';'> ) ] action: [(C {(sleep)} {($ VSub_DollarName '$duration')}) (C {(cat)} {(trace)})] ) ] else_action: [(C {(cat)} {(trace_pipe)})] ) ] ) ) (C {($ VSub_DollarName '$awk')} {(-v)} {(Lit_VarLike 'o=') ($ VSub_DollarName '$offset')} {(-v)} {(Lit_VarLike 'opt_name=') ($ VSub_DollarName '$opt_name')} {(-v)} {(Lit_VarLike 'name=') ($ VSub_DollarName '$name')} {(-v)} {(Lit_VarLike 'opt_duration=') ($ VSub_DollarName '$opt_duration')} {(-v)} {(Lit_VarLike 'opt_time=') ($ VSub_DollarName '$opt_time')} {(-v)} {(Lit_VarLike 'opt_fail=') ($ VSub_DollarName '$opt_fail')} {(-v)} {(Lit_VarLike 'opt_file=') ($ VSub_DollarName '$opt_file')} {(-v)} {(Lit_VarLike 'file=') ($ VSub_DollarName '$file')} { (SQ <'\n'> <'\t# common fields\n'> <'\t$1 != "#" {\n'> <'\t\t# task name can contain dashes and space\n'> <'\t\tsplit($0, line, "-")\n'> <'\t\tsub(/^[ \\t\\r\\n]+/, "", line[1])\n'> <'\t\tcomm = line[1]\n'> <'\t\tif (opt_name && match(comm, name) == 0)\n'> <'\t\t\tnext\n'> <'\t\tsub(/ .*$/, "", line[2])\n'> <'\t\tpid = line[2]\n'> <'\t}\n'> <'\n'> <'\t# do_sys_open()\n'> <'\t$1 != "#" && $(5+o) ~ /do_sys_open/ {\n'> <'\t\t#\n'> <'\t\t# eg: ... (do_sys_open+0xc3/0x220 <- getname) arg1="file1"\n'> <'\t\t#\n'> <'\t\tfilename = $NF\n'> <'\t\tsub(/"$/, "", filename)\n'> <'\t\tsub(/.*"/, "", filename)\n'> <'\t\tlastfile[pid] = filename\n'> <'\t}\n'> <'\n'> <'\t# sys_open()\n'> <'\t$1 != "#" && $(4+o) == "sys_open" {\n'> <'\t\tfilename = lastfile[pid]\n'> <'\t\tdelete lastfile[pid]\n'> <'\t\tif (opt_file && filename !~ file)\n'> <'\t\t\tnext\n'> <'\t\trval = $NF\n'> <'\t\t# matched failed as beginning with 0xfffff\n'> <'\t\tif (opt_fail && rval !~ /0xfffff/)\n'> <'\t\t\tnext\n'> <'\t\tif (rval ~ /0xfffff/)\n'> <'\t\t\trval = -1\n'> <'\n'> <'\t\tif (opt_time) {\n'> <'\t\t\ttime = $(3+o); sub(":", "", time)\n'> <'\t\t\tprintf "%-16s ", time\n'> <'\t\t}\n'> <'\t\tprintf "%-16.16s %-6s %4s %s\\n", comm, pid, rval, filename\n'> <'\t}\n'> <'\n'> <'\t$0 ~ /LOST.*EVENTS/ { print "WARNING: " $0 > "/dev/stderr" }\n'> ) } ) ] negated: F ) (C {(end)}) ] )