(command.CommandList children: [ (command.ShAssignment left: <Id.Lit_VarLike 'tracing='> pairs: [ (AssignPair left: <Id.Lit_VarLike 'tracing='> lhs: (sh_lhs_expr.Name left:<Id.Lit_VarLike 'tracing='> name:tracing) op: assign_op.Equal rhs: {<'/sys/kernel/debug/tracing'>} ) ] redirects: [] ) (command.CommandList children: [ (command.Sentence child: (command.ShAssignment left: <Id.Lit_VarLike 'flock='> pairs: [ (AssignPair left: <Id.Lit_VarLike 'flock='> lhs: (sh_lhs_expr.Name left:<Id.Lit_VarLike 'flock='> name:flock) op: assign_op.Equal rhs: {<'/var/tmp/.ftrace-lock'>} ) ] redirects: [] ) terminator: <Id.Op_Semi _> ) (command.ShAssignment left: <Id.Lit_VarLike 'wroteflock='> pairs: [ (AssignPair left: <Id.Lit_VarLike 'wroteflock='> lhs: (sh_lhs_expr.Name left:<Id.Lit_VarLike 'wroteflock='> name:wroteflock) op: assign_op.Equal rhs: {<0>} ) ] redirects: [] ) ] ) (command.CommandList children: [ (command.Sentence child: (command.ShAssignment left: <Id.Lit_VarLike 'opt_duration='> pairs: [ (AssignPair left: <Id.Lit_VarLike 'opt_duration='> lhs: (sh_lhs_expr.Name left:<Id.Lit_VarLike 'opt_duration='> name:opt_duration) op: assign_op.Equal rhs: {<0>} ) ] redirects: [] ) terminator: <Id.Op_Semi _> ) (command.Sentence child: (command.ShAssignment left: <Id.Lit_VarLike 'duration='> pairs: [ (AssignPair left: <Id.Lit_VarLike 'duration='> lhs: (sh_lhs_expr.Name left:<Id.Lit_VarLike 'duration='> name:duration) op: assign_op.Equal rhs: (rhs_word__Empty) ) ] redirects: [] ) terminator: <Id.Op_Semi _> ) (command.Sentence child: (command.ShAssignment left: <Id.Lit_VarLike 'opt_name='> pairs: [ (AssignPair left: <Id.Lit_VarLike 'opt_name='> lhs: (sh_lhs_expr.Name left:<Id.Lit_VarLike 'opt_name='> name:opt_name) op: assign_op.Equal rhs: {<0>} ) ] redirects: [] ) terminator: <Id.Op_Semi _> ) (command.Sentence child: (command.ShAssignment left: <Id.Lit_VarLike 'name='> pairs: [ (AssignPair left: <Id.Lit_VarLike 'name='> lhs: (sh_lhs_expr.Name left:<Id.Lit_VarLike 'name='> name:name) op: assign_op.Equal rhs: (rhs_word__Empty) ) ] redirects: [] ) terminator: <Id.Op_Semi _> ) (command.Sentence child: (command.ShAssignment left: <Id.Lit_VarLike 'opt_time='> pairs: [ (AssignPair left: <Id.Lit_VarLike 'opt_time='> lhs: (sh_lhs_expr.Name left:<Id.Lit_VarLike 'opt_time='> name:opt_time) op: assign_op.Equal rhs: {<0>} ) ] redirects: [] ) terminator: <Id.Op_Semi _> ) (command.ShAssignment left: <Id.Lit_VarLike 'opt_reexec='> pairs: [ (AssignPair left: <Id.Lit_VarLike 'opt_reexec='> lhs: (sh_lhs_expr.Name left:<Id.Lit_VarLike 'opt_reexec='> name:opt_reexec) op: assign_op.Equal rhs: {<0>} ) ] redirects: [] ) ] ) (command.CommandList children: [ (command.Sentence child: (command.ShAssignment left: <Id.Lit_VarLike 'opt_argc='> pairs: [ (AssignPair left: <Id.Lit_VarLike 'opt_argc='> lhs: (sh_lhs_expr.Name left:<Id.Lit_VarLike 'opt_argc='> name:opt_argc) op: assign_op.Equal rhs: {<0>} ) ] redirects: [] ) terminator: <Id.Op_Semi _> ) (command.Sentence child: (command.ShAssignment left: <Id.Lit_VarLike 'argc='> pairs: [ (AssignPair left: <Id.Lit_VarLike 'argc='> lhs: (sh_lhs_expr.Name left:<Id.Lit_VarLike 'argc='> name:argc) op: assign_op.Equal rhs: {<8>} ) ] redirects: [] ) terminator: <Id.Op_Semi _> ) (command.Sentence child: (command.ShAssignment left: <Id.Lit_VarLike 'max_argc='> pairs: [ (AssignPair left: <Id.Lit_VarLike 'max_argc='> lhs: (sh_lhs_expr.Name left:<Id.Lit_VarLike 'max_argc='> name:max_argc) op: assign_op.Equal rhs: {<16>} ) ] redirects: [] ) terminator: <Id.Op_Semi _> ) (command.ShAssignment left: <Id.Lit_VarLike 'ftext='> pairs: [ (AssignPair left: <Id.Lit_VarLike 'ftext='> lhs: (sh_lhs_expr.Name left:<Id.Lit_VarLike 'ftext='> name:ftext) op: assign_op.Equal rhs: (rhs_word__Empty) ) ] redirects: [] ) ] ) (command.Simple blame_tok: <trap> more_env: [] words: [{<trap>} {(SQ <':'>)} {<INT>} {<QUIT>} {<TERM>} {<PIPE>} {<HUP>}] redirects: [] do_fork: T ) (command.ShFunction keyword: <Id.KW_Function function> name_tok: <usage> name: usage body: (BraceGroup left: <Id.Lit_LBrace '{'> children: [ (command.Simple blame_tok: <cat> more_env: [] words: [{<cat>}] redirects: [ (Redir op: <Id.Redir_DLessDash '<<-'> loc: (redir_loc.Fd fd:0) arg: (redir_param.HereDoc here_begin: {<END>} here_end_tok: <Id.Undefined_Tok ''> stdin_parts: [ <'USAGE: execsnoop [-hrt] [-a argc] [-d secs] [name]\n'> <' -d seconds # trace duration, and use buffers\n'> <' -a argc # max args to show (default 8)\n'> <' -r # include re-execs\n'> <' -t # include time (seconds)\n'> <' -h # this usage message\n'> <' name # process name to match (REs allowed)\n'> <' eg,\n'> <' execsnoop # watch exec()s live (unbuffered)\n'> <' execsnoop -d 1 # trace 1 sec (buffered)\n'> <' execsnoop grep # trace process names containing grep\n'> <' execsnoop \'log'> <Id.Lit_Dollar '$'> <'\' # filenames ending in '> <Id.Right_DoubleQuote '"'> <log> <Id.Right_DoubleQuote '"'> <'\n'> <'\n'> <'See the man page and example file for more info.\n'> ] ) ) (Redir op:<Id.Redir_GreatAnd '>&'> loc:(redir_loc.Fd fd:1) arg:{<2>}) ] do_fork: T ) (command.ControlFlow keyword:<Id.ControlFlow_Exit exit>) ] redirects: [] right: <Id.Lit_RBrace '}'> ) ) (command.ShFunction keyword: <Id.KW_Function function> name_tok: <warn> name: warn body: (BraceGroup left: <Id.Lit_LBrace '{'> children: [ (command.If if_kw: <Id.KW_If if> arms: [ (IfArm keyword: <Id.KW_If if> cond: (condition.Shell commands: [ (command.Sentence child: (command.Pipeline negated: <Id.KW_Bang '!'> children: [ (command.Simple blame_tok: <eval> more_env: [] words: [{<eval>} {(DQ ($ Id.VSub_At '@'))}] redirects: [] do_fork: T ) ] ops: [] ) terminator: <Id.Op_Semi _> ) ] ) then_kw: <Id.KW_Then then> action: [ (command.Simple blame_tok: <echo> more_env: [] words: [ {<echo>} { (DQ <'WARNING: command failed '> (word_part.EscapedLiteral token: <Id.Lit_EscapedChar '\\"'> ch: '"' ) ($ Id.VSub_At '@') (word_part.EscapedLiteral token:<Id.Lit_EscapedChar '\\"'> ch:'"') ) } ] redirects: [(Redir op:<Id.Redir_GreatAnd '>&'> loc:(redir_loc.Fd fd:1) arg:{<2>})] do_fork: T ) ] spids: [281 292] ) ] else_action: [] fi_kw: <Id.KW_Fi fi> redirects: [] ) ] redirects: [] right: <Id.Lit_RBrace '}'> ) ) (command.ShFunction keyword: <Id.KW_Function function> name_tok: <end> name: end body: (BraceGroup left: <Id.Lit_LBrace '{'> children: [ (command.Simple blame_tok: <echo> more_env: [] words: [{<echo>}] redirects: [(Redir op:<Id.Redir_Great '2>'> loc:(redir_loc.Fd fd:2) arg:{<'/dev/null'>})] do_fork: T ) (command.Simple blame_tok: <echo> more_env: [] words: [{<echo>} {(DQ <'Ending tracing...'>)}] redirects: [(Redir op:<Id.Redir_Great '2>'> loc:(redir_loc.Fd fd:2) arg:{<'/dev/null'>})] do_fork: T ) (command.Simple blame_tok: <cd> more_env: [] words: [{<cd>} {($ Id.VSub_DollarName tracing)}] redirects: [] do_fork: T ) (command.Simple blame_tok: <warn> more_env: [] words: [ {<warn>} {(DQ <'echo 0 > events/kprobes/'> ($ Id.VSub_DollarName kname) <'/enable'>)} ] redirects: [] do_fork: T ) (command.Simple blame_tok: <warn> more_env: [] words: [{<warn>} {(DQ <'echo 0 > events/sched/sched_process_fork/enable'>)}] redirects: [] do_fork: T ) (command.Simple blame_tok: <warn> more_env: [] words: [{<warn>} {(DQ <'echo -:'> ($ Id.VSub_DollarName kname) <' >> kprobe_events'>)}] redirects: [] do_fork: T ) (command.Simple blame_tok: <warn> more_env: [] words: [{<warn>} {(DQ <'echo > trace'>)}] redirects: [] do_fork: T ) (command.AndOr children: [ (command.DParen left: <Id.Op_DLeftParen _> child: ($ Id.Lit_ArithVarLike wroteflock) right: <Id.Op_DRightParen _> redirects: [] ) (command.Simple blame_tok: <warn> more_env: [] words: [{<warn>} {(DQ <'rm '> ($ Id.VSub_DollarName flock))}] redirects: [] do_fork: T ) ] ops: [<Id.Op_DAmp _>] ) ] redirects: [] right: <Id.Lit_RBrace '}'> ) ) (command.ShFunction keyword: <Id.KW_Function function> name_tok: <die> name: die body: (BraceGroup left: <Id.Lit_LBrace '{'> children: [ (command.Simple blame_tok: <echo> more_env: [] words: [{<echo>} {(DQ ($ Id.VSub_At '@'))}] redirects: [(Redir op:<Id.Redir_GreatAnd '>&'> loc:(redir_loc.Fd fd:1) arg:{<2>})] do_fork: T ) (command.ControlFlow keyword:<Id.ControlFlow_Exit exit> arg_word:{<1>}) ] redirects: [] right: <Id.Lit_RBrace '}'> ) ) (command.ShFunction keyword: <Id.KW_Function function> name_tok: <edie> name: edie body: (BraceGroup left: <Id.Lit_LBrace '{'> children: [ (command.Simple blame_tok: <echo> more_env: [] words: [{<echo>} {(DQ ($ Id.VSub_At '@'))}] redirects: [(Redir op:<Id.Redir_GreatAnd '>&'> loc:(redir_loc.Fd fd:1) arg:{<2>})] do_fork: T ) (command.Simple blame_tok: <exec> more_env: [] words: [{<exec>}] redirects: [ (Redir op: <Id.Redir_Great '>'> loc: (redir_loc.Fd fd:1) arg: {<'/dev/null'>} ) (Redir op:<Id.Redir_GreatAnd '2>&'> loc:(redir_loc.Fd fd:2) arg:{<1>}) ] do_fork: T ) (command.Simple blame_tok: <end> more_env: [] words: [{<end>}] redirects: [] do_fork: T ) (command.ControlFlow keyword:<Id.ControlFlow_Exit exit> arg_word:{<1>}) ] redirects: [] right: <Id.Lit_RBrace '}'> ) ) (command.WhileUntil keyword: <Id.KW_While while> cond: (condition.Shell commands: [ (command.Simple blame_tok: <getopts> more_env: [] words: [{<getopts>} {<a> <Id.Lit_Colon ':'> <d> <Id.Lit_Colon ':'> <hrt>} {<opt>}] redirects: [] do_fork: T ) ] ) body: (command.DoGroup left: <Id.KW_Do do> children: [ (command.Case case_kw: <Id.KW_Case case> to_match: (case_arg.Word w:{($ Id.VSub_DollarName opt)}) arms_start: <Id.KW_In in> arms: [ (CaseArm left: <a> pattern: (pat.Words words:[{<a>}]) middle: <Id.Right_CasePat _> action: [ (command.Sentence child: (command.ShAssignment left: <Id.Lit_VarLike 'opt_argc='> pairs: [ (AssignPair left: <Id.Lit_VarLike 'opt_argc='> lhs: (sh_lhs_expr.Name left:<Id.Lit_VarLike 'opt_argc='> name:opt_argc) op: assign_op.Equal rhs: {<1>} ) ] redirects: [] ) terminator: <Id.Op_Semi _> ) (command.ShAssignment left: <Id.Lit_VarLike 'argc='> pairs: [ (AssignPair left: <Id.Lit_VarLike 'argc='> lhs: (sh_lhs_expr.Name left:<Id.Lit_VarLike 'argc='> name:argc) op: assign_op.Equal rhs: {($ Id.VSub_DollarName OPTARG)} ) ] redirects: [] ) ] right: <Id.Op_DSemi _> ) (CaseArm left: <d> pattern: (pat.Words words:[{<d>}]) middle: <Id.Right_CasePat _> action: [ (command.Sentence child: (command.ShAssignment left: <Id.Lit_VarLike 'opt_duration='> pairs: [ (AssignPair left: <Id.Lit_VarLike 'opt_duration='> lhs: (sh_lhs_expr.Name left: <Id.Lit_VarLike 'opt_duration='> name: opt_duration ) op: assign_op.Equal rhs: {<1>} ) ] redirects: [] ) terminator: <Id.Op_Semi _> ) (command.ShAssignment left: <Id.Lit_VarLike 'duration='> pairs: [ (AssignPair left: <Id.Lit_VarLike 'duration='> lhs: (sh_lhs_expr.Name left:<Id.Lit_VarLike 'duration='> name:duration) op: assign_op.Equal rhs: {($ Id.VSub_DollarName OPTARG)} ) ] redirects: [] ) ] right: <Id.Op_DSemi _> ) (CaseArm left: <r> pattern: (pat.Words words:[{<r>}]) middle: <Id.Right_CasePat _> action: [ (command.ShAssignment left: <Id.Lit_VarLike 'opt_reexec='> pairs: [ (AssignPair left: <Id.Lit_VarLike 'opt_reexec='> lhs: (sh_lhs_expr.Name left:<Id.Lit_VarLike 'opt_reexec='> name:opt_reexec) op: assign_op.Equal rhs: {<1>} ) ] redirects: [] ) ] right: <Id.Op_DSemi _> ) (CaseArm left: <t> pattern: (pat.Words words:[{<t>}]) middle: <Id.Right_CasePat _> action: [ (command.ShAssignment left: <Id.Lit_VarLike 'opt_time='> pairs: [ (AssignPair left: <Id.Lit_VarLike 'opt_time='> lhs: (sh_lhs_expr.Name left:<Id.Lit_VarLike 'opt_time='> name:opt_time) op: assign_op.Equal rhs: {<1>} ) ] redirects: [] ) ] right: <Id.Op_DSemi _> ) (CaseArm left: <h> pattern: (pat.Words words:[{<h>} {<Id.Lit_QMark '?'>}]) middle: <Id.Right_CasePat _> action: [ (command.Simple blame_tok: <usage> more_env: [] words: [{<usage>}] redirects: [] do_fork: T ) ] right: <Id.Op_DSemi _> ) ] arms_end: <Id.KW_Esac esac> redirects: [] ) ] right: <Id.KW_Done done> ) redirects: [] ) (command.Simple blame_tok: <shift> more_env: [] words: [ {<shift>} { (word_part.ArithSub left: <Id.Left_DollarDParen '$(('> anode: (arith_expr.Binary op_id: Id.Arith_Minus left: {($ Id.VSub_DollarName OPTIND)} right: {<Id.Lit_Digits 1>} ) right: <Id.Right_DollarDParen _> ) } ] redirects: [] do_fork: T ) (command.If if_kw: <Id.KW_If if> arms: [ (IfArm keyword: <Id.KW_If if> cond: (condition.Shell commands: [ (command.Sentence child: (command.DParen left: <Id.Op_DLeftParen _> child: {($ Id.VSub_Pound '#')} right: <Id.Op_DRightParen _> redirects: [] ) terminator: <Id.Op_Semi _> ) ] ) then_kw: <Id.KW_Then then> action: [ (command.ShAssignment left: <Id.Lit_VarLike 'opt_name='> pairs: [ (AssignPair left: <Id.Lit_VarLike 'opt_name='> lhs: (sh_lhs_expr.Name left:<Id.Lit_VarLike 'opt_name='> name:opt_name) op: assign_op.Equal rhs: {<1>} ) ] redirects: [] ) (command.ShAssignment left: <Id.Lit_VarLike 'name='> pairs: [ (AssignPair left: <Id.Lit_VarLike 'name='> lhs: (sh_lhs_expr.Name left:<Id.Lit_VarLike 'name='> name:name) op: