bashreadline(8)

✨ bashreadline(8) — bashreadline 💖

Manual name: bashreadline — print entered bash commands system wide. Uses Linux eBPF/bcc. 🦋

💅 NAME

bestie, bashreadline prints every bash command that gets entered, system wide 🌸 It runs on Linux eBPF/bcc ✨

🎀 SYNOPSIS

bashreadline [-h] [-s SHARED]

🌈 DESCRIPTION

okay so bashreadline traces the return of the readline() function using uprobes 🔥 that means it shows the bash commands that were typed in interactively, system wide, no cap 💀

the entered command might fail, and that's totally fine. this is just showing what was entered, not whether it worked 🙈

this program is also a basic example of eBPF/bcc and uprobes, so it's giving teaching vibes 🧚

this makes use of a Linux 4.4 feature (bpf_perf_event_output()) ✨ for kernels older than 4.4, check the version under tools/old, which uses an older mechanism 🍓

since this uses BPF, only the root user can use this tool 👑 main character energy is not the vibe for regular users here 😭

🫶 REQUIREMENTS

you'll need CONFIG_BPF and bcc 💜

✨ OPTIONS ✨

• -h — print the usage message 🎀
• -s — specify the location of the libreadline.so shared library 🦋 use this when the script fails to run directly with the error: "Exception: could not determine address of symbol ´readline´". the default value is /lib/libreadline.so 💖

🍓 EXAMPLES

trace bash commands system wide:

# bashreadline

🔥 FIELDS

• TIME — time of the command, formatted as HH:MM:SS ⭐
• PID — process ID of the bash shell 🧚
• COMMAND — the entered command 💅

🌸 OVERHEAD

the rate of interactive bash commands is expected to be very low (<<100/s), so the overhead of this program is expected to be negligible 🫶 iykyk, it's basically nothing ✨

🦋 SOURCE

this is from bcc 💜

https://github.com/iovisor/bcc

also look in the bcc distribution for a companion _examples.txt file containing example usage, output, and commentary for this tool 🎀

🌈 OS

Linux 🐧

💀 STABILITY

Unstable - in development 🙈

👑 AUTHOR

Brendan Gregg 💖

🧚 SEE ALSO

• opensnoop(8) 💅

---

bestie, that's the whole page 🫶 this was a USER COMMANDS manual page, dated 2016-01-28, for bashreadline(8). periodt 💖✨