(CommandList children: [ (Assignment keyword: Assign_None pairs: [ (assign_pair lhs: (LhsName name:tracing) op: Equal rhs: {(/sys/kernel/debug/tracing)} spids: [166] ) ] spids: [166] ) (Sentence child: (Assignment keyword: Assign_None pairs: [ (assign_pair lhs: (LhsName name:flock) op: Equal rhs: {(/var/tmp/.ftrace-lock)} spids: [169] ) ] spids: [169] ) terminator: <Op_Semi ';'> ) (Assignment keyword: Assign_None pairs: [(assign_pair lhs:(LhsName name:wroteflock) op:Equal rhs:{(0)} spids:[173])] spids: [173] ) (Sentence child: (Assignment keyword: Assign_None pairs: [(assign_pair lhs:(LhsName name:opt_duration) op:Equal rhs:{(0)} spids:[176])] spids: [176] ) terminator: <Op_Semi ';'> ) (Sentence child: (Assignment keyword: Assign_None pairs: [(assign_pair lhs:(LhsName name:duration) op:Equal rhs:{(EmptyPart)} spids:[180])] spids: [180] ) terminator: <Op_Semi ';'> ) (Sentence child: (Assignment keyword: Assign_None pairs: [(assign_pair lhs:(LhsName name:opt_name) op:Equal rhs:{(0)} spids:[183])] spids: [183] ) terminator: <Op_Semi ';'> ) (Sentence child: (Assignment keyword: Assign_None pairs: [(assign_pair lhs:(LhsName name:name) op:Equal rhs:{(EmptyPart)} spids:[187])] spids: [187] ) terminator: <Op_Semi ';'> ) (Sentence child: (Assignment keyword: Assign_None pairs: [(assign_pair lhs:(LhsName name:opt_time) op:Equal rhs:{(0)} spids:[190])] spids: [190] ) terminator: <Op_Semi ';'> ) (Assignment keyword: Assign_None pairs: [(assign_pair lhs:(LhsName name:opt_reexec) op:Equal rhs:{(0)} spids:[194])] spids: [194] ) (Sentence child: (Assignment keyword: Assign_None pairs: [(assign_pair lhs:(LhsName name:opt_argc) op:Equal rhs:{(0)} spids:[197])] spids: [197] ) terminator: <Op_Semi ';'> ) (Sentence child: (Assignment keyword: Assign_None pairs: [(assign_pair lhs:(LhsName name:argc) op:Equal rhs:{(8)} spids:[201])] spids: [201] ) terminator: <Op_Semi ';'> ) (Sentence child: (Assignment keyword: Assign_None pairs: [(assign_pair lhs:(LhsName name:max_argc) op:Equal rhs:{(16)} spids:[205])] spids: [205] ) terminator: <Op_Semi ';'> ) (Assignment keyword: Assign_None pairs: [(assign_pair lhs:(LhsName name:ftext) op:Equal rhs:{(EmptyPart)} spids:[209])] spids: [209] ) (C {(trap)} {(SQ <':'>)} {(INT)} {(QUIT)} {(TERM)} {(PIPE)} {(HUP)}) (FuncDef name: usage body: (BraceGroup children: [ (SimpleCommand words: [{(cat)}] redirects: [ (HereDoc op_id: Redir_DLessDash fd: 16777215 body: { (DQ ('USAGE: execsnoop [-hrt] [-a argc] [-d secs] [name]\n') (' -d seconds # trace duration, and use buffers\n') (' -a argc # max args to show (default 8)\n') (' -r # include re-execs\n') (' -t # include time (seconds)\n') (' -h # this usage message\n') (' name # process name to match (REs allowed)\n') (' eg,\n') (' execsnoop # watch exec()s live (unbuffered)\n') (' execsnoop -d 1 # trace 1 sec (buffered)\n') ( ' execsnoop grep # trace process names containing grep\n' ) (" execsnoop 'log") (Lit_Other '$') ("' # filenames ending in ") (Right_DoubleQuote '"') (log) (Right_DoubleQuote '"') ('\n') ('\n') ('See the man page and example file for more info.