(CommandList children: [ (Assignment keyword: Assign_None pairs: [ (assign_pair lhs: (LhsName name:tracing) op: Equal rhs: {(/sys/kernel/debug/tracing)} spids: [166] ) ] spids: [166] ) (Sentence child: (Assignment keyword: Assign_None pairs: [ (assign_pair lhs: (LhsName name:flock) op: Equal rhs: {(/var/tmp/.ftrace-lock)} spids: [169] ) ] spids: [169] ) terminator: <Op_Semi ';'> ) (Assignment keyword: Assign_None pairs: [(assign_pair lhs:(LhsName name:wroteflock) op:Equal rhs:{(0)} spids:[173])] spids: [173] ) (Sentence child: (Assignment keyword: Assign_None pairs: [(assign_pair lhs:(LhsName name:opt_duration) op:Equal rhs:{(0)} spids:[176])] spids: [176] ) terminator: <Op_Semi ';'> ) (Sentence child: (Assignment keyword: Assign_None pairs: [(assign_pair lhs:(LhsName name:duration) op:Equal rhs:{(EmptyPart)} spids:[180])] spids: [180] ) terminator: <Op_Semi ';'> ) (Sentence child: (Assignment keyword: Assign_None pairs: [(assign_pair lhs:(LhsName name:opt_name) op:Equal rhs:{(0)} spids:[183])] spids: [183] ) terminator: <Op_Semi ';'> ) (Sentence child: (Assignment keyword: Assign_None pairs: [(assign_pair lhs:(LhsName name:name) op:Equal rhs:{(EmptyPart)} spids:[187])] spids: [187] ) terminator: <Op_Semi ';'> ) (Sentence child: (Assignment keyword: Assign_None pairs: [(assign_pair lhs:(LhsName name:opt_time) op:Equal rhs:{(0)} spids:[190])] spids: [190] ) terminator: <Op_Semi ';'> ) (Assignment keyword: Assign_None pairs: [(assign_pair lhs:(LhsName name:opt_reexec) op:Equal rhs:{(0)} spids:[194])] spids: [194] ) (Sentence child: (Assignment keyword: Assign_None pairs: [(assign_pair lhs:(LhsName name:opt_argc) op:Equal rhs:{(0)} spids:[197])] spids: [197] ) terminator: <Op_Semi ';'> ) (Sentence child: (Assignment keyword: Assign_None pairs: [(assign_pair lhs:(LhsName name:argc) op:Equal rhs:{(8)} spids:[201])] spids: [201] ) terminator: <Op_Semi ';'> ) (Sentence child: (Assignment keyword: Assign_None pairs: [(assign_pair lhs:(LhsName name:max_argc) op:Equal rhs:{(16)} spids:[205])] spids: [205] ) terminator: <Op_Semi ';'> ) (Assignment keyword: Assign_None pairs: [(assign_pair lhs:(LhsName name:ftext) op:Equal rhs:{(EmptyPart)} spids:[209])] spids: [209] ) (C {(trap)} {(SQ <':'>)} {(INT)} {(QUIT)} {(TERM)} {(PIPE)} {(HUP)}) (FuncDef name: usage body: (BraceGroup children: [ (SimpleCommand words: [{(cat)}] redirects: [ (HereDoc op: <Redir_DLessDash '<<-'> fd: 16777215 here_begin: {(END)} here_end_span_id: 267 stdin_parts: [ ('USAGE: execsnoop [-hrt] [-a argc] [-d secs] [name]\n') (' -d seconds # trace duration, and use buffers\n') (' -a argc # max args to show (default 8)\n') (' -r # include re-execs\n') (' -t # include time (seconds)\n') (' -h # this usage message\n') (' name # process name to match (REs allowed)\n') (' eg,\n') (' execsnoop # watch exec()s live (unbuffered)\n') (' execsnoop -d 1 # trace 1 sec (buffered)\n') (' execsnoop grep # trace process names containing grep\n') (" execsnoop 'log") (Lit_Other '$') ("' # filenames ending in ") (Right_DoubleQuote '"') (log) (Right_DoubleQuote '"') ('\n') ('\n') ('See the man page and example file for more info.