bashreadline(8)

📦
version 0.36.1 · 2 versions
, in alpine 3.24, nixpkgs unstable

💅 bashreadline(8) — from the System Manager's Manual, but make it cute

okay so bestie, you know how you literally type stuff into bash all day and never think about it? this little tool is the one watching. it's bashreadline, and it lives in section 8 of the manual. welcome to the group chat 🎀

✨ NAME ✨

bashreadline — print entered bash commands system wide. uses Linux eBPF/bcc. no cap, that's the whole vibe.

🦋 SYNOPSIS 🦋

bashreadline [-h] [-s SHARED]

like, that's it. two flags. she's low maintenance 💅

🌸 DESCRIPTION 🌸

so here's the tea: bashreadline traces the return of the readline() function using uprobes, and shows you the bash commands that were entered interactively — system wide. every shell on the box, all at once. iconic behavior honestly.

⭐ important little caveat bestie: the entered command may fail. this tool isn't checking whether anything worked. it's just showing you what was entered. that's it. no judgment. 🙈

this program is also a basic example of eBPF/bcc and uprobes — so like, it's both a tool and a little tutorial moment. main character energy fr fr.

it makes use of a Linux 4.4 feature (bpf_perf_event_output()). for kernels older than 4.4, please go look at the version under tools/old, which uses an older mechanism. she's retro 💜

🫶 also, since this uses BPF, only the root user can use this tool. that's not a suggestion, that's the rules.

🧚 REQUIREMENTS 🧚

  • CONFIG_BPF
  • bcc

that's the checklist. go get 'em. ✨

🎀 OPTIONS 🎀

  • -h — print usage message. the "help me help you" flag.
  • -s — specify the location of the libreadline.so shared library, for when you failed to run the script directly and got this exact error: "Exception: could not determine address of symbol ´readline´". the default value is /lib/libreadline.so. so if she can't find her friend, you point her at it. 🦋

🔥 EXAMPLES 🔥

trace bash commands system wide:

# bashreadline

just like that. chef's kiss. 👑

🌈 FIELDS 🌈

  • TIME — time of the command (HH:MM:SS).
  • PID — process ID of the bash shell.
  • COMMAND — entered command.

three little columns of pure information. we stan a clean output 💖

⭐ OVERHEAD ⭐

as the rate of interactive bash commands is expected to be very low (<<100/s), the overhead of this program is expected to be negligible.

translation: she barely takes up any room. the vibe check passes. ✅

💜 SOURCE 💜

this is from bcc.

https://github.com/iovisor/bcc

also look in the bcc distribution for a companion _examples.txt file containing example usage, output, and commentary for this tool. it's like the director's commentary track, but for eBPF 🍓

🧚 OS 🧚

Linux. obviously. 💅

😭 STABILITY 😭

Unstable - in development.

she's still growing into herself. be patient. be kind. 🫶

👑 AUTHOR 👑

Brendan Gregg

legend behavior, honestly.

💀 SEE ALSO 💀

opensnoop(8)

go give her a look too, she's also serving ✨

💖 cute little sign-off: this page is filed under USER COMMANDS and dated 2016-01-28, and yes the whole thing is still called bashreadline(8) — periodt. 🌸