assign_op.Equal rhs: {($ Id.VSub_Number 1)} ) ] redirects: [] ) (command.Simple blame_tok: <shift> more_env: [] words: [{<shift>}] redirects: [] do_fork: T ) ] spids: [556 566] ) ] else_action: [] fi_kw: <Id.KW_Fi fi> redirects: [] ) (command.AndOr children: [ (command.DParen left: <Id.Op_DLeftParen _> child: {($ Id.VSub_Pound '#')} right: <Id.Op_DRightParen _> redirects: [] ) (command.Simple blame_tok: <usage> more_env: [] words: [{<usage>}] redirects: [] do_fork: T ) ] ops: [<Id.Op_DAmp _>] ) (command.AndOr children: [ (command.DParen left: <Id.Op_DLeftParen _> child: (arith_expr.Binary op_id: Id.Arith_DAmp left: ($ Id.Lit_ArithVarLike opt_pid) right: ($ Id.Lit_ArithVarLike opt_name) ) right: <Id.Op_DRightParen _> redirects: [] ) (command.Simple blame_tok: <die> more_env: [] words: [{<die>} {(DQ <'ERROR: use either -p or -n.'>)}] redirects: [] do_fork: T ) ] ops: [<Id.Op_DAmp _>] ) (command.AndOr children: [ (command.DParen left: <Id.Op_DLeftParen _> child: ($ Id.Lit_ArithVarLike opt_pid) right: <Id.Op_DRightParen _> redirects: [] ) (command.ShAssignment left: <Id.Lit_VarLike 'ftext='> pairs: [ (AssignPair left: <Id.Lit_VarLike 'ftext='> lhs: (sh_lhs_expr.Name left:<Id.Lit_VarLike 'ftext='> name:ftext) op: assign_op.Equal rhs: {(DQ <' issued by PID '> ($ Id.VSub_DollarName pid))} ) ] redirects: [] ) ] ops: [<Id.Op_DAmp _>] ) (command.AndOr children: [ (command.DParen left: <Id.Op_DLeftParen _> child: ($ Id.Lit_ArithVarLike opt_name) right: <Id.Op_DRightParen _> redirects: [] ) (command.ShAssignment left: <Id.Lit_VarLike 'ftext='> pairs: [ (AssignPair left: <Id.Lit_VarLike 'ftext='> lhs: (sh_lhs_expr.Name left:<Id.Lit_VarLike 'ftext='> name:ftext) op: assign_op.Equal rhs: { (DQ <' issued by process name '> (word_part.EscapedLiteral token: <Id.Lit_EscapedChar '\\"'> ch: '"' ) ($ Id.VSub_DollarName name) (word_part.EscapedLiteral token:<Id.Lit_EscapedChar '\\"'> ch:'"') ) } ) ] redirects: [] ) ] ops: [<Id.Op_DAmp _>] ) (command.AndOr children: [ (command.DParen left: <Id.Op_DLeftParen _> child: ($ Id.Lit_ArithVarLike opt_file) right: <Id.Op_DRightParen _> redirects: [] ) (command.ShAssignment left: <Id.Lit_VarLike 'ftext='> pairs: [ (AssignPair left: <Id.Lit_VarLike 'ftext='> lhs: (sh_lhs_expr.Name left:<Id.Lit_VarLike 'ftext='> name:ftext) op: assign_op.Equal rhs: { (DQ ($ Id.VSub_DollarName ftext) <' for filenames containing '> (word_part.EscapedLiteral token: <Id.Lit_EscapedChar '\\"'> ch: '"' ) ($ Id.VSub_DollarName file) (word_part.EscapedLiteral token:<Id.Lit_EscapedChar '\\"'> ch:'"') ) } ) ] redirects: [] ) ] ops: [<Id.Op_DAmp _>] ) (command.AndOr children: [ (command.DParen left: <Id.Op_DLeftParen _> child: (arith_expr.Binary op_id: Id.Arith_DAmp left: ($ Id.Lit_ArithVarLike opt_argc) right: (arith_expr.Binary op_id: Id.Arith_Great left: ($ Id.Lit_ArithVarLike argc) right: ($ Id.Lit_ArithVarLike max_argc) ) ) right: <Id.Op_DRightParen _> redirects: [] ) (command.Simple blame_tok: <die> more_env: [] words: [{<die>} {(DQ <'ERROR: max -a argc is '> ($ Id.VSub_DollarName max_argc) <.>)}] redirects: [] do_fork: T ) ] ops: [<Id.Op_DAmp _>] ) (command.If if_kw: <Id.KW_If if> arms: [ (IfArm keyword: <Id.KW_If if> cond: (condition.Shell commands: [ (command.Sentence child: (command.DParen left: <Id.Op_DLeftParen _> child: ($ Id.Lit_ArithVarLike opt_duration) right: <Id.Op_DRightParen _> redirects: [] ) terminator: <Id.Op_Semi _> ) ] ) then_kw: <Id.KW_Then then> action: [ (command.Simple blame_tok: <echo> more_env: [] words: [ {<echo>} { (DQ <'Tracing exec()s'> ($ Id.VSub_DollarName ftext) <' for '> ($ Id.VSub_DollarName duration) <' seconds (buffered)...'> ) } ] redirects: [] do_fork: T ) ] spids: [690 700] ) ] else_kw: <Id.KW_Else else> else_action: [ (command.Simple blame_tok: <echo> more_env: [] words: [{<echo>} {(DQ <'Tracing exec()s'> ($ Id.VSub_DollarName ftext) <'. Ctrl-C to end.'