\n') ] ) (Redir op:<Redir_GreatAnd '>&'> fd:16777215 arg_word:{(2)}) ] ) (ControlFlow token:<ControlFlow_Exit exit>) ] spids: [235] ) spids: [231 234] ) (FuncDef name: warn body: (BraceGroup children: [ (If arms: [ (if_arm cond: [ (Sentence child: (Pipeline children:[(C {(eval)} {(DQ ($ VSub_At '$@'))})] negated:T) terminator: <Op_Semi ';'> ) ] action: [ (SimpleCommand words: [ {(echo)} { (DQ ('WARNING: command failed ') (EscapedLiteralPart token: <Lit_EscapedChar '\\"'> ) ($ VSub_At '$@') (EscapedLiteralPart token:<Lit_EscapedChar '\\"'>) ) } ] redirects: [(Redir op:<Redir_GreatAnd '>&'> fd:16777215 arg_word:{(2)})] ) ] spids: [16777215 292] ) ] spids: [16777215 308] ) ] spids: [278] ) spids: [274 277] ) (FuncDef name: end body: (BraceGroup children: [ (SimpleCommand words: [{(echo)}] redirects: [(Redir op:<Redir_Great '2>'> fd:2 arg_word:{(/dev/null)})] ) (SimpleCommand words: [{(echo)} {(DQ ('Ending tracing...'))}] redirects: [(Redir op:<Redir_Great '2>'> fd:2 arg_word:{(/dev/null)})] ) (C {(cd)} {($ VSub_Name '$tracing')}) (C {(warn)} {(DQ ('echo 0 > events/kprobes/') ($ VSub_Name '$kname') (/enable))}) (C {(warn)} {(DQ ('echo 0 > events/sched/sched_process_fork/enable'))}) (C {(warn)} {(DQ ('echo -:') ($ VSub_Name '$kname') (' >> kprobe_events'))}) (C {(warn)} {(DQ ('echo > trace'))}) (AndOr ops: [Op_DAmp] children: [ (DParen child:(ArithVarRef name:wroteflock) spids:[377 382]) (C {(warn)} {(DQ ('rm ') ($ VSub_Name '$flock'))}) ] ) ] spids: [317] ) spids: [313 316] ) (FuncDef name: die body: (BraceGroup children: [ (SimpleCommand words: [{(echo)} {(DQ ($ VSub_At '$@'))}] redirects: [(Redir op:<Redir_GreatAnd '>&'> fd:16777215 arg_word:{(2)})] ) (ControlFlow token:<ControlFlow_Exit exit> arg_word:{(1)}) ] spids: [400] ) spids: [396 399] ) (FuncDef name: edie body: (BraceGroup children: [ (SimpleCommand words: [{(echo)} {(DQ ($ VSub_At '$@'))}] redirects: [(Redir op:<Redir_GreatAnd '>&'> fd:16777215 arg_word:{(2)})] ) (SimpleCommand words: [{(exec)}] redirects: [ (Redir op:<Redir_Great '>'> fd:16777215 arg_word:{(/dev/null)}) (Redir op:<Redir_GreatAnd '2>&'> fd:2 arg_word:{(1)}) ] ) (C {(end)}) (ControlFlow token:<ControlFlow_Exit exit> arg_word:{(1)}) ] spids: [424] ) spids: [420 423] ) (While cond: [(C {(getopts)} {(a) (Lit_Other ':') (d) (Lit_Other ':') (hrt)} {(opt)})] body: (DoGroup children: [ (Case to_match: {($ VSub_Name '$opt')} arms: [ (case_arm pat_list: [{(a)}] action: [ (Sentence child: (Assignment keyword: Assign_None pairs: [ (assign_pair lhs: (LhsName name:opt_argc) op: Equal rhs: {(1)} spids: [488] ) ] spids: [488] ) terminator: <Op_Semi ';'> ) (Assignment keyword: Assign_None pairs: [ (assign_pair lhs: (LhsName