\n') ) } do_expansion: True here_end: END was_filled: T spids: [240] ) (Redir op_id:Redir_GreatAnd fd:16777215 arg_word:{(2)} spids:[243]) ] ) (ControlFlow token:<ControlFlow_Exit exit>) ] spids: [235] ) spids: [231 234] ) (FuncDef name: warn body: (BraceGroup children: [ (If arms: [ (if_arm cond: [ (Sentence child: (Pipeline children:[(C {(eval)} {(DQ ($ VSub_At '$@'))})] negated:T) terminator: <Op_Semi ';'> ) ] action: [ (SimpleCommand words: [ {(echo)} { (DQ ('WARNING: command failed ') (EscapedLiteralPart token: <Lit_EscapedChar '\\"'> ) ($ VSub_At '$@') (EscapedLiteralPart token:<Lit_EscapedChar '\\"'>) ) } ] redirects: [(Redir op_id:Redir_GreatAnd fd:16777215 arg_word:{(2)} spids:[296])] ) ] spids: [16777215 291] ) ] spids: [16777215 307] ) ] spids: [277] ) spids: [273 276] ) (FuncDef name: end body: (BraceGroup children: [ (SimpleCommand words: [{(echo)}] redirects: [(Redir op_id:Redir_Great fd:2 arg_word:{(/dev/null)} spids:[325])] ) (SimpleCommand words: [{(echo)} {(DQ ('Ending tracing...'))}] redirects: [(Redir op_id:Redir_Great fd:2 arg_word:{(/dev/null)} spids:[335])] ) (C {(cd)} {($ VSub_Name '$tracing')}) (C {(warn)} {(DQ ('echo 0 > events/kprobes/') ($ VSub_Name '$kname') (/enable))}) (C {(warn)} {(DQ ('echo 0 > events/sched/sched_process_fork/enable'))}) (C {(warn)} {(DQ ('echo -:') ($ VSub_Name '$kname') (' >> kprobe_events'))}) (C {(warn)} {(DQ ('echo > trace'))}) (AndOr ops: [Op_DAmp] children: [ (DParen child:(ArithVarRef name:wroteflock)) (C {(warn)} {(DQ ('rm ') ($ VSub_Name '$flock'))}) ] ) ] spids: [316] ) spids: [312 315] ) (FuncDef name: die body: (BraceGroup children: [ (SimpleCommand words: [{(echo)} {(DQ ($ VSub_At '$@'))}] redirects: [(Redir op_id:Redir_GreatAnd fd:16777215 arg_word:{(2)} spids:[404])] ) (ControlFlow token:<ControlFlow_Exit exit> arg_word:{(1)}) ] spids: [399] ) spids: [395 398] ) (FuncDef name: edie body: (BraceGroup children: [ (SimpleCommand words: [{(echo)} {(DQ ($ VSub_At '$@'))}] redirects: [(Redir op_id:Redir_GreatAnd fd:16777215 arg_word:{(2)} spids:[432])] ) (SimpleCommand words: [{(exec)}] redirects: [ (Redir op_id: Redir_Great fd: 16777215 arg_word: {(/dev/null)} spids: [442] ) (Redir op_id:Redir_GreatAnd fd:2 arg_word:{(1)} spids:[445]) ] ) (C {(end)}) (ControlFlow token:<ControlFlow_Exit exit> arg_word:{(1)}) ] spids: [423] ) spids: [419 422] ) (While cond: [(C {(getopts)} {(a) (Lit_Other ':') (d) (Lit_Other ':') (hrt)} {(opt)})] body: (DoGroup children: [ (Case to_match: {($ VSub_Name '$opt')} arms: [ (case_arm pat_list: [{(a)}] action: [ (Sentence child: (Assignment keyword: Assign_None pairs: [ (assign_pair lhs: (LhsName name:opt_argc) op: Equal rhs: {(1)} spids: [487] ) ] spids: [487] ) terminator: <Op_Semi ';'> ) (Assignment keyword: Assign_None pairs: [ (assign_pair lhs: (LhsName name:argc) op: Equal rhs: {($ VSub_Name '$OPTARG')} spids: [491] ) ] spids: [491] ) ] spids: [484 485 494 16777215] ) (case_arm pat_list: [{(d)}] action: [ (Sentence child: (Assignment keyword: Assign_None pairs: [ (assign_pair lhs: (LhsName name:opt_duration) op: Equal rhs: {(1)} spids: [500] ) ] spids: [500] ) terminator: <Op_Semi ';'> ) (Assignment keyword: Assign_None pairs: [ (assign_pair lhs: (LhsName name:duration) op: Equal rhs: {($ VSub_Name '$OPTARG')} spids: [504] ) ] spids: [504] ) ] spids: [497 498 507 16777215] ) (case_arm pat_list: [{(r)}] action: [ (Assignment keyword: Assign_None pairs: [ (assign_pair lhs: (LhsName name:opt_reexec) op: Equal rhs: {(1)} spids: [513] ) ] spids: [513] ) ] spids: [510 511 516 16777215] ) (case_arm pat_list: [{(t)}] action: [ (Assignment keyword: Assign_None pairs: [ (assign_pair lhs: (LhsName name:opt_time) op: Equal rhs: {(1)} spids: [522] ) ] spids: [522] ) ] spids: [519 520 525 16777215] ) (case_arm pat_list: [{(h)} {(Lit_Other '?')}] action: [(C {(usage)})] spids: [528 531 535 16777215] ) ] spids: [477 481 538] ) ] spids: [474 540] ) ) (C {(shift)} { (ArithSubPart anode: (ArithBinary op_id: Arith_Minus left: (ArithWord w:{($ VSub_Name '$OPTIND')}) right: (ArithWord w:{(Lit_Digits 1)}) ) spids: [544 553] ) } ) (If arms: [ (if_arm cond: [ (Sentence child: (DParen child:(ArithWord w:{($ VSub_Pound '$#')})) terminator: <Op_Semi ';'> ) ] action: [ (Assignment keyword: Assign_None pairs: [(assign_pair lhs:(LhsName name:opt_name) op:Equal rhs:{(1)} spids:[568])] spids: [568] ) (Assignment keyword: Assign_None pairs: [ (assign_pair lhs: (LhsName name:name) op: Equal rhs: {($ VSub_Number '$1')} spids: [572] ) ] spids: [572] ) (C {(shift)}) ] spids: [16777215 565] ) ] spids: [16777215 578] ) (AndOr ops: [Op_DAmp] children: [(DParen child:(ArithWord w:{($ VSub_Pound '$#')})) (C {(usage)})] ) (AndOr ops: [Op_DAmp] children: [ (DParen child: (ArithBinary op_id: Arith_DAmp left: (ArithVarRef name:opt_pid) right: (ArithVarRef name:opt_name) ) ) (C {(die)} {(DQ ('ERROR: use either -p or -n.'))}) ] ) (AndOr ops: [Op_DAmp] children: [ (DParen child:(ArithVarRef name:opt_pid)) (Assignment keyword: Assign_None pairs: [ (assign_pair lhs: (LhsName name:ftext) op: Equal rhs: {(DQ (' issued by PID ') ($ VSub_Name '$pid'))} spids: [623] ) ] spids: [623] ) ] ) (AndOr ops: [Op_DAmp] children: [ (DParen child:(ArithVarRef name:opt_name)) (Assignment keyword: Assign_None pairs: [ (assign_pair lhs: (LhsName name:ftext) op: Equal rhs: { (DQ (' issued by process name ') (EscapedLiteralPart token:<Lit_EscapedChar '\\"'>) ($ VSub_Name '$name') (EscapedLiteralPart token:<Lit_EscapedChar '\\"'>) ) } spids: [638] ) ] spids: [638] ) ] ) (AndOr ops: [Op_DAmp] children: [ (DParen child:(ArithVarRef name:opt_file)) (Assignment keyword: Assign_None