| Brendan Gregg | aa87997 | 2016-01-28 22:43:37 -0800 | [diff] [blame] | 1 | .TH bashreadline 8 "2016-01-28" "USER COMMANDS" |
| 2 | .SH NAME |
| 3 | bashreadline \- Print entered bash commands system wide. Uses Linux eBPF/bcc. |
| 4 | .SH SYNOPSIS |
| JayceCao | b26e26b | 2019-02-18 14:55:12 +0800 | [diff] [blame] | 5 | .B bashreadline [\-h] [\-s SHARED] |
| Brendan Gregg | aa87997 | 2016-01-28 22:43:37 -0800 | [diff] [blame] | 6 | .SH DESCRIPTION |
| 7 | bashreadline traces the return of the readline() function using uprobes, to |
| 8 | show the bash commands that were entered interactively, system wide. The |
| 9 | entered command may fail: this is just showing what was entered. |
| 10 | |
| 11 | This program is also a basic example of eBPF/bcc and uprobes. |
| 12 | |
| Paul Chaignon | 4f0a887 | 2019-12-27 19:24:49 +0100 | [diff] [blame] | 13 | This makes use of a Linux 4.4 feature (bpf_perf_event_output()); |
| 14 | for kernels older than 4.4, see the version under tools/old, |
| mcaleavya | cbe10b5 | 2016-02-12 20:10:59 +0000 | [diff] [blame] | 15 | which uses an older mechanism |
| 16 | |
| Brendan Gregg | aa87997 | 2016-01-28 22:43:37 -0800 | [diff] [blame] | 17 | Since this uses BPF, only the root user can use this tool. |
| 18 | .SH REQUIREMENTS |
| 19 | CONFIG_BPF and bcc. |
| JayceCao | b26e26b | 2019-02-18 14:55:12 +0800 | [diff] [blame] | 20 | .SH OPTIONS |
| 21 | .TP |
| 22 | \-h |
| 23 | Print usage message. |
| 24 | .TP |
| 25 | \-s |
| 26 | Specify the location of libreadline.so shared library when you failed to run the |
| 27 | script directly with error: "Exception: could not determine address of symbol |
| 28 | \'readline\'". Default value is /lib/libreadline.so. |
| Brendan Gregg | aa87997 | 2016-01-28 22:43:37 -0800 | [diff] [blame] | 29 | .SH EXAMPLES |
| 30 | .TP |
| 31 | Trace bash commands system wide: |
| 32 | # |
| 33 | .B bashreadline |
| 34 | .SH FIELDS |
| 35 | .TP |
| 36 | TIME |
| 37 | Time of the command (HH:MM:SS). |
| 38 | .TP |
| 39 | PID |
| 40 | Process ID of the bash shell. |
| 41 | .TP |
| 42 | COMMAND |
| 43 | Entered command. |
| 44 | .SH OVERHEAD |
| 45 | As the rate of interactive bash commands is expected to be very low (<<100/s), |
| 46 | the overhead of this program is expected to be negligible. |
| 47 | .SH SOURCE |
| 48 | This is from bcc. |
| 49 | .IP |
| 50 | https://github.com/iovisor/bcc |
| 51 | .PP |
| 52 | Also look in the bcc distribution for a companion _examples.txt file containing |
| 53 | example usage, output, and commentary for this tool. |
| 54 | .SH OS |
| 55 | Linux |
| 56 | .SH STABILITY |
| 57 | Unstable - in development. |
| 58 | .SH AUTHOR |
| 59 | Brendan Gregg |
| 60 | .SH SEE ALSO |
| 61 | opensnoop(8) |