name:argc) op: Equal rhs: {($ VSub_Name '$OPTARG')} spids: [492] ) ] spids: [492] ) ] spids: [485 486 495 16777215] ) (case_arm pat_list: [{(d)}] action: [ (Sentence child: (Assignment keyword: Assign_None pairs: [ (assign_pair lhs: (LhsName name:opt_duration) op: Equal rhs: {(1)} spids: [501] ) ] spids: [501] ) terminator: <Op_Semi ';'> ) (Assignment keyword: Assign_None pairs: [ (assign_pair lhs: (LhsName name:duration) op: Equal rhs: {($ VSub_Name '$OPTARG')} spids: [505] ) ] spids: [505] ) ] spids: [498 499 508 16777215] ) (case_arm pat_list: [{(r)}] action: [ (Assignment keyword: Assign_None pairs: [ (assign_pair lhs: (LhsName name:opt_reexec) op: Equal rhs: {(1)} spids: [514] ) ] spids: [514] ) ] spids: [511 512 517 16777215] ) (case_arm pat_list: [{(t)}] action: [ (Assignment keyword: Assign_None pairs: [ (assign_pair lhs: (LhsName name:opt_time) op: Equal rhs: {(1)} spids: [523] ) ] spids: [523] ) ] spids: [520 521 526 16777215] ) (case_arm pat_list: [{(h)} {(Lit_Other '?')}] action: [(C {(usage)})] spids: [529 532 536 16777215] ) ] spids: [478 482 539] ) ] spids: [475 541] ) ) (C {(shift)} { (ArithSubPart anode: (ArithBinary op_id: Arith_Minus left: (ArithWord w:{($ VSub_Name '$OPTIND')}) right: (ArithWord w:{(Lit_Digits 1)}) ) spids: [545 554] ) } ) (If arms: [ (if_arm cond: [ (Sentence child: (DParen child:(ArithWord w:{($ VSub_Pound '$#')}) spids:[558 563]) terminator: <Op_Semi ';'> ) ] action: [ (Assignment keyword: Assign_None pairs: [(assign_pair lhs:(LhsName name:opt_name) op:Equal rhs:{(1)} spids:[569])] spids: [569] ) (Assignment keyword: Assign_None pairs: [ (assign_pair lhs: (LhsName name:name) op: Equal rhs: {($ VSub_Number '$1')} spids: [573] ) ] spids: [573] ) (C {(shift)}) ] spids: [16777215 566] ) ] spids: [16777215 579] ) (AndOr ops: [Op_DAmp] children: [(DParen child:(ArithWord w:{($ VSub_Pound '$#')}) spids:[581 586]) (C {(usage)})] ) (AndOr ops: [Op_DAmp] children: [ (DParen child: (ArithBinary op_id: Arith_DAmp left: (ArithVarRef name:opt_pid) right: (ArithVarRef name:opt_name) ) spids: [596 605] ) (C {(die)} {(DQ ('ERROR: use either -p or -n.'))}) ] ) (AndOr ops: [Op_DAmp] children: [ (DParen child:(ArithVarRef name:opt_pid) spids:[615 620]) (Assignment keyword: Assign_None pairs: [ (assign_pair lhs: (LhsName name:ftext) op: Equal rhs: {(DQ (' issued by PID ') ($ VSub_Name '$pid'))} spids: [624] ) ] spids: [624] ) ] ) (AndOr ops: [Op_DAmp] children: [ (DParen child:(ArithVarRef name:opt_name) spids:[630 635]) (Assignment keyword: Assign_None pairs: [ (assign_pair lhs: (LhsName name:ftext) op: Equal rhs: { (DQ (' issued by process name ') (EscapedLiteralPart token:<Lit_EscapedChar '\\"'>) ($ VSub_Name '$name') (EscapedLiteralPart token:<Lit_EscapedChar '\\"'>) ) } spids: [639] ) ] spids: [639] ) ] ) (AndOr ops: [Op_DAmp] children: [ (DParen child:(ArithVarRef name:opt_file) spids:[647 652]) (Assignment keyword: Assign_None pairs: [ (assign_pair lhs: (LhsName name:ftext) op: Equal rhs: { (DQ ($ VSub_Name '$ftext') (' for filenames containing ') (EscapedLiteralPart token:<Lit_EscapedChar '\\"'>) ($ VSub_Name '$file') (EscapedLiteralPart token:<Lit_EscapedChar '\\"'>) ) } spids: [656] ) ] spids: [656] ) ] ) (AndOr ops: [Op_DAmp] children: [ (DParen child: (ArithBinary op_id: Arith_DAmp left: (ArithVarRef name:opt_argc) right: (ArithBinary op_id: Arith_Great left: (ArithVarRef name:argc) right: (ArithVarRef name:max_argc) ) ) spids: [665 678] ) (C {(die)} {(DQ ('ERROR: max -a argc is ') ($ VSub_Name '$max_argc') (.))}) ] ) (If arms: [ (if_arm cond: [ (Sentence child: (DParen child:(ArithVarRef name:opt_duration) spids:[692 697]) terminator: <Op_Semi ';'> ) ] action: [ (C {(echo)} { (DQ ('Tracing exec()s') ($ VSub_Name '$ftext') (' for ') ($ VSub_Name '$duration') (' seconds (buffered)...') ) } ) ] spids: [16777215 700] ) ] else_action: [(C {(echo)} {(DQ ('Tracing exec()s') ($ VSub_Name '$ftext') ('. Ctrl-C to end.'))})] spids: [713 724] ) (If arms: [ (if_arm cond: [ (Sentence child: (DParen child:(ArithVarRef name:opt_duration) spids:[732 737]) terminator: <Op_Semi ';'> ) ] action: [ (AndOr ops: [Op_DAmp Op_DPipe] children: [ (DBracket expr:(BoolUnary op_id:BoolUnary_x child:{(/usr/bin/mawk)})) (Assignment keyword: Assign_None pairs: [(assign_pair lhs:(LhsName name:awk) op:Equal rhs:{(mawk)} spids:[753])] spids: [753] ) (Assignment keyword: Assign_None pairs: [(assign_pair lhs:(LhsName name:awk) op:Equal rhs:{(awk)} spids:[758])] spids: [758] ) ] ) ] spids: [16777215 740] ) ] else_action: [ (If arms: [ (if_arm cond: [ (Sentence child: (DBracket expr:(BoolUnary op_id:BoolUnary_x child:{(/usr/bin/gawk)})) terminator: <Op_Semi ';'> ) ] action: [ (Assignment keyword: Assign_None pairs: [(assign_pair lhs:(LhsName name:awk) op:Equal rhs:{(gawk)} spids:[782])] spids: [782] ) ] spids: [16777215 779] ) (if_arm cond: [ (Sentence child: (DBracket expr:(BoolUnary op_id:BoolUnary_x child:{(/usr/bin/mawk)})) terminator: <Op_Semi ';'> ) ] action: [ (Assignment keyword: Assign_None pairs: [ (assign_pair lhs: (LhsName name:awk) op: Equal rhs: {(DQ ('mawk -W interactive'))} spids: [800] ) ] spids: [800] ) ] spids: [786 797] ) ] else_action: [ (Assignment keyword: Assign_None pairs: [(assign_pair lhs:(LhsName name:awk) op:Equal rhs:{(awk)} spids:[809])] spids: [809] ) ] spids: [806 813] ) ] spids: [761 815] ) (AndOr ops: [Op_DPipe] children: [ (C {(cd)} {($ VSub_Name '$tracing')}) (C {(die)} { (DQ ('ERROR: accessing tracing. Root user? Kernel has FTRACE?