pairs: [ (assign_pair lhs: (LhsName name:ftext) op: Equal rhs: { (DQ ($ VSub_Name '$ftext') (' for filenames containing ') (EscapedLiteralPart token:<Lit_EscapedChar '\\"'>) ($ VSub_Name '$file') (EscapedLiteralPart token:<Lit_EscapedChar '\\"'>) ) } spids: [655] ) ] spids: [655] ) ] ) (AndOr ops: [Op_DAmp] children: [ (DParen child: (ArithBinary op_id: Arith_DAmp left: (ArithVarRef name:opt_argc) right: (ArithBinary op_id: Arith_Great left: (ArithVarRef name:argc) right: (ArithVarRef name:max_argc) ) ) ) (C {(die)} {(DQ ('ERROR: max -a argc is ') ($ VSub_Name '$max_argc') (.))}) ] ) (If arms: [ (if_arm cond: [ (Sentence child: (DParen child:(ArithVarRef name:opt_duration)) terminator: <Op_Semi ';'> ) ] action: [ (C {(echo)} { (DQ ('Tracing exec()s') ($ VSub_Name '$ftext') (' for ') ($ VSub_Name '$duration') (' seconds (buffered)...') ) } ) ] spids: [16777215 699] ) ] else_action: [(C {(echo)} {(DQ ('Tracing exec()s') ($ VSub_Name '$ftext') ('. Ctrl-C to end.'))})] spids: [712 723] ) (If arms: [ (if_arm cond: [ (Sentence child: (DParen child:(ArithVarRef name:opt_duration)) terminator: <Op_Semi ';'> ) ] action: [ (AndOr ops: [Op_DAmp Op_DPipe] children: [ (DBracket expr:(BoolUnary op_id:BoolUnary_x child:{(/usr/bin/mawk)})) (Assignment keyword: Assign_None pairs: [(assign_pair lhs:(LhsName name:awk) op:Equal rhs:{(mawk)} spids:[752])] spids: [752] ) (Assignment keyword: Assign_None pairs: [(assign_pair lhs:(LhsName name:awk) op:Equal rhs:{(awk)} spids:[757])] spids: [757] ) ] ) ] spids: [16777215 739] ) ] else_action: [ (If arms: [ (if_arm cond: [ (Sentence child: (DBracket expr:(BoolUnary op_id:BoolUnary_x child:{(/usr/bin/gawk)})) terminator: <Op_Semi ';'> ) ] action: [ (Assignment keyword: Assign_None pairs: [(assign_pair lhs:(LhsName name:awk) op:Equal rhs:{(gawk)} spids:[781])] spids: [781] ) ] spids: [16777215 778] ) (if_arm cond: [ (Sentence child: (DBracket expr:(BoolUnary op_id:BoolUnary_x child:{(/usr/bin/mawk)})) terminator: <Op_Semi ';'> ) ] action: [ (Assignment keyword: Assign_None pairs: [ (assign_pair lhs: (LhsName name:awk) op: Equal rhs: {(DQ ('mawk -W interactive'))} spids: [799] ) ] spids: [799] ) ] spids: [785 796] ) ] else_action: [ (Assignment keyword: Assign_None pairs: [(assign_pair lhs:(LhsName name:awk) op:Equal rhs:{(awk)} spids:[808])] spids: [808] ) ] spids: [805 812] ) ] spids: [760 814] ) (AndOr ops: [Op_DPipe] children: [ (C {(cd)} {($ VSub_Name '$tracing')}) (C {(die)} { (DQ ('ERROR: accessing tracing. Root user? Kernel has FTRACE?\n') (' debugfs mounted? (mount -t debugfs debugfs /sys/kernel/debug)') ) } ) ] ) (AndOr ops: [Op_DAmp] children: [ (DBracket expr:(BoolUnary op_id:BoolUnary_e child:{($ VSub_Name '$flock')})) (C {(die)} { (DQ ('ERROR: ftrace may be in use by PID ') (CommandSubPart command_list: (CommandList children:[(C {(cat)} {($ VSub_Name '$flock')})]) left_token: <Left_CommandSub '$('> spids: [851 855] ) (' ') ($ VSub_Name '$flock') ) } ) ] ) (AndOr ops: [Op_DPipe] children: [ (SimpleCommand words: [{(echo)} {($ VSub_Dollar '$$')}] redirects: [ (Redir op_id: Redir_Great fd: 16777215 arg_word: {($ VSub_Name '$flock')} spids: [864] ) ] ) (C {(die)} {(DQ ('ERROR: unable to write ') ($ VSub_Name '$flock') (.))