(command.CommandList children: [ (command.ShAssignment pairs: [ (assign_pair lhs: (sh_lhs_expr.Name name:tracing) op: assign_op.Equal rhs: {</sys/kernel/debug/tracing>} spids: [142] ) ] ) (command.CommandList children: [ (command.Sentence child: (command.ShAssignment pairs: [ (assign_pair lhs: (sh_lhs_expr.Name name:flock) op: assign_op.Equal rhs: {</var/tmp/.ftrace-lock>} spids: [145] ) ] ) terminator: <Id.Op_Semi _> ) (command.ShAssignment pairs: [ (assign_pair lhs: (sh_lhs_expr.Name name:wroteflock) op: assign_op.Equal rhs: {<0>} spids: [149] ) ] ) ] ) (command.CommandList children: [ (command.Sentence child: (command.ShAssignment pairs: [ (assign_pair lhs: (sh_lhs_expr.Name name:opt_duration) op: assign_op.Equal rhs: {<0>} spids: [152] ) ] ) terminator: <Id.Op_Semi _> ) (command.Sentence child: (command.ShAssignment pairs: [ (assign_pair lhs: (sh_lhs_expr.Name name:duration) op: assign_op.Equal rhs: (word.Empty) spids: [156] ) ] ) terminator: <Id.Op_Semi _> ) (command.Sentence child: (command.ShAssignment pairs: [ (assign_pair lhs: (sh_lhs_expr.Name name:opt_name) op: assign_op.Equal rhs: {<0>} spids: [159] ) ] ) terminator: <Id.Op_Semi _> ) (command.Sentence child: (command.ShAssignment pairs: [ (assign_pair lhs: (sh_lhs_expr.Name name:name) op: assign_op.Equal rhs: (word.Empty) spids: [163] ) ] ) terminator: <Id.Op_Semi _> ) (command.Sentence child: (command.ShAssignment pairs: [ (assign_pair lhs: (sh_lhs_expr.Name name:opt_pid) op: assign_op.Equal rhs: {<0>} spids: [166] ) ] ) terminator: <Id.Op_Semi _> ) (command.Sentence child: (command.ShAssignment pairs: [ (assign_pair lhs: (sh_lhs_expr.Name name:pid) op: assign_op.Equal rhs: (word.Empty) spids: [170] ) ] ) terminator: <Id.Op_Semi _> ) (command.Sentence child: (command.ShAssignment pairs: [ (assign_pair lhs: (sh_lhs_expr.Name name:opt_tid) op: assign_op.Equal rhs: {<0>} spids: [173] ) ] ) terminator: <Id.Op_Semi _> ) (command.ShAssignment pairs: [ (assign_pair lhs: (sh_lhs_expr.Name name:tid) op: assign_op.Equal rhs: (word.Empty) spids: [177] ) ] ) ] ) (command.CommandList children: [ (command.Sentence child: (command.ShAssignment pairs: [ (assign_pair lhs: (sh_lhs_expr.Name name:ftext) op: assign_op.Equal rhs: (word.Empty) spids: [179] ) ] ) terminator: <Id.Op_Semi _> ) (command.Sentence child: (command.ShAssignment pairs: [ (assign_pair lhs: (sh_lhs_expr.Name name:opt_time) op: assign_op.Equal rhs: {<0>} spids: [182] ) ] ) terminator: <Id.Op_Semi _> ) (command.Sentence child: (command.ShAssignment pairs: [ (assign_pair lhs: (sh_lhs_expr.Name name:opt_fail) op: assign_op.Equal rhs: {<0>} spids: [186] ) ] ) terminator: <Id.Op_Semi _> ) (command.Sentence child: (command.ShAssignment pairs: [ (assign_pair lhs: (sh_lhs_expr.Name name:opt_file) op: assign_op.Equal rhs: {<0>} spids: [190] ) ] ) terminator: <Id.Op_Semi _> ) (command.ShAssignment pairs: [ (assign_pair lhs: (sh_lhs_expr.Name name:file) op: assign_op.Equal rhs: (word.Empty) spids: [194] ) ] ) ] ) (C {<trap>} {(SQ <':'>)} {<INT>} {<QUIT>} {<TERM>} {<PIPE>} {<HUP>}) (command.ShFunction name: usage body: (command.BraceGroup children: [ (command.Simple words: [{<cat>}] redirects: [ (redir.HereDoc op: <Id.Redir_DLessDash '<<-'> fd: -1 here_begin: {<END>} here_end_span_id: 259 stdin_parts: [ <'USAGE: opensnoop [-htx] [-d secs] [-p PID] [-L TID] [-n name] [filename]\n'> <' -d seconds # trace duration, and use buffers\n'> <' -n name # process name to match on open\n'> <' -p PID # PID to match on open\n'> <' -L TID # PID to match on open\n'> <' -t # include time (seconds)\n'> <' -x # only show failed opens\n'> <' -h # this usage message\n'> <' filename # match filename (partials, REs, ok)\n'> <' eg,\n'> <' opensnoop # watch open()s live (unbuffered)\n'> <' opensnoop -d 1 # trace 1 sec (buffered)\n'> <' opensnoop -p 181 # trace I/O issued by PID 181 only\n'> <' opensnoop conf # trace filenames containing '> <Id.Right_DoubleQuote '"'> <conf> <Id.Right_DoubleQuote '"'> <'\n'> <" opensnoop 'log"> <Id.Lit_Other '$'> <"' # filenames ending in "> <Id.Right_DoubleQuote '"'> <log> <Id.Right_DoubleQuote '"'> <'\n'> <'\n'> <'See the man page and example file for more info.\n'> ] ) (redir.Redir op:<Id.Redir_GreatAnd '>&'> fd:-1 arg_word:{<2>}) ] ) (command.ControlFlow token:<Id.ControlFlow_Exit exit>) ] ) ) (command.ShFunction name: warn body: (command.BraceGroup children: [ (command.If arms: [ (if_arm cond: [ (command.Sentence child: (command.Pipeline children: [(C {<eval>} {(DQ ($ Id.VSub_At '$@'))})] negated: T ) terminator: <Id.Op_Semi _> ) ] action: [ (command.Simple words: [ {<echo>} { (DQ <'WARNING: command failed '> (word_part.EscapedLiteral token: <Id.Lit_EscapedChar '\\"'> ) ($ Id.VSub_At '$@') (word_part.EscapedLiteral token:<Id.Lit_EscapedChar '\\"'>) ) } ] redirects: [(redir.Redir op:<Id.Redir_GreatAnd '>&'> fd:-1 arg_word:{<2>})] ) ] spids: [273 284] ) ] ) ] ) ) (command.ShFunction name: end body: (command.BraceGroup children: [ (command.Simple words: [{<echo>}] redirects: [(redir.Redir op:<Id.Redir_Great '2>'> fd:2 arg_word:{</dev/null>})] ) (command.Simple words: [{<echo>} {(DQ <'Ending tracing...'>)}] redirects: [(redir.Redir op:<Id.Redir_Great '2>'> fd:2 arg_word:{</dev/null>})] ) (C {<cd>} {($ Id.VSub_DollarName '$tracing')}) (C {<warn>} {(DQ <'echo 0 > events/kprobes/getnameprobe/enable'>)}) (C {<warn>} {(DQ <'echo 0 > events/syscalls/sys_exit_open/enable'>)}) (command.If arms: [ (if_arm cond: [ (command.Sentence child: (command.DParen child: (arith_expr.Binary op_id: Id.Arith_DPipe left: (arith_expr.VarRef token:<Id.Lit_ArithVarLike opt_pid>) right: (arith_expr.VarRef token:<Id.Lit_ArithVarLike opt_tid>) ) ) terminator: <Id.Op_Semi _> ) ] action: [ (C {<warn>} {(DQ <'echo 0 > events/kprobes/getnameprobe/filter'>)}) (C {<warn>} {(DQ <'echo 0 > events/syscalls/sys_exit_open/filter'>)}) ] spids: [351 365] ) ] ) (C {<warn>} {(DQ <'echo -:getnameprobe >> kprobe_events'>)}) (C {<warn>} {(DQ <'echo > trace'>)}) (command.AndOr ops: [Id.Op_DAmp] children: [ (command.DParen child: (arith_expr.VarRef token:<Id.Lit_ArithVarLike wroteflock>) ) (C {<warn>} {(DQ <'rm '> ($ Id.VSub_DollarName '$flock'))}) ] ) ] ) ) (command.ShFunction name: die body: (command.BraceGroup children: [ (command.Simple words: [{<echo>} {(DQ ($ Id.VSub_At '$@'))}] redirects: [(redir.Redir op:<Id.Redir_GreatAnd '>&'> fd:-1 arg_word:{<2>})] ) (command.ControlFlow token:<Id.ControlFlow_Exit exit> arg_word:{<1>}) ] ) ) (command.ShFunction name: edie body: (command.BraceGroup children: [ (command.Simple words: [{<echo>} {(DQ ($ Id.VSub_At '$@'))}] redirects: [(redir.Redir op:<Id.Redir_GreatAnd '>&'> fd:-1 arg_word:{<2>})] ) (command.Simple words: [{<exec>}] redirects: [ (redir.Redir op:<Id.Redir_Great '>'> fd:-1 arg_word:{</dev/null>}) (redir.Redir op:<Id.Redir_GreatAnd '2>&'> fd:2 arg_word:{<1>}) ] ) (C {<end>}) (command.ControlFlow token:<Id.ControlFlow_Exit exit> arg_word:{<1>}) ] ) ) (command.WhileUntil keyword: <Id.KW_While while> cond: [ (C {<getopts>} {<d> <Id.Lit_Other ':'> <hn> <Id.Lit_Other ':'> <p> <Id.Lit_Other ':'> <L> <Id.Lit_Other ':'> <tx>} {<opt>} ) ] body: (command.DoGroup children: [ (command.Case to_match: {($ Id.VSub_DollarName '$opt')} arms: [ (case_arm pat_list: [{<d>}] action: [ (command.Sentence child: (command.ShAssignment pairs: [ (assign_pair lhs: (sh_lhs_expr.Name name:opt_duration) op: assign_op.Equal rhs: {<1>} spids: [514] ) ] ) terminator: <Id.Op_Semi _> ) (command.ShAssignment pairs: [ (assign_pair lhs: (sh_lhs_expr.Name name:duration) op: assign_op.Equal rhs: {($ Id.VSub_DollarName '$OPTARG')} spids: [518] ) ] ) ] spids: [511 512 521 -1] ) (case_arm pat_list: [{<n>}] action: [ (command.Sentence child: (command.ShAssignment pairs: [ (assign_pair lhs: (sh_lhs_expr.Name name:opt_name) op: assign_op.Equal rhs: {<1>} spids: [527] ) ] ) terminator: <Id.Op_Semi _> ) (command.ShAssignment pairs: [ (assign_pair lhs: (sh_lhs_expr.Name name:name) op: assign_op.Equal rhs: {($ Id.VSub_DollarName '$OPTARG')} spids: [531] ) ] ) ] spids: [524 525 534 -1] ) (case_arm pat_list: [{<p>}] action: [ (command.Sentence child: (command.ShAssignment pairs: [ (assign_pair lhs: (sh_lhs_expr.Name name:opt_pid) op: assign_op.Equal rhs: {<1>} spids: [540] ) ] ) terminator: <Id.Op_Semi _> ) (command.ShAssignment pairs: [ (assign_pair lhs: (sh_lhs_expr.Name name:pid) op: assign_op.Equal rhs: {($ Id.VSub_DollarName '$OPTARG')} spids: [544] ) ] ) ] spids: [537 538 547 -1] ) (case_arm pat_list: [{<L>}] action: [ (command.Sentence child: (command.ShAssignment pairs: [ (assign_pair lhs: (sh_lhs_expr.Name name:opt_tid) op: assign_op.Equal rhs: {<1>} spids: [553] ) ] ) terminator: <Id.Op_Semi _> ) (command.ShAssignment pairs: [ (assign_pair lhs: (sh_lhs_expr.Name name:tid) op: assign_op.Equal rhs: {($ Id.VSub_DollarName '$OPTARG')} spids: [557] ) ] ) ] spids: [550 551 560 -1] ) (case_arm pat_list: [{<t>}] action: [ (command.ShAssignment pairs: [ (assign_pair lhs: (sh_lhs_expr.Name name:opt_time) op: assign_op.Equal rhs: {<1>} spids: [566] ) ] ) ] spids: [563 564 569 -1] ) (case_arm pat_list: [{<x>}] action: [ (command.ShAssignment pairs: [ (assign_pair lhs: (sh_lhs_expr.Name name:opt_fail) op: assign_op.Equal rhs: {<1>} spids: [575] ) ] ) ] spids: [572 573 578 -1] ) (case_arm pat_list: [{<h>} {<Id.Lit_QMark '?'>}] action: [(C {<usage>})] spids: [581 584 588 -1] ) ] ) ] ) ) (C {<shift>} { (word_part.ArithSub anode: (arith_expr.Binary op_id: Id.Arith_Minus left: (arith_expr.ArithWord w:{($ Id.VSub_DollarName '$OPTIND')}) right: (arith_expr.ArithWord w:{<Id.Lit_Digits 1>}) ) ) } ) (command.If arms: [ (if_arm cond: [ (command.Sentence child: (command.DParen child:(arith_expr.ArithWord w:{($ Id.VSub_Pound '$#')})) terminator: <Id.Op_Semi _> ) ] action: [ (command.ShAssignment pairs: [ (assign_pair lhs: (sh_lhs_expr.Name name:opt_file) op: assign_op.Equal rhs: {<1>} spids: [621] ) ] ) (command.ShAssignment pairs: [ (assign_pair lhs: (sh_lhs_expr.Name name:file) op: assign_op.Equal rhs: {($ Id.VSub_Number '$1')} spids: [625] ) ] ) (C {<shift>}) ] spids: [608 618] ) ] ) (command.AndOr ops: [Id.Op_DAmp] children: [(command.DParen child:(arith_expr.ArithWord w:{($ Id.VSub_Pound '$#')})) (C {<usage>})] ) (command.AndOr ops: [Id.Op_DAmp] children: [ (command.DParen child: (arith_expr.Binary op_id: Id.Arith_Great left: (arith_expr.Binary op_id: Id.Arith_Plus left: (arith_expr.Binary op_id: Id.Arith_Plus left: (arith_expr.VarRef token:<Id.Lit_ArithVarLike opt_pid>) right: (arith_expr.VarRef token:<Id.Lit_ArithVarLike opt_name>) ) right: (arith_expr.VarRef token:<Id.Lit_ArithVarLike opt_tid>) ) right: (arith_expr.ArithWord w:{<Id.Lit_Digits 1>}) ) ) (C {<die>} {(DQ <'ERROR: use at most one of -p, -n, -L.'>)}) ] ) (command.AndOr ops: [Id.Op_DAmp] children: [ (command.DParen child:(arith_expr.VarRef token:<Id.Lit_ArithVarLike opt_pid>)) (command.ShAssignment pairs: [ (assign_pair lhs: (sh_lhs_expr.Name name:ftext) op: assign_op.Equal rhs: {(DQ <' issued by PID '> ($ Id.VSub_DollarName '$pid'))} spids: [686] ) ] ) ] ) (command.AndOr ops: [Id.Op_DAmp] children: [ (command.DParen child:(arith_expr.VarRef token:<Id.Lit_ArithVarLike opt_tid>)) (command.ShAssignment pairs: [ (assign_pair lhs: (sh_lhs_expr.Name name:ftext) op: assign_op.Equal rhs: {(DQ <' issued by TID '> ($ Id.VSub_DollarName '$tid'))} spids: [701] ) ] ) ] ) (command.AndOr ops: [Id.Op_DAmp] children: [ (command.DParen child:(arith_expr.VarRef token:<Id.Lit_ArithVarLike opt_name>)) (command.ShAssignment pairs: [ (assign_pair lhs: (sh_lhs_expr.Name name:ftext) op: assign_op.Equal rhs: { (DQ <' issued by process name '> (word_part.EscapedLiteral token:<Id.Lit_EscapedChar '\\"'>) ($ Id.VSub_DollarName '$name') (word_part.EscapedLiteral token:<Id.Lit_EscapedChar '\\"'>) ) } spids: [716] ) ] ) ] ) (command.AndOr ops: [Id.Op_DAmp] children: [ (command.DParen child:(arith_expr.VarRef token:<Id.Lit_ArithVarLike opt_file>)) (command.ShAssignment pairs: [ (assign_pair lhs: (sh_lhs_expr.Name name:ftext) op: assign_op.Equal rhs: { (DQ ($ Id.VSub_DollarName '$ftext') <' for filenames containing '> (word_part.EscapedLiteral token:<Id.Lit_EscapedChar '\\"'>) ($ Id.VSub_DollarName '$file') (word_part.EscapedLiteral token:<Id.Lit_EscapedChar '\\"'>) ) } spids: [733] ) ] ) ] ) (command.If arms: [ (if_arm cond: [ (command.Sentence child: (command.DParen child: (arith_expr.VarRef token:<Id.Lit_ArithVarLike opt_duration>) ) terminator: <Id.Op_Semi _> ) ] action: [ (C {<echo>} { (DQ <'Tracing open()s'> ($ Id.VSub_DollarName '$ftext') <' for '> ($ Id.VSub_DollarName '$duration') <' seconds (buffered)...'> ) } ) ] spids: [742 752] ) ] else_action: [ (C {<echo>} {(DQ <'Tracing open()s'> ($ Id.VSub_DollarName '$ftext') <'. Ctrl-C to end.'>)}) ] ) (command.AndOr ops: [Id.Op_DAmp Id.Op_DPipe] children: [ (command.DParen child:(arith_expr.VarRef token:<Id.Lit_ArithVarLike opt_duration>)) (command.ShAssignment pairs: [ (assign_pair lhs: (sh_lhs_expr.Name name:use) op: assign_op.Equal rhs: {<mawk>} spids: [791] ) ] ) (command.ShAssignment pairs: [ (assign_pair lhs: (sh_lhs_expr.Name name:use) op: assign_op.Equal rhs: {<gawk>} spids: [796] ) ] ) ] ) (command.AndOr ops: [Id.Op_DAmp Id.Op_DPipe] children: [ (command.DBracket expr: (bool_expr.Unary op_id: Id.BoolUnary_x child: {</usr/bin/> ($ Id.VSub_DollarName '$use')} ) ) (command.ShAssignment pairs: [ (assign_pair lhs: (sh_lhs_expr.Name name:awk) op: assign_op.Equal rhs: {($ Id.VSub_DollarName '$use')} spids: [813] ) ] ) (command.ShAssignment pairs: [ (assign_pair lhs: (sh_lhs_expr.Name name:awk) op: assign_op.Equal rhs: {<awk>} spids: [818] ) ] ) ] ) (command.AndOr ops: [Id.Op_DPipe] children: [ (C {<cd>} {($ Id.VSub_DollarName '$tracing')}) (C {<die>} { (DQ <'ERROR: accessing tracing. Root user? Kernel has FTRACE?\n'> <' debugfs mounted? (mount -t debugfs debugfs /sys/kernel/debug)'> ) } ) ] ) (command.AndOr ops: [Id.Op_DAmp] children: [ (command.DBracket expr: (bool_expr.Unary op_id:Id.BoolUnary_e child:{($ Id.VSub_DollarName '$flock')}) ) (C {<die>} { (DQ <'ERROR: ftrace may be in use by PID '> (command_sub left_token: <Id.Left_DollarParen '$('> command_list: (command.CommandList children: [(C {<cat>} {($ Id.VSub_DollarName '$flock')})] ) ) <' '> ($ Id.VSub_DollarName '$flock') ) } ) ] ) (command.AndOr ops: [Id.Op_DPipe] children: [ (command.Simple words: [{<echo>} {($ Id.VSub_Dollar '$$')}] redirects: [ (redir.Redir op: <Id.Redir_Great '>'> fd: -1 arg_word: {($ Id.VSub_DollarName '$flock')} ) ] ) (C {<die>} {(DQ <'ERROR: unable to write '> ($ Id.VSub_DollarName '$flock') <.