bashreadline.bt(8)

📦
version 0.27.0 · 3 versions
  • 0.27.0 · alpine 3.24, arch rolling, centos-stream 10, centos-stream 9, debian trixie, fedora 43, fedora 44, nixos 26.05, nixpkgs unstable, opensuse-leap 16.0, ubuntu questing, ubuntu resolute, ubuntu stonking (latest)
  • 0.14.0 · ubuntu jammy
  • 0.20.2 · ubuntu noble
, in alpine 3.24, arch rolling, centos-stream 10, centos-stream 9, debian trixie, fedora 43, fedora 44, nixos 26.05, nixpkgs unstable, opensuse-leap 16.0, ubuntu questing, ubuntu resolute, ubuntu stonking

💖 bashreadline.bt(8) 💖

✨ NAME ✨

bashreadline.bt, okay so this one prints bash commands system wide 🌈 It runs on bpftrace/eBPF 🦋

🎀 SYNOPSIS 🎀

bashreadline.bt

📖 DESCRIPTION 📖

okay so bashreadline traces the return of the readline() function using uretprobes ✨ which means it shows you every bash command that somebody typed in interactively, across the whole system 💅 The command might fail, and that's totally fine bestie, because this tool is just showing what got entered 🙈

This program is also a basic example of bpftrace and uretprobes, so it's kind of a starter pack 🧚

Since this uses BPF, only the root user can use this tool 🔥 (no cap, you need root for this one)

💜 REQUIREMENTS 💜

You need CONFIG_BPF and bpftrace ✨

🍓 EXAMPLES 🍓

Trace bash commands system wide:

# bashreadline.bt

👑 FIELDS 👑

  • TIME — a timestamp on the output, in "HH:MM:SS" format ⭐
  • PID — the process ID for bash 🦋
  • COMMAND — the entered command 💅

🌸 OVERHEAD 🌸

The rate of interactive bash commands is expected to be very low (<<100/s), so the overhead of this program is expected to be negligible 🫶 literally not a big deal

🔥 SOURCE 🔥

This is from bpftrace 💖

https://github.com/bpftrace/bpftrace

Also look in the bpftrace distribution for a companion _examples.txt file containing example usage, output, and commentary for this tool 📚

This is a bpftrace version of the bcc tool of the same name ✨ The bcc tool may provide more options and customizations 💅

https://github.com/iovisor/bcc

🌈 OS 🌈

Linux 🐧

🙈 STABILITY 🙈

Unstable, it's still in development, so be gentle with it 🥺

🧚 AUTHOR 🧚

Brendan Gregg 👑

🦋 SEE ALSO 🦋

opensnoop.bt(8) 💜

Byeee bestie, this was the bashreadline.bt(8) page from the USER COMMANDS section, dated 2018-09-06 🎀💖✨

📦 where this page comes from