}) ] ) (Assignment keyword: Assign_None pairs: [(assign_pair lhs:(LhsName name:wroteflock) op:Equal rhs:{(1)} spids:[878])] spids: [878] ) (If arms: [ (if_arm cond: [ (Sentence child: (DBracket expr:(BoolUnary op_id:BoolUnary_x child:{(/usr/bin/getconf)})) terminator: <Op_Semi ';'> ) ] action: [ (Assignment keyword: Assign_None pairs: [ (assign_pair lhs: (LhsName name:bits) op: Equal rhs: { (CommandSubPart command_list: (CommandList children:[(C {(getconf)} {(LONG_BIT)})]) left_token: <Left_CommandSub '$('> spids: [900 904] ) } spids: [899] ) ] spids: [899] ) ] spids: [16777215 896] ) ] else_action: [ (Assignment keyword: Assign_None pairs: [(assign_pair lhs:(LhsName name:bits) op:Equal rhs:{(64)} spids:[909])] spids: [909] ) (AndOr ops: [Op_DAmp] children: [ (DBracket expr: (BoolBinary op_id: BoolBinary_GlobDEqual left: { (CommandSubPart command_list: (CommandList children:[(C {(uname)} {(-m)})]) left_token: <Left_CommandSub '$('> spids: [915 919] ) } right: {(i) (Lit_Other '*')} ) ) (Assignment keyword: Assign_None pairs: [(assign_pair lhs:(LhsName name:bits) op:Equal rhs:{(32)} spids:[930])] spids: [930] ) ] ) ] spids: [906 933] ) (DParen child: (BinaryAssign op_id: Arith_Equal left: (LhsName name:offset) right: (ArithBinary op_id: Arith_Slash left: (ArithVarRef name:bits) right: (ArithWord w:{(Lit_Digits 8)}) ) ) ) (FuncDef name: makeprobe body: (BraceGroup children: [ (Assignment keyword: Assign_None pairs: [ (assign_pair lhs: (LhsName name:func) op: Equal rhs: {($ VSub_Number '$1')} spids: [957] ) ] spids: [957] ) (Assignment keyword: Assign_None pairs: [ (assign_pair lhs: (LhsName name:kname) op: Equal rhs: {(execsnoop_) ($ VSub_Name '$func')} spids: [961] ) ] spids: [961] ) (Assignment keyword: Assign_None pairs: [ (assign_pair lhs: (LhsName name:kprobe) op: Equal rhs: {(DQ ('p:') ($ VSub_Name '$kname') (' ') ($ VSub_Name '$func'))} spids: [966] ) ] spids: [966] ) (Assignment keyword: Assign_None pairs: [(assign_pair lhs:(LhsName name:i) op:Equal rhs:{(0)} spids:[975])] spids: [975] ) (While cond: [ (Sentence child: (DParen child: (ArithBinary op_id: Arith_Less left: (ArithVarRef name:i) right: (ArithBinary op_id: Arith_Plus left: (ArithVarRef name:argc) right: (ArithWord w:{(Lit_Digits 1)}) ) ) ) terminator: <Op_Semi ';'> ) ] body: (DoGroup children: [ (Assignment keyword: Assign_None pairs: [ (assign_pair lhs: (LhsName name:kprobe) op: Equal rhs: { (DQ ($ VSub_Name '$kprobe') (' +0(+') (ArithSubPart anode: (ArithBinary op_id: Arith_Star left: (ArithVarRef name:i) right: (ArithVarRef name:offset) ) spids: [1008 1017] ) ('(%si)):string') ) } spids: [1004] ) ] spids: [1004] ) (DParen child: (UnaryAssign op_id:Node_PostDPlus child:(LhsName name:i)) ) ] spids: [997 1031] ) ) ] spids: [954] ) spids: [950 953] ) (C {(makeprobe)} {(sys_execve)}) (SimpleCommand words: [{(echo)} {(nop)}] redirects: [(Redir op_id:Redir_Great fd:16777215 arg_word:{(current_tracer)} spids:[1050])] ) (If arms: [ (if_arm cond: [ (Sentence child: (Pipeline children: [ (SimpleCommand words: [{(echo)} {($ VSub_Name '$kprobe')}] redirects: [ (Redir op_id: Redir_DGreat fd: 16777215 arg_word: {(kprobe_events)} spids: [1062] ) (Redir op_id: Redir_Great fd: 2 arg_word: {(/dev/null)} spids: [1066] ) ] ) ] negated: T ) terminator: <Op_Semi ';'> ) ] action: [ (C {(makeprobe)} {(stub_execve)}) (If arms: [ (if_arm cond: [ (Sentence child: (Pipeline children: [ (SimpleCommand words: [{(echo)} {($ VSub_Name '$kprobe')}] redirects: [ (Redir op_id: Redir_DGreat fd: 16777215 arg_word: {(kprobe_events)} spids: [1086] ) (Redir op_id: Redir_Great fd: 2 arg_word: {(/dev/null)} spids: [1090] ) ] ) ] negated: T ) terminator: <Op_Semi ';'> ) ] action: [ (C {(makeprobe)} {(do_execve)}) (If arms: [ (if_arm cond: [ (Sentence child: (Pipeline children: [ (SimpleCommand words: [{(echo)} {($ VSub_Name '$kprobe')}] redirects: [ (Redir op_id: Redir_DGreat fd: 16777215 arg_word: {(kprobe_events)} spids: [1110] ) (Redir op_id: Redir_Great fd: 2 arg_word: {(/dev/null)} spids: [1114] ) ] ) ] negated: T ) terminator: <Op_Semi ';'> ) ] action: [(C {(edie)} {(DQ ('ERROR: adding a kprobe for execve. Exiting.'))})] spids: [16777215 1118] ) ] spids: [16777215 1128] ) ] spids: [16777215 1094] ) ] spids: [16777215 1131] ) ] spids: [16777215 1070] ) ] spids: [16777215 1133] ) (If arms: [ (if_arm cond: [ (Sentence child: (Pipeline children: [ (SimpleCommand words: [{(echo)} {(1)}] redirects: [ (Redir op_id: Redir_Great fd: 16777215 arg_word: {(events/kprobes/) ($ VSub_Name '$kname') (/enable)} spids: [1143] ) ] ) ] negated: T ) terminator: <Op_Semi ';'> ) ] action: [(C {(edie)} {(DQ ('ERROR: enabling kprobe for execve. Exiting.'))})] spids: [16777215 1150] ) ] spids: [16777215 1159] ) (If arms: [ (if_arm cond: [ (Sentence child: (Pipeline children: [ (SimpleCommand words: [{(echo)} {(1)}] redirects: [ (Redir op_id: Redir_Great fd: 16777215 arg_word: {(events/sched/sched_process_fork/enable)} spids: [1169] ) ] ) ] negated: T ) terminator: <Op_Semi ';'> ) ] action: [(C {(edie)} {(DQ ('ERROR: enabling sched:sched_process_fork tracepoint. Exiting.'))