>)}) ] ) (command.ShAssignment pairs: [ (assign_pair lhs: (sh_lhs_expr.Name name:wroteflock) op: assign_op.Equal rhs: {<1>} spids: [883] ) ] ) (command.Simple words: [{<echo>} {<nop>}] redirects: [(redir.Redir op:<Id.Redir_Great '>'> fd:-1 arg_word:{<current_tracer>})] ) (command.ShAssignment pairs: [ (assign_pair lhs: (sh_lhs_expr.Name name:ver) op: assign_op.Equal rhs: { (command_sub left_token: <Id.Left_DollarParen '$('> command_list: (command.CommandList children:[(C {<uname>} {<-r>})]) ) } spids: [898] ) ] ) (command.If arms: [ (if_arm cond: [ (command.Sentence child: (command.DBracket expr: (bool_expr.LogicalOr left: (bool_expr.Binary op_id: Id.BoolBinary_GlobDEqual left: {(DQ ($ Id.VSub_DollarName '$ver'))} right: {<2.> <Id.Lit_Other '*'>} ) right: (bool_expr.Binary op_id: Id.BoolBinary_GlobDEqual left: {(DQ ($ Id.VSub_DollarName '$ver'))} right: {<3.> <Id.Lit_Other '['> <1-6> <Id.Lit_Other ']'> <.> <Id.Lit_Other '*'>} ) ) ) terminator: <Id.Op_Semi _> ) ] action: [ (command.ShAssignment pairs: [ (assign_pair lhs: (sh_lhs_expr.Name name:kprobe) op: assign_op.Equal rhs: {(SQ <'r:getnameprobe getname +0($retval):string'>)} spids: [943] ) ] ) ] spids: [905 936] ) ] else_action: [ (command.ShAssignment pairs: [ (assign_pair lhs: (sh_lhs_expr.Name name:kprobe) op: assign_op.Equal rhs: {(SQ <'r:getnameprobe getname +0(+0($retval)):string'>)} spids: [955] ) ] ) ] ) (command.If arms: [ (if_arm cond: [ (command.Sentence child: (command.Pipeline children: [ (command.Simple words: [{<echo>} {($ Id.VSub_DollarName '$kprobe')}] redirects: [ (redir.Redir op: <Id.Redir_DGreat '>>'> fd: -1 arg_word: {<kprobe_events>} ) ] ) ] negated: T ) terminator: <Id.Op_Semi _> ) ] action: [(C {<edie>} {(DQ <'ERROR: adding a kprobe for getname(). Exiting.'>)})] spids: [962 975] ) ] ) (command.If arms: [ (if_arm cond: [ (command.Sentence child: (command.DParen child:(arith_expr.VarRef token:<Id.Lit_ArithVarLike opt_pid>)) terminator: <Id.Op_Semi _> ) ] action: [ (command.ShAssignment pairs: [ (assign_pair lhs: (sh_lhs_expr.Name name:filter) op: assign_op.Equal rhs: (word.Empty) spids: [999] ) ] ) (command.ForEach iter_name: tid iter_words: [{</proc/> ($ Id.VSub_DollarName '$pid') </task/> <Id.Lit_Star '*'>}] do_arg_iter: F body: (command.DoGroup children: [ (command.ShAssignment pairs: [ (assign_pair lhs: (sh_lhs_expr.Name name:filter) op: assign_op.Equal rhs: { (DQ ($ Id.VSub_DollarName '$filter') <' || common_pid == '> (braced_var_sub token: <Id.VSub_Name tid> suffix_op: (suffix_op.Unary op_id: Id.VOp1_DPound arg_word: {<'*'> <Id.Lit_Slash />} ) ) ) } spids: [1017] ) ] ) ] ) ) (command.ShAssignment pairs: [ (assign_pair lhs: (sh_lhs_expr.Name name:filter) op: assign_op.Equal rhs: { (braced_var_sub token: <Id.VSub_Name filter> suffix_op: (suffix_op.Slice begin:(arith_expr.ArithWord w:{<Id.Lit_Digits 3>})) ) } spids: [1033] ) ] ) (command.If arms: [ (if_arm cond: [ (command.AndOr ops: [Id.Op_DPipe] children: [ (command.Pipeline children: [ (command.Simple words: [{<echo>} {($ Id.VSub_DollarName '$filter')}] redirects: [ (redir.Redir op: <Id.Redir_Great '>'> fd: -1 arg_word: {<events/kprobes/getnameprobe/filter>} ) ] ) ] negated: T ) (command.Pipeline children: [ (command.Simple words: [{<echo>} {($ Id.VSub_DollarName '$filter')}] redirects: [ (redir.Redir op: <Id.Redir_Great '>'> fd: -1 arg_word: {<events/syscalls/sys_exit_open/filter>} ) ] ) ] negated: T ) ] ) ] action: [ (C {<edie>} {(DQ <'ERROR: setting -p '> ($ Id.VSub_DollarName '$pid') <'. Exiting.'>)} ) ] spids: [1044 1071] ) ] ) ] spids: [986 996] ) ] ) (command.If arms: [ (if_arm cond: [ (command.Sentence child: (command.DParen child:(arith_expr.VarRef token:<Id.Lit_ArithVarLike opt_tid>)) terminator: <Id.Op_Semi _> ) ] action: [ (command.If arms: [ (if_arm cond: [ (command.AndOr ops: [Id.Op_DPipe] children: [ (command.Pipeline children: [ (command.Simple words: [{<echo>} {(DQ <'common_pid == '> ($ Id.VSub_DollarName '$tid'))}] redirects: [ (redir.Redir op: <Id.Redir_Great '>'> fd: -1 arg_word: {<events/kprobes/getnameprobe/filter>} ) ] ) ] negated: T ) (command.Pipeline children: [ (command.Simple words: [{<echo>} {(DQ <'common_pid == '> ($ Id.VSub_DollarName '$tid'))}] redirects: [ (redir.Redir op: <Id.Redir_Great '>'> fd: -1 arg_word: {<events/syscalls/sys_exit_open/filter>} ) ] ) ] negated: T ) ] ) ] action: [ (C {<edie>} {(DQ <'ERROR: setting -L '> ($ Id.VSub_DollarName '$tid') <'. Exiting.'>)} ) ] spids: [1100 1133] ) ] ) ] spids: [1087 1097] ) ] ) (command.If arms: [ (if_arm cond: [ (command.Sentence child: (command.Pipeline children: [ (command.Simple words: [{<echo>} {<1>}] redirects: [ (redir.Redir op: <Id.Redir_Great '>'> fd: -1 arg_word: {<events/kprobes/getnameprobe/enable>} ) ] ) ] negated: T ) terminator: <Id.Op_Semi _> ) ] action: [(C {<edie>} {(DQ <'ERROR: enabling kprobe for getname(). Exiting.'>)})] spids: [1149 1162] ) ] ) (command.If arms: [ (if_arm cond: [ (command.Sentence child: (command.Pipeline children: [ (command.Simple words: [{<echo>} {<1>}] redirects: [ (redir.Redir op: <Id.Redir_Great '>'> fd: -1 arg_word: {<events/syscalls/sys_exit_open/enable>} ) ] ) ] negated: T ) terminator: <Id.Op_Semi _> ) ] action: [(C {<edie>} {(DQ <'ERROR: enabling open() exit tracepoint. Exiting.'