>)}] redirects: [] do_fork: T ) ] fi_kw: <Id.KW_Fi fi> redirects: [] ) (command.If if_kw: <Id.KW_If if> arms: [ (IfArm keyword: <Id.KW_If if> cond: (condition.Shell commands: [ (command.Sentence child: (command.DParen left: <Id.Op_DLeftParen _> child: ($ Id.Lit_ArithVarLike opt_duration) right: <Id.Op_DRightParen _> redirects: [] ) terminator: <Id.Op_Semi _> ) ] ) then_kw: <Id.KW_Then then> action: [ (command.AndOr children: [ (command.DBracket left: <Id.KW_DLeftBracket '[['> expr: (bool_expr.Unary op_id:Id.BoolUnary_x child:{<'/usr/bin/mawk'>}) right: <Id.Lit_DRightBracket ']]'> redirects: [] ) (command.ShAssignment left: <Id.Lit_VarLike 'awk='> pairs: [ (AssignPair left: <Id.Lit_VarLike 'awk='> lhs: (sh_lhs_expr.Name left:<Id.Lit_VarLike 'awk='> name:awk) op: assign_op.Equal rhs: {<mawk>} ) ] redirects: [] ) (command.ShAssignment left: <Id.Lit_VarLike 'awk='> pairs: [ (AssignPair left: <Id.Lit_VarLike 'awk='> lhs: (sh_lhs_expr.Name left:<Id.Lit_VarLike 'awk='> name:awk) op: assign_op.Equal rhs: {<awk>} ) ] redirects: [] ) ] ops: [<Id.Op_DAmp _> <Id.Op_DPipe _>] ) ] spids: [730 740] ) ] else_kw: <Id.KW_Else else> else_action: [ (command.If if_kw: <Id.KW_If if> arms: [ (IfArm keyword: <Id.KW_If if> cond: (condition.Shell commands: [ (command.Sentence child: (command.DBracket left: <Id.KW_DLeftBracket '[['> expr: (bool_expr.Unary op_id:Id.BoolUnary_x child:{<'/usr/bin/gawk'>}) right: <Id.Lit_DRightBracket ']]'> redirects: [] ) terminator: <Id.Op_Semi _> ) ] ) then_kw: <Id.KW_Then then> action: [ (command.ShAssignment left: <Id.Lit_VarLike 'awk='> pairs: [ (AssignPair left: <Id.Lit_VarLike 'awk='> lhs: (sh_lhs_expr.Name left:<Id.Lit_VarLike 'awk='> name:awk) op: assign_op.Equal rhs: {<gawk>} ) ] redirects: [] ) ] spids: [768 779] ) (IfArm keyword: <Id.KW_Elif elif> cond: (condition.Shell commands: [ (command.Sentence child: (command.DBracket left: <Id.KW_DLeftBracket '[['> expr: (bool_expr.Unary op_id:Id.BoolUnary_x child:{<'/usr/bin/mawk'>}) right: <Id.Lit_DRightBracket ']]'> redirects: [] ) terminator: <Id.Op_Semi _> ) ] ) then_kw: <Id.KW_Then then> action: [ (command.ShAssignment left: <Id.Lit_VarLike 'awk='> pairs: [ (AssignPair left: <Id.Lit_VarLike 'awk='> lhs: (sh_lhs_expr.Name left:<Id.Lit_VarLike 'awk='> name:awk) op: assign_op.Equal rhs: {(DQ <'mawk -W interactive'>)} ) ] redirects: [] ) ] spids: [786 797] ) ] else_kw: <Id.KW_Else else> else_action: [ (command.ShAssignment left: <Id.Lit_VarLike 'awk='> pairs: [ (AssignPair left: <Id.Lit_VarLike 'awk='> lhs: (sh_lhs_expr.Name left:<Id.Lit_VarLike 'awk='> name:awk) op: assign_op.Equal rhs: {<awk>} ) ] redirects: [] ) ] fi_kw: <Id.KW_Fi fi> redirects: [] ) ] fi_kw: <Id.KW_Fi fi> redirects: [] ) (command.AndOr children: [ (command.Simple blame_tok: <cd> more_env: [] words: [{<cd>} {($ Id.VSub_DollarName tracing)}] redirects: [] do_fork: T ) (command.Simple blame_tok: <die> more_env: [] words: [ {<die>} { (DQ <'ERROR: accessing tracing. Root user? Kernel has FTRACE?\n'> <' debugfs mounted? (mount -t debugfs debugfs /sys/kernel/debug)'> ) } ] redirects: [] do_fork: T ) ] ops: [<Id.Op_DPipe _>] ) (command.AndOr children: [ (command.DBracket left: <Id.KW_DLeftBracket '[['> expr: (bool_expr.Unary op_id:Id.BoolUnary_e child:{($ Id.VSub_DollarName flock)}) right: <Id.Lit_DRightBracket ']]'> redirects: [] ) (command.Simple blame_tok: <die> more_env: [] words: [ {<die>} { (DQ <'ERROR: ftrace may be in use by PID '> (CommandSub left_token: <Id.Left_DollarParen '$('> child: (command.Simple blame_tok: <cat> more_env: [] words: [{<cat>} {($ Id.VSub_DollarName flock)}] redirects: [] do_fork: T ) right: <Id.Eof_RParen _> ) <' '> ($ Id.VSub_DollarName flock) ) } ] redirects: [] do_fork: T ) ] ops: [<Id.Op_DAmp _>] ) (command.AndOr children: [ (command.Simple blame_tok: <echo> more_env: [] words: [{<echo>} {($ Id.VSub_Dollar '$')}] redirects: [ (Redir op: <Id.Redir_Great '>'> loc: (redir_loc.Fd fd:1) arg: {($ Id.VSub_DollarName flock)} ) ] do_fork: T ) (command.Simple blame_tok: <die> more_env: [] words: [{<die>} {(DQ <'ERROR: unable to write '> ($ Id.VSub_DollarName flock) <.