\n') (' debugfs mounted? (mount -t debugfs debugfs /sys/kernel/debug)') ) } ) ] ) (AndOr ops: [Op_DAmp] children: [ (DBracket expr:(BoolUnary op_id:BoolUnary_e child:{($ VSub_Name '$flock')})) (C {(die)} { (DQ ('ERROR: ftrace may be in use by PID ') (CommandSubPart command_list: (CommandList children:[(C {(cat)} {($ VSub_Name '$flock')})]) left_token: <Left_CommandSub '$('> spids: [852 856] ) (' ') ($ VSub_Name '$flock') ) } ) ] ) (AndOr ops: [Op_DPipe] children: [ (SimpleCommand words: [{(echo)} {($ VSub_Dollar '$$')}] redirects: [(Redir op:<Redir_Great '>'> fd:16777215 arg_word:{($ VSub_Name '$flock')})] ) (C {(die)} {(DQ ('ERROR: unable to write ') ($ VSub_Name '$flock') (.))}) ] ) (Assignment keyword: Assign_None pairs: [(assign_pair lhs:(LhsName name:wroteflock) op:Equal rhs:{(1)} spids:[879])] spids: [879] ) (If arms: [ (if_arm cond: [ (Sentence child: (DBracket expr:(BoolUnary op_id:BoolUnary_x child:{(/usr/bin/getconf)})) terminator: <Op_Semi ';'> ) ] action: [ (Assignment keyword: Assign_None pairs: [ (assign_pair lhs: (LhsName name:bits) op: Equal rhs: { (CommandSubPart command_list: (CommandList children:[(C {(getconf)} {(LONG_BIT)})]) left_token: <Left_CommandSub '$('> spids: [901 905] ) } spids: [900] ) ] spids: [900] ) ] spids: [16777215 897] ) ] else_action: [ (Assignment keyword: Assign_None pairs: [(assign_pair lhs:(LhsName name:bits) op:Equal rhs:{(64)} spids:[910])] spids: [910] ) (AndOr ops: [Op_DAmp] children: [ (DBracket expr: (BoolBinary op_id: BoolBinary_GlobDEqual left: { (CommandSubPart command_list: (CommandList children:[(C {(uname)} {(-m)})]) left_token: <Left_CommandSub '$('> spids: [916 920] ) } right: {(i) (Lit_Other '*')} ) ) (Assignment keyword: Assign_None pairs: [(assign_pair lhs:(LhsName name:bits) op:Equal rhs:{(32)} spids:[931])] spids: [931] ) ] ) ] spids: [907 934] ) (DParen child: (BinaryAssign op_id: Arith_Equal left: (LhsName name:offset) right: (ArithBinary op_id: Arith_Slash left: (ArithVarRef name:bits) right: (ArithWord w:{(Lit_Digits 8)}) ) ) spids: [936 949] ) (FuncDef name: makeprobe body: (BraceGroup children: [ (Assignment keyword: Assign_None pairs: [ (assign_pair lhs: (LhsName name:func) op: Equal rhs: {($ VSub_Number '$1')} spids: [958] ) ] spids: [958] ) (Assignment keyword: Assign_None pairs: [ (assign_pair lhs: (LhsName name:kname) op: Equal rhs: {(execsnoop_) ($ VSub_Name '$func')} spids: [962] ) ] spids: [962] ) (Assignment keyword: Assign_None pairs: [ (assign_pair lhs: (LhsName name:kprobe) op: Equal rhs: {(DQ ('p:') ($ VSub_Name '$kname') (' ') ($ VSub_Name '$func'))} spids: [967] ) ] spids: [967] ) (Assignment keyword: Assign_None pairs: [(assign_pair lhs:(LhsName name:i) op:Equal rhs:{(0)} spids:[976])] spids: [976] ) (While cond: [ (Sentence child: (DParen child: (ArithBinary op_id: Arith_Less left: (ArithVarRef name:i) right: (ArithBinary op_id: Arith_Plus left: (ArithVarRef name:argc) right: (ArithWord w:{(Lit_Digits 1)}) ) ) spids: [982 995] ) terminator: <Op_Semi ';'> ) ] body: (DoGroup children: [ (Assignment keyword: Assign_None pairs: [ (assign_pair lhs: (LhsName name:kprobe) op: Equal rhs: { (DQ ($ VSub_Name '$kprobe') (' +0(+') (ArithSubPart anode: (ArithBinary op_id: Arith_Star left: (ArithVarRef