})] spids: [16777215 1174] ) ] spids: [16777215 1183] ) (C {(echo)} {(DQ ('Instrumenting ') ($ VSub_Name '$func'))}) (AndOr ops: [Op_DAmp] children: [ (DParen child:(ArithVarRef name:opt_time)) (C {(printf)} {(DQ ('%-16s '))} {(DQ (TIMEs))}) ] ) (C {(printf)} {(DQ ('%6s %6s %s') (Lit_Other '\\') (n))} {(DQ (PID))} {(DQ (PPID))} {(DQ (ARGS))}) (Assignment keyword: Assign_None pairs: [ (assign_pair lhs: (LhsName name:offset) op: Equal rhs: { (CommandSubPart command_list: (CommandList children: [ (C {($ VSub_Name '$awk')} { (SQ <'BEGIN { o = 0; }\n'> <'\t$1 == "#" && $2 ~ /TASK/ && NF == 6 { o = 1; }\n'> <'\t$2 ~ /TASK/ { print o; exit }'> ) } {(trace)} ) ] ) left_token: <Left_CommandSub '$('> spids: [1254 1264] ) } spids: [1253] ) ] spids: [1253] ) (C {(warn)} {(DQ ('echo > trace'))}) (Pipeline children: [ (Subshell child: (If arms: [ (if_arm cond: [ (Sentence child: (DParen child:(ArithVarRef name:opt_duration)) terminator: <Op_Semi ';'> ) ] action: [(C {(sleep)} {($ VSub_Name '$duration')}) (C {(cat)} {(-v)} {(trace)})] spids: [16777215 1288] ) ] else_action: [(C {(cat)} {(-v)} {(trace_pipe)})] spids: [1306 1319] ) spids: [1276 1321] ) (C {($ VSub_Name '$awk')} {(-v)} {(Lit_VarLike 'o=') ($ VSub_Name '$offset')} {(-v)} {(Lit_VarLike 'opt_name=') ($ VSub_Name '$opt_name')} {(-v)} {(Lit_VarLike 'name=') ($ VSub_Name '$name')} {(-v)} {(Lit_VarLike 'opt_duration=') ($ VSub_Name '$opt_duration')} {(-v)} {(Lit_VarLike 'opt_time=') ($ VSub_Name '$opt_time')} {(-v)} {(Lit_VarLike 'kname=') ($ VSub_Name '$kname')} {(-v)} {(Lit_VarLike 'opt_reexec=') ($ VSub_Name '$opt_reexec')} { (SQ <'\n'> <'\t# common fields\n'> <'\t$1 != "#" {\n'> <'\t\t# task name can contain dashes\n'> <'\t\tcomm = pid = $1\n'> <'\t\tsub(/-[0-9][0-9]*/, "", comm)\n'> <'\t\tsub(/.*-/, "", pid)\n'> <'\t}\n'> <'\n'> <'\t$1 != "#" && $(4+o) ~ /sched_process_fork/ {\n'> <'\t\tcpid=$0\n'> <'\t\tsub(/.* child_pid=/, "", cpid)\n'> <'\t\tsub(/ .*/, "", cpid)\n'> <'\t\tgetppid[cpid] = pid\n'> <'\t\tdelete seen[pid]\n'> <'\t}\n'> <'\n'> <'\t$1 != "#" && $(4+o) ~ kname {\n'> <'\t\tif (seen[pid])\n'> <'\t\t\tnext\n'> <'\t\tif (opt_name && comm !~ name)\n'> <'\t\t\tnext\n'> <'\n'> <'\t\t#\n'> <'\t\t# examples:\n'> <'\t\t# ... arg1="/bin/echo" arg2="1" arg3="2" arg4="3" ...\n'> <'\t\t# ... arg1="sleep" arg2="2" arg3=(fault) arg4="" ...\n'> <'\t\t# ... arg1="" arg2=(fault) arg3="" arg4="" ...\n'> <'\t\t# the last example is uncommon, and may be a race.\n'> <'\t\t#\n'> <'\t\tif ($0 ~ /arg1=""/) {\n'> <'\t\t\targs = comm " [?]"\n'> <'\t\t} else {\n'> <'\t\t\targs=$0\n'> <'\t\t\tsub(/ arg[0-9]*=\\(fault\\).*/, "", args)\n'> <'\t\t\tsub(/.*arg1="/, "", args)\n'> <'\t\t\tgsub(/" arg[0-9]*="/, " ", args)\n'> <'\t\t\tsub(/"$/, "", args)\n'> <'\t\t\tif ($0 !~ /\\(fault\\)/)\n'> <'\t\t\t\targs = args " [...]"\n'> <'\t\t}\n'> <'\n'> <'\t\tif (opt_time) {\n'> <'\t\t\ttime = $(3+o); sub(":", "", time)\n'> <'\t\t\tprintf "%-16s ", time\n'> <'\t\t}\n'> <'\t\tprintf "%6s %6d %s\\n", pid, getppid[pid], args\n'> <'\t\tif (!opt_duration)\n'> <'\t\t\tfflush()\n'> <'\t\tif (!opt_reexec) {\n'> <'\t\t\tseen[pid] = 1\n'> <'\t\t\tdelete getppid[pid]\n'> <'\t\t}\n'> <'\t}\n'> <'\n'> <'\t$0 ~ /LOST.*EVENT[S]/ { print "WARNING: " $0 > "/dev/stderr" }\n'> ) } ) ] negated: F ) (C {(end)}) ] )