>)}] redirects: [] do_fork: T ) ] ops: [<Id.Op_DPipe _>] ) (command.ShAssignment left: <Id.Lit_VarLike 'wroteflock='> pairs: [ (AssignPair left: <Id.Lit_VarLike 'wroteflock='> lhs: (sh_lhs_expr.Name left:<Id.Lit_VarLike 'wroteflock='> name:wroteflock) op: assign_op.Equal rhs: {<1>} ) ] redirects: [] ) (command.If if_kw: <Id.KW_If if> arms: [ (IfArm keyword: <Id.KW_If if> cond: (condition.Shell commands: [ (command.Sentence child: (command.DBracket left: <Id.KW_DLeftBracket '[['> expr: (bool_expr.Unary op_id:Id.BoolUnary_x child:{<'/usr/bin/getconf'>}) right: <Id.Lit_DRightBracket ']]'> redirects: [] ) terminator: <Id.Op_Semi _> ) ] ) then_kw: <Id.KW_Then then> action: [ (command.ShAssignment left: <Id.Lit_VarLike 'bits='> pairs: [ (AssignPair left: <Id.Lit_VarLike 'bits='> lhs: (sh_lhs_expr.Name left:<Id.Lit_VarLike 'bits='> name:bits) op: assign_op.Equal rhs: { (CommandSub left_token: <Id.Left_DollarParen '$('> child: (command.Simple blame_tok: <getconf> more_env: [] words: [{<getconf>} {<LONG_BIT>}] redirects: [] do_fork: T ) right: <Id.Eof_RParen _> ) } ) ] redirects: [] ) ] spids: [886 897] ) ] else_kw: <Id.KW_Else else> else_action: [ (command.ShAssignment left: <Id.Lit_VarLike 'bits='> pairs: [ (AssignPair left: <Id.Lit_VarLike 'bits='> lhs: (sh_lhs_expr.Name left:<Id.Lit_VarLike 'bits='> name:bits) op: assign_op.Equal rhs: {<64>} ) ] redirects: [] ) (command.AndOr children: [ (command.DBracket left: <Id.KW_DLeftBracket '[['> expr: (bool_expr.Binary op_id: Id.BoolBinary_GlobDEqual left: { (CommandSub left_token: <Id.Left_DollarParen '$('> child: (command.Simple blame_tok: <uname> more_env: [] words: [{<uname>} {<-m>}] redirects: [] do_fork: T ) right: <Id.Eof_RParen _> ) } right: {<i> <Id.Lit_Other '*'>} ) right: <Id.Lit_DRightBracket ']]'> redirects: [] ) (command.ShAssignment left: <Id.Lit_VarLike 'bits='> pairs: [ (AssignPair left: <Id.Lit_VarLike 'bits='> lhs: (sh_lhs_expr.Name left:<Id.Lit_VarLike 'bits='> name:bits) op: assign_op.Equal rhs: {<32>} ) ] redirects: [] ) ] ops: [<Id.Op_DAmp _>] ) ] fi_kw: <Id.KW_Fi fi> redirects: [] ) (command.DParen left: <Id.Op_DLeftParen _> child: (arith_expr.BinaryAssign op_id: Id.Arith_Equal left: ($ Id.Lit_ArithVarLike offset) right: (arith_expr.Binary op_id: Id.Arith_Slash left: ($ Id.Lit_ArithVarLike bits) right: {<Id.Lit_Digits 8>} ) ) right: <Id.Op_DRightParen _> redirects: [] ) (command.ShFunction keyword: <Id.KW_Function function> name_tok: <makeprobe> name: makeprobe body: (BraceGroup left: <Id.Lit_LBrace '{'> children: [ (command.ShAssignment left: <Id.Lit_VarLike 'func='> pairs: [ (AssignPair left: <Id.Lit_VarLike 'func='> lhs: (sh_lhs_expr.Name left:<Id.Lit_VarLike 'func='> name:func) op: assign_op.Equal rhs: {($ Id.VSub_Number 1)} ) ] redirects: [] ) (command.ShAssignment left: <Id.Lit_VarLike 'kname='> pairs: [ (AssignPair left: <Id.Lit_VarLike 'kname='> lhs: (sh_lhs_expr.Name left:<Id.Lit_VarLike 'kname='> name:kname) op: assign_op.Equal rhs: {<execsnoop_> ($ Id.VSub_DollarName func)} ) ] redirects: [] ) (command.ShAssignment left: <Id.Lit_VarLike 'kprobe='> pairs: [ (AssignPair left: <Id.Lit_VarLike 'kprobe='> lhs: (sh_lhs_expr.Name left:<Id.Lit_VarLike 'kprobe='> name:kprobe) op: assign_op.Equal rhs: {(DQ <'p:'> ($ Id.VSub_DollarName kname) <' '> ($ Id.VSub_DollarName func))} ) ] redirects: [] ) (command.ShAssignment left: <Id.Lit_VarLike 'i='> pairs: [ (AssignPair left: <Id.Lit_VarLike 'i='> lhs: (sh_lhs_expr.Name left:<Id.Lit_VarLike 'i='> name:i) op: assign_op.Equal rhs: {<0>} ) ] redirects: [] ) (command.WhileUntil keyword: <Id.KW_While while> cond: (condition.Shell commands: [ (command.Sentence child: (command.DParen left: <Id.Op_DLeftParen _> child: (arith_expr.Binary op_id: Id.Arith_Less left: ($ Id.Lit_ArithVarLike i) right: (arith_expr.Binary op_id: Id.Arith_Plus left: ($ Id.Lit_ArithVarLike argc) right: {<Id.Lit_Digits 1>} ) ) right: <Id.Op_DRightParen _> redirects: [] ) terminator: <Id.Op_Semi _> ) ] ) body: (command.DoGroup left: <Id.KW_Do do> children: [ (command.ShAssignment left: <Id.Lit_VarLike 'kprobe='> pairs: [ (AssignPair left: <Id.Lit_VarLike 'kprobe='> lhs: (sh_lhs_expr.Name left:<Id.Lit_VarLike 'kprobe='> name:kprobe) op: assign_op.Equal rhs: { (DQ ($ Id.VSub_DollarName kprobe) <' +0(+'> (word_part.ArithSub left: <Id.Left_DollarDParen '$(('> anode: (arith_expr.Binary op_id: Id.Arith_Star left: ($ Id.Lit_ArithVarLike i) right: ($ Id.Lit_ArithVarLike offset) ) right: <Id.Right_DollarDParen _> ) <'(%si)):string'> ) } ) ] redirects: [] ) (command.DParen left: <Id.Op_DLeftParen _> child: (arith_expr.UnaryAssign op_id: Id.Node_PostDPlus child: ($ Id.Lit_ArithVarLike i) ) right: <Id.Op_DRightParen _> redirects: [] ) ] right: <Id.KW_Done done> ) redirects: [] ) ] redirects: [] right: <Id.Lit_RBrace '}'> ) ) (command.Simple blame_tok: <makeprobe> more_env: [] words: [{<makeprobe>} {<sys_execve>}] redirects: [] do_fork: T ) (command.Simple blame_tok: <echo> more_env: [] words: [{<echo>} {<nop>}] redirects: [(Redir op:<Id.Redir_Great '>'> loc:(redir_loc.Fd fd:1) arg:{<current_tracer>})] do_fork: T ) (command.If if_kw: <Id.KW_If if> arms: [ (IfArm keyword: <Id.KW_If if> cond: (condition.Shell commands: [ (command.Sentence child: (command.Pipeline negated: <Id.KW_Bang '!'