name:i) right: (ArithVarRef name:offset) ) spids: [1009 1018] ) ('(%si)):string') ) } spids: [1005] ) ] spids: [1005] ) (DParen child: (UnaryAssign op_id:Node_PostDPlus child:(LhsName name:i)) spids: [1023 1029] ) ] spids: [998 1032] ) ) ] spids: [955] ) spids: [951 954] ) (C {(makeprobe)} {(sys_execve)}) (SimpleCommand words: [{(echo)} {(nop)}] redirects: [(Redir op:<Redir_Great '>'> fd:16777215 arg_word:{(current_tracer)})] ) (If arms: [ (if_arm cond: [ (Sentence child: (Pipeline children: [ (SimpleCommand words: [{(echo)} {($ VSub_Name '$kprobe')}] redirects: [ (Redir op: <Redir_DGreat '>>'> fd: 16777215 arg_word: {(kprobe_events)} ) (Redir op: <Redir_Great '2>'> fd: 2 arg_word: {(/dev/null)} ) ] ) ] negated: T ) terminator: <Op_Semi ';'> ) ] action: [ (C {(makeprobe)} {(stub_execve)}) (If arms: [ (if_arm cond: [ (Sentence child: (Pipeline children: [ (SimpleCommand words: [{(echo)} {($ VSub_Name '$kprobe')}] redirects: [ (Redir op: <Redir_DGreat '>>'> fd: 16777215 arg_word: {(kprobe_events)} ) (Redir op: <Redir_Great '2>'> fd: 2 arg_word: {(/dev/null)} ) ] ) ] negated: T ) terminator: <Op_Semi ';'> ) ] action: [ (C {(makeprobe)} {(do_execve)}) (If arms: [ (if_arm cond: [ (Sentence child: (Pipeline children: [ (SimpleCommand words: [{(echo)} {($ VSub_Name '$kprobe')}] redirects: [ (Redir op: <Redir_DGreat '>>'> fd: 16777215 arg_word: {(kprobe_events)} ) (Redir op: <Redir_Great '2>'> fd: 2 arg_word: {(/dev/null)} ) ] ) ] negated: T ) terminator: <Op_Semi ';'> ) ] action: [(C {(edie)} {(DQ ('ERROR: adding a kprobe for execve. Exiting.'))})] spids: [16777215 1119] ) ] spids: [16777215 1129] ) ] spids: [16777215 1095] ) ] spids: [16777215 1132] ) ] spids: [16777215 1071] ) ] spids: [16777215 1134] ) (If arms: [ (if_arm cond: [ (Sentence child: (Pipeline children: [ (SimpleCommand words: [{(echo)} {(1)}] redirects: [ (Redir op: <Redir_Great '>'> fd: 16777215 arg_word: {(events/kprobes/) ($ VSub_Name '$kname') (/enable)} ) ] ) ] negated: T ) terminator: <Op_Semi ';'> ) ] action: [(C {(edie)} {(DQ ('ERROR: enabling kprobe for execve. Exiting.'))})] spids: [16777215 1151] ) ] spids: [16777215 1160] ) (If arms: [ (if_arm cond: [ (Sentence child: (Pipeline children: [ (SimpleCommand words: [{(echo)} {(1)}] redirects: [ (Redir op: <Redir_Great '>'> fd: 16777215 arg_word: {(events/sched/sched_process_fork/enable)} ) ] ) ] negated: T ) terminator: <Op_Semi ';'> ) ] action: [(C {(edie)} {(DQ ('ERROR: enabling sched:sched_process_fork tracepoint. Exiting.'))