>)})] spids: [1173 1186] ) ] ) (command.AndOr ops: [Id.Op_DAmp] children: [ (command.DParen child:(arith_expr.VarRef token:<Id.Lit_ArithVarLike opt_time>)) (C {<printf>} {(DQ <'%-16s '>)} {(DQ <TIMEs>)}) ] ) (C {<printf>} {(DQ <'%-16.16s %-6s %4s %s'> <Id.Lit_Other '\\'> <n>)} {(DQ <COMM>)} {(DQ <PID>)} {(DQ <FD>)} {(DQ <FILE>)} ) (command.ShAssignment pairs: [ (assign_pair lhs: (sh_lhs_expr.Name name:offset) op: assign_op.Equal rhs: { (command_sub left_token: <Id.Left_DollarParen '$('> command_list: (command.CommandList children: [ (C {($ Id.VSub_DollarName '$awk')} { (SQ <'BEGIN { o = 0; }\n'> <'\t$1 == "#" && $2 ~ /TASK/ && NF == 6 { o = 1; }\n'> <'\t$2 ~ /TASK/ { print o; exit }'> ) } {<trace>} ) ] ) ) } spids: [1262] ) ] ) (C {<warn>} {(DQ <'echo > trace'>)}) (command.Pipeline children: [ (command.Subshell command_list: (command.CommandList children: [ (command.If arms: [ (if_arm cond: [ (command.Sentence child: (command.DParen child: (arith_expr.VarRef token:<Id.Lit_ArithVarLike opt_duration>) ) terminator: <Id.Op_Semi _> ) ] action: [(C {<sleep>} {($ Id.VSub_DollarName '$duration')}) (C {<cat>} {<trace>})] spids: [1287 1297] ) ] else_action: [(C {<cat>} {<trace_pipe>})] ) ] ) ) (C {($ Id.VSub_DollarName '$awk')} {<-v>} {<Id.Lit_VarLike 'o='> ($ Id.VSub_DollarName '$offset')} {<-v>} {<Id.Lit_VarLike 'opt_name='> ($ Id.VSub_DollarName '$opt_name')} {<-v>} {<Id.Lit_VarLike 'name='> ($ Id.VSub_DollarName '$name')} {<-v>} {<Id.Lit_VarLike 'opt_duration='> ($ Id.VSub_DollarName '$opt_duration')} {<-v>} {<Id.Lit_VarLike 'opt_time='> ($ Id.VSub_DollarName '$opt_time')} {<-v>} {<Id.Lit_VarLike 'opt_fail='> ($ Id.VSub_DollarName '$opt_fail')} {<-v>} {<Id.Lit_VarLike 'opt_file='> ($ Id.VSub_DollarName '$opt_file')} {<-v>} {<Id.Lit_VarLike 'file='> ($ Id.VSub_DollarName '$file')} { (SQ <'\n'> <'\t# common fields\n'> <'\t$1 != "#" {\n'> <'\t\t# task name can contain dashes and space\n'> <'\t\tsplit($0, line, "-")\n'> <'\t\tsub(/^[ \\t\\r\\n]+/, "", line[1])\n'> <'\t\tcomm = line[1]\n'> <'\t\tif (opt_name && match(comm, name) == 0)\n'> <'\t\t\tnext\n'> <'\t\tsub(/ .*$/, "", line[2])\n'> <'\t\tpid = line[2]\n'> <'\t}\n'> <'\n'> <'\t# do_sys_open()\n'> <'\t$1 != "#" && $(5+o) ~ /do_sys_open/ {\n'> <'\t\t#\n'> <'\t\t# eg: ... (do_sys_open+0xc3/0x220 <- getname) arg1="file1"\n'> <'\t\t#\n'> <'\t\tfilename = $NF\n'> <'\t\tsub(/"$/, "", filename)\n'> <'\t\tsub(/.*"/, "", filename)\n'> <'\t\tlastfile[pid] = filename\n'> <'\t}\n'> <'\n'> <'\t# sys_open()\n'> <'\t$1 != "#" && $(4+o) == "sys_open" {\n'> <'\t\tfilename = lastfile[pid]\n'> <'\t\tdelete lastfile[pid]\n'> <'\t\tif (opt_file && filename !~ file)\n'> <'\t\t\tnext\n'> <'\t\trval = $NF\n'> <'\t\t# matched failed as beginning with 0xfffff\n'> <'\t\tif (opt_fail && rval !~ /0xfffff/)\n'> <'\t\t\tnext\n'> <'\t\tif (rval ~ /0xfffff/)\n'> <'\t\t\trval = -1\n'> <'\n'> <'\t\tif (opt_time) {\n'> <'\t\t\ttime = $(3+o); sub(":", "", time)\n'> <'\t\t\tprintf "%-16s ", time\n'> <'\t\t}\n'> <'\t\tprintf "%-16.16s %-6s %4s %s\\n", comm, pid, rval, filename\n'> <'\t}\n'> <'\n'> <'\t$0 ~ /LOST.*EVENTS/ { print "WARNING: " $0 > "/dev/stderr" }\n'> ) } ) ] negated: F ) (C {<end>}) ] )