> children: [ (command.Simple blame_tok: <echo> more_env: [] words: [{<echo>} {($ Id.VSub_DollarName kprobe)}] redirects: [ (Redir op: <Id.Redir_DGreat '>>'> loc: (redir_loc.Fd fd:1) arg: {<kprobe_events>} ) (Redir op: <Id.Redir_Great '2>'> loc: (redir_loc.Fd fd:2) arg: {<'/dev/null'>} ) ] do_fork: T ) ] ops: [] ) terminator: <Id.Op_Semi _> ) ] ) then_kw: <Id.KW_Then then> action: [ (command.Simple blame_tok: <makeprobe> more_env: [] words: [{<makeprobe>} {<stub_execve>}] redirects: [] do_fork: T ) (command.If if_kw: <Id.KW_If if> arms: [ (IfArm keyword: <Id.KW_If if> cond: (condition.Shell commands: [ (command.Sentence child: (command.Pipeline negated: <Id.KW_Bang '!'> children: [ (command.Simple blame_tok: <echo> more_env: [] words: [{<echo>} {($ Id.VSub_DollarName kprobe)}] redirects: [ (Redir op: <Id.Redir_DGreat '>>'> loc: (redir_loc.Fd fd:1) arg: {<kprobe_events>} ) (Redir op: <Id.Redir_Great '2>'> loc: (redir_loc.Fd fd:2) arg: {<'/dev/null'>} ) ] do_fork: T ) ] ops: [] ) terminator: <Id.Op_Semi _> ) ] ) then_kw: <Id.KW_Then then> action: [ (command.Simple blame_tok: <makeprobe> more_env: [] words: [{<makeprobe>} {<do_execve>}] redirects: [] do_fork: T ) (command.If if_kw: <Id.KW_If if> arms: [ (IfArm keyword: <Id.KW_If if> cond: (condition.Shell commands: [ (command.Sentence child: (command.Pipeline negated: <Id.KW_Bang '!'> children: [ (command.Simple blame_tok: <echo> more_env: [] words: [{<echo>} {($ Id.VSub_DollarName kprobe)}] redirects: [ (Redir op: <Id.Redir_DGreat '>>'> loc: (redir_loc.Fd fd:1) arg: {<kprobe_events>} ) (Redir op: <Id.Redir_Great '2>'> loc: (redir_loc.Fd fd:2) arg: {<'/dev/null'>} ) ] do_fork: T ) ] ops: [] ) terminator: <Id.Op_Semi _> ) ] ) then_kw: <Id.KW_Then then> action: [ (command.Simple blame_tok: <edie> more_env: [] words: [{<edie>} {(DQ <'ERROR: adding a kprobe for execve. Exiting.'>)}] redirects: [] do_fork: T ) ] spids: [1103 1119] ) ] else_action: [] fi_kw: <Id.KW_Fi fi> redirects: [] ) ] spids: [1079 1095] ) ] else_action: [] fi_kw: <Id.KW_Fi fi> redirects: [] ) ] spids: [1055 1071] ) ] else_action: [] fi_kw: <Id.KW_Fi fi> redirects: [] ) (command.If if_kw: <Id.KW_If if> arms: [ (IfArm keyword: <Id.KW_If if> cond: (condition.Shell commands: [ (command.Sentence child: (command.Pipeline negated: <Id.KW_Bang '!'> children: [ (command.Simple blame_tok: <echo> more_env: [] words: [{<echo>} {<1>}] redirects: [ (Redir op: <Id.Redir_Great '>'> loc: (redir_loc.Fd fd:1) arg: {<'events/kprobes/'> ($ Id.VSub_DollarName kname) <'/enable'>} ) ] do_fork: T ) ] ops: [] ) terminator: <Id.Op_Semi _> ) ] ) then_kw: <Id.KW_Then then> action: [ (command.Simple blame_tok: <edie> more_env: [] words: [{<edie>} {(DQ <'ERROR: enabling kprobe for execve. Exiting.'>)}] redirects: [] do_fork: T ) ] spids: [1136 1151] ) ] else_action: [] fi_kw: <Id.KW_Fi fi> redirects: [] ) (command.If if_kw: <Id.KW_If if> arms: [ (IfArm keyword: <Id.KW_If if> cond: (condition.Shell commands: [ (command.Sentence child: (command.Pipeline negated: <Id.KW_Bang '!'> children: [ (command.Simple blame_tok: <echo> more_env: [] words: [{<echo>} {<1>}] redirects: [ (Redir op: <Id.Redir_Great '>'> loc: (redir_loc.Fd fd:1) arg: {<'events/sched/sched_process_fork/enable'>} ) ] do_fork: T ) ] ops: [] ) terminator: <Id.Op_Semi _> ) ] ) then_kw: <Id.KW_Then then> action: [ (command.Simple blame_tok: <edie> more_env: [] words: [{<edie>} {(DQ <'ERROR: enabling sched:sched_process_fork tracepoint. Exiting.'