Linux and UNIX Man Pages

Linux & Unix Commands - Search Man Pages

filemon(4) [netbsd man page]

FILEMON(4)						   BSD Kernel Interfaces Manual 						FILEMON(4)

filemon -- track interesting system calls SYNOPSIS
#include <filemon.h> DESCRIPTION
filemon provides a means for tracking the successful system calls performed by a process. It is used by make(1) to track the activities of build scripts, for the purpose of automatically learning dependencies. The data captured by filemon for the script n=`wc -l /etc/motd`; echo "int motd_lines = $n;" > cmp -s foo.h 2> /dev/null || mv foo.h looks like: # filemon version 4 # Target pid 24291 V 4 E 29676 /bin/sh R 29676 /etc/ R 29676 /lib/ R 29676 /lib/ R 29676 /lib/ F 29676 4899 E 4899 /usr/bin/wc R 4899 /etc/ R 4899 /usr/lib/ R 4899 /etc/motd X 4899 0 W 29676 X 29676 0 # Bye bye E 3250 /bin/sh R 3250 /etc/ R 3250 /lib/ R 3250 /lib/ R 3250 /lib/ W 26673 /dev/null E 26673 /usr/bin/cmp R 26673 /etc/ R 26673 /usr/lib/ X 26673 2 E 576 /bin/mv R 576 /etc/ R 576 /lib/ M 576 '' 'foo.h' X 576 0 X 3250 0 # Bye bye Most records follow the format: type pid data where type is one of the list below, and unless otherwise specified, data is a pathname. C chdir(2). D unlink(2). E exec(3). F fork(2), vfork(2); data is the process id of the child. L link(2), symlink(2); data is two pathnames. M rename(2); data is two pathnames. R open(2) for read or read-write. W open(2) for writing or read-write. X exit(3); data is the exit status. V indicates the version of filemon. FILES
/dev/filemon EXAMPLES
The following example demonstrates the basic usage of filemon: #include <filemon.h> pid_d pid; int fd, tfd; int status; filemon_fd = open("/dev/filemon", O_RDWR); temp_fd = mkstemp("/tmp/filemon.XXXXXXX"); /* give filemon the temp file to use */ ioctl(filemon_fd, FILEMON_SET_FD, &temp_fd); /* children do not need these once they exec */ fcntl(filemon_fd, F_SETFD, 1); fcntl(temp_fd, F_SETFD, 1); pid = fork(); switch(pid) { case -1: err(1, "cannot fork"); break; case 0: pid = getpid(); /* tell filemon to monitor this process */ ioctl(filemon_fd, FILEMON_SET_PID, &pid); execvp(...); _exit(1); break; default: status = wait(); close(filemon_fd); lseek(temp_fd, SEEK_SET, 0); /* read the captured syscalls from temp_fd */ close(temp_fd); break; } The output of filemon is intended to be simple to parse. It is possible to achieve almost equivalent results with dtrace(1) though on many systems this requires elevated privileges. Also, ktrace(1) can capture similar data, but records failed system calls as well as successful, and is thus more complex to post-process. HISTORY
filemon was contributed by Juniper Networks. BSD
September 29, 2011 BSD

Check Out this Related Man Page

SCRIPT(1)						    BSD General Commands Manual 						 SCRIPT(1)

script -- make typescript of terminal session SYNOPSIS
script [-adfkpqr] [-F pipe] [-t time] [file [command ...]] DESCRIPTION
The script utility makes a typescript of everything printed on your terminal. It is useful for students who need a hardcopy record of an interactive session as proof of an assignment, as the typescript file can be printed out later with lpr(1). If the argument file is given, script saves all dialogue in file. If no file name is given, the typescript is saved in the file typescript. If the argument command is given, script will run the specified command with an optional argument vector instead of an interactive shell. The following options are available: -a Append the output to file or typescript, retaining the prior contents. -d When playing back a session with the -p flag, do not sleep between records when playing back a timestamped session. -F pipe Immediately flush output after each write. This will allow a user to create a named pipe using mkfifo(1) and another user may watch the live session using a utility like cat(1). -f Create file.filemon or typescript.filemon using filemon(4). -k Log keys sent to the program as well as output. -p Play back a session recorded with the -r flag in real time. -q Run in quiet mode, omit the start, stop and command status messages. -r Record a session with input, output, and timestamping. -t time Specify the interval at which the script output file will be flushed to disk, in seconds. A value of 0 causes script to flush after every character I/O event. The default interval is 30 seconds. The script ends when the forked shell (or command) exits (a control-D to exit the Bourne shell (sh(1)), and exit, logout or control-D (if ignoreeof is not set) for the C-shell, csh(1)). Certain interactive commands, such as vi(1), create garbage in the typescript file. The script utility works best with commands that do not manipulate the screen. The results are meant to emulate a hardcopy terminal, not an addressable one. ENVIRONMENT
The following environment variables are utilized by script: SCRIPT The SCRIPT environment variable is added to the sub-shell. If SCRIPT already existed in the users environment, its value is overwrit- ten within the sub-shell. The value of SCRIPT is the name of the typescript file. SHELL If the variable SHELL exists, the shell forked by script will be that shell. If SHELL is not set, the Bourne shell is assumed. (Most shells set this variable automatically). SEE ALSO
csh(1), filemon(4) (for the history mechanism). HISTORY
The script command appeared in 3.0BSD. The -d, -p and -r options first appeared in NetBSD 2.0 and were ported to FreeBSD 9.2. BUGS
The script utility places everything in the log file, including linefeeds and backspaces. This is not what the naive user expects. It is not possible to specify a command without also naming the script file because of argument parsing compatibility issues. When running in -k mode, echo cancelling is far from ideal. The slave terminal mode is checked for ECHO mode to check when to avoid manual echo logging. This does not work when the terminal is in a raw mode where the program being run is doing manual echo. If script reads zero bytes from the terminal, it switches to a mode when it only attempts to read once a second until there is data to read. This prevents script from spinning on zero-byte reads, but might cause a 1-second delay in processing of user input. BSD
December 4, 2013 BSD
Man Page