monitor process lifecycle

procmonitor.bt

#define RESET "\033[0m"
#define RED "\033[31m"
#define GREEN "\033[32m"
#define YELLOW "\033[33m"
#define BRED "\033[41m"

#define TIME strftime("%H:%M:%S", nsecs)

BEGIN {
        printf("%8s [%5s %16s] ACTION args\n", "TIME", "PID", "COMM");
}

tracepoint:sched:sched_process_fork {
        printf("%s [%5d %16s] %sFORK%s child %d\n",  TIME, pid, comm, GREEN, RESET, args->child_pid);
}

tracepoint:sched:sched_process_exit {
        printf("%s [%5d %16s] %sEXIT%s\n", TIME, pid, args->comm, RED, RESET);
}

kprobe:SyS_execve
{
        printf("%s [%5d %16s] %sEXEC%s ",  TIME, pid, comm, YELLOW, RESET);
        join(arg1);
}

// stolen from killsnoop.bt

tracepoint:syscalls:sys_enter_kill
{
        @killpid[tid] = args->pid;
        @killsig[tid] = args->sig;
}

tracepoint:syscalls:sys_exit_kill
/@killpid[tid]/
{

        printf("%s [%5d %16s] %sKILLS%s %d with signal %d: %d\n", TIME, pid, comm, BRED, RESET, @killpid[tid], @killsig[tid],
            args->ret);
        delete(@killpid[tid]);
        delete(@killsig[tid]);
}