>)}] redirects: [] do_fork: T ) ] spids: [1162 1175] ) ] else_action: [] fi_kw: <Id.KW_Fi fi> redirects: [] ) (command.Simple blame_tok: <echo> more_env: [] words: [{<echo>} {(DQ <'Instrumenting '> ($ Id.VSub_DollarName func))}] redirects: [] do_fork: T ) (command.AndOr children: [ (command.DParen left: <Id.Op_DLeftParen _> child: ($ Id.Lit_ArithVarLike opt_time) right: <Id.Op_DRightParen _> redirects: [] ) (command.Simple blame_tok: <printf> more_env: [] words: [{<printf>} {(DQ <'%-16s '>)} {(DQ <TIMEs>)}] redirects: [] do_fork: T ) ] ops: [<Id.Op_DAmp _>] ) (command.Simple blame_tok: <printf> more_env: [] words: [ {<printf>} {(DQ <'%6s %6s %s'> <Id.Lit_BadBackslash '\\'> <n>)} {(DQ <PID>)} {(DQ <PPID>)} {(DQ <ARGS>)} ] redirects: [] do_fork: T ) (command.ShAssignment left: <Id.Lit_VarLike 'offset='> pairs: [ (AssignPair left: <Id.Lit_VarLike 'offset='> lhs: (sh_lhs_expr.Name left:<Id.Lit_VarLike 'offset='> name:offset) op: assign_op.Equal rhs: { (CommandSub left_token: <Id.Left_DollarParen '$('> child: (command.Simple blame_tok: <Id.VSub_DollarName '$awk'> more_env: [] words: [ {($ Id.VSub_DollarName awk)} { (SQ <'BEGIN { o = 0; }\n'> <'\t$1 == "#" && $2 ~ /TASK/ && NF == 6 { o = 1; }\n'> <'\t$2 ~ /TASK/ { print o; exit }'> ) } {<trace>} ] redirects: [] do_fork: T ) right: <Id.Eof_RParen _> ) } ) ] redirects: [] ) (command.Simple blame_tok: <warn> more_env: [] words: [{<warn>} {(DQ <'echo > trace'>)}] redirects: [] do_fork: T ) (command.Pipeline children: [ (command.Subshell left: <Id.Op_LParen _> child: (command.If if_kw: <Id.KW_If if> arms: [ (IfArm keyword: <Id.KW_If if> cond: (condition.Shell commands: [ (command.Sentence child: (command.DParen left: <Id.Op_DLeftParen _> child: ($ Id.Lit_ArithVarLike opt_duration) right: <Id.Op_DRightParen _> redirects: [] ) terminator: <Id.Op_Semi _> ) ] ) then_kw: <Id.KW_Then then> action: [ (command.Simple blame_tok: <sleep> more_env: [] words: [{<sleep>} {($ Id.VSub_DollarName duration)}] redirects: [] do_fork: T ) (command.Simple blame_tok: <cat> more_env: [] words: [{<cat>} {<-v>} {<trace>}] redirects: [] do_fork: T ) ] spids: [1279 1289] ) ] else_kw: <Id.KW_Else else> else_action: [ (command.Simple blame_tok: <cat> more_env: [] words: [{<cat>} {<-v>} {<trace_pipe>}] redirects: [] do_fork: T ) ] fi_kw: <Id.KW_Fi fi> redirects: [] ) right: <Id.Right_Subshell _> redirects: [] ) (command.Simple blame_tok: <Id.VSub_DollarName '$awk'> more_env: [] words: [ {($ Id.VSub_DollarName awk)} {<-v>} {<Id.Lit_VarLike 'o='> ($ Id.VSub_DollarName offset)} {<-v>} {<Id.Lit_VarLike 'opt_name='> ($ Id.VSub_DollarName opt_name)} {<-v>} {<Id.Lit_VarLike 'name='> ($ Id.VSub_DollarName name)} {<-v>} {<Id.Lit_VarLike 'opt_duration='> ($ Id.VSub_DollarName opt_duration)} {<-v>} {<Id.Lit_VarLike 'opt_time='> ($ Id.VSub_DollarName opt_time)} {<-v>} {<Id.Lit_VarLike 'kname='> ($ Id.VSub_DollarName kname)} {<-v>} {<Id.Lit_VarLike 'opt_reexec='> ($ Id.VSub_DollarName opt_reexec)} { (SQ <'\n'> <'\t# common fields\n'> <'\t$1 != "#" {\n'> <'\t\t# task name can contain dashes\n'> <'\t\tcomm = pid = $1\n'> <'\t\tsub(/-[0-9][0-9]*/, "", comm)\n'> <'\t\tsub(/.*-/, "", pid)\n'> <'\t}\n'> <'\n'> <'\t$1 != "#" && $(4+o) ~ /sched_process_fork/ {\n'> <'\t\tcpid=$0\n'> <'\t\tsub(/.* child_pid=/, "", cpid)\n'> <'\t\tsub(/ .*/, "", cpid)\n'> <'\t\tgetppid[cpid] = pid\n'> <'\t\tdelete seen[pid]\n'> <'\t}\n'> <'\n'> <'\t$1 != "#" && $(4+o) ~ kname {\n'> <'\t\tif (seen[pid])\n'> <'\t\t\tnext\n'> <'\t\tif (opt_name && comm !~ name)\n'> <'\t\t\tnext\n'> <'\n'> <'\t\t#\n'> <'\t\t# examples:\n'> <'\t\t# ... arg1="/bin/echo" arg2="1" arg3="2" arg4="3" ...\n'> <'\t\t# ... arg1="sleep" arg2="2" arg3=(fault) arg4="" ...\n'> <'\t\t# ... arg1="" arg2=(fault) arg3="" arg4="" ...\n'> <'\t\t# the last example is uncommon, and may be a race.\n'> <'\t\t#\n'> <'\t\tif ($0 ~ /arg1=""/) {\n'> <'\t\t\targs = comm " [?]"\n'> <'\t\t} else {\n'> <'\t\t\targs=$0\n'> <'\t\t\tsub(/ arg[0-9]*=\\(fault\\).*/, "", args)\n'> <'\t\t\tsub(/.*arg1="/, "", args)\n'> <'\t\t\tgsub(/" arg[0-9]*="/, " ", args)\n'> <'\t\t\tsub(/"$/, "", args)\n'> <'\t\t\tif ($0 !~ /\\(fault\\)/)\n'> <'\t\t\t\targs = args " [...]"\n'> <'\t\t}\n'> <'\n'> <'\t\tif (opt_time) {\n'> <'\t\t\ttime = $(3+o); sub(":", "", time)\n'> <'\t\t\tprintf "%-16s ", time\n'> <'\t\t}\n'> <'\t\tprintf "%6s %6d %s\\n", pid, getppid[pid], args\n'> <'\t\tif (!opt_duration)\n'> <'\t\t\tfflush()\n'> <'\t\tif (!opt_reexec) {\n'> <'\t\t\tseen[pid] = 1\n'> <'\t\t\tdelete getppid[pid]\n'> <'\t\t}\n'> <'\t}\n'> <'\n'> <'\t$0 ~ /LOST.*EVENT[S]/ { print "WARNING: " $0 > "/dev/stderr" }\n'> ) } ] redirects: [] do_fork: T ) ] ops: [<Id.Op_Pipe _>] ) (command.Simple blame_tok:<end> more_env:[] words:[{<end>}] redirects:[] do_fork:T) ] )