})] spids: [16777215 1175] ) ] spids: [16777215 1184] ) (C {(echo)} {(DQ ('Instrumenting ') ($ VSub_Name '$func'))}) (AndOr ops: [Op_DAmp] children: [ (DParen child:(ArithVarRef name:opt_time) spids:[1193 1198]) (C {(printf)} {(DQ ('%-16s '))} {(DQ (TIMEs))}) ] ) (C {(printf)} {(DQ ('%6s %6s %s') (Lit_Other '\\') (n))} {(DQ (PID))} {(DQ (PPID))} {(DQ (ARGS))}) (Assignment keyword: Assign_None pairs: [ (assign_pair lhs: (LhsName name:offset) op: Equal rhs: { (CommandSubPart command_list: (CommandList children: [ (C {($ VSub_Name '$awk')} { (SQ <'BEGIN { o = 0; }\n'> <'\t$1 == "#" && $2 ~ /TASK/ && NF == 6 { o = 1; }\n'> <'\t$2 ~ /TASK/ { print o; exit }'> ) } {(trace)} ) ] ) left_token: <Left_CommandSub '$('> spids: [1255 1265] ) } spids: [1254] ) ] spids: [1254] ) (C {(warn)} {(DQ ('echo > trace'))}) (Pipeline children: [ (Subshell child: (If arms: [ (if_arm cond: [ (Sentence child: (DParen child:(ArithVarRef name:opt_duration) spids:[1281 1286]) terminator: <Op_Semi ';'> ) ] action: [(C {(sleep)} {($ VSub_Name '$duration')}) (C {(cat)} {(-v)} {(trace)})] spids: [16777215 1289] ) ] else_action: [(C {(cat)} {(-v)} {(trace_pipe)})] spids: [1307 1320] ) spids: [1277 1322] ) (C {($ VSub_Name '$awk')} {(-v)} {(Lit_VarLike 'o=') ($ VSub_Name '$offset')} {(-v)} {(Lit_VarLike 'opt_name=') ($ VSub_Name '$opt_name')} {(-v)} {(Lit_VarLike 'name=') ($ VSub_Name '$name')} {(-v)} {(Lit_VarLike 'opt_duration=') ($ VSub_Name '$opt_duration')} {(-v)} {(Lit_VarLike 'opt_time=') ($ VSub_Name '$opt_time')} {(-v)} {(Lit_VarLike 'kname=') ($ VSub_Name '$kname')} {(-v)} {(Lit_VarLike 'opt_reexec=') ($ VSub_Name '$opt_reexec')} { (SQ <'\n'> <'\t# common fields\n'> <'\t$1 != "#" {\n'> <'\t\t# task name can contain dashes\n'> <'\t\tcomm = pid = $1\n'> <'\t\tsub(/-[0-9][0-9]*/, "", comm)\n'> <'\t\tsub(/.*-/, "", pid)\n'> <'\t}\n'> <'\n'> <'\t$1 != "#" && $(4+o) ~ /sched_process_fork/ {\n'> <'\t\tcpid=$0\n'> <'\t\tsub(/.* child_pid=/, "", cpid)\n'> <'\t\tsub(/ .*/, "", cpid)\n'> <'\t\tgetppid[cpid] = pid\n'> <'\t\tdelete seen[pid]\n'> <'\t}\n'> <'\n'> <'\t$1 != "#" && $(4+o) ~ kname {\n'> <'\t\tif (seen[pid])\n'> <'\t\t\tnext\n'> <'\t\tif (opt_name && comm !~ name)\n'> <'\t\t\tnext\n'> <'\n'> <'\t\t#\n'> <'\t\t# examples:\n'> <'\t\t# ... arg1="/bin/echo" arg2="1" arg3="2" arg4="3" ...\n'> <'\t\t# ... arg1="sleep" arg2="2" arg3=(fault) arg4="" ...\n'> <'\t\t# ... arg1="" arg2=(fault) arg3="" arg4="" ...\n'> <'\t\t# the last example is uncommon, and may be a race.\n'> <'\t\t#\n'> <'\t\tif ($0 ~ /arg1=""/) {\n'> <'\t\t\targs = comm " [?]"\n'> <'\t\t} else {\n'> <'\t\t\targs=$0\n'> <'\t\t\tsub(/ arg[0-9]*=\\(fault\\).*/, "", args)\n'> <'\t\t\tsub(/.*arg1="/, "", args)\n'> <'\t\t\tgsub(/" arg[0-9]*="/, " ", args)\n'> <'\t\t\tsub(/"$/, "", args)\n'> <'\t\t\tif ($0 !~ /\\(fault\\)/)\n'> <'\t\t\t\targs = args " [...]"\n'> <'\t\t}\n'> <'\n'> <'\t\tif (opt_time) {\n'> <'\t\t\ttime = $(3+o); sub(":", "", time)\n'> <'\t\t\tprintf "%-16s ", time\n'> <'\t\t}\n'> <'\t\tprintf "%6s %6d %s\\n", pid, getppid[pid], args\n'> <'\t\tif (!opt_duration)\n'> <'\t\t\tfflush()\n'> <'\t\tif (!opt_reexec) {\n'> <'\t\t\tseen[pid] = 1\n'> <'\t\t\tdelete getppid[pid]\n'> <'\t\t}\n'> <'\t}\n'> <'\n'> <'\t$0 ~ /LOST.*EVENT[S]/ { print "WARNING: " $0 > "/dev/stderr" }\n'> ) } ) ] negated: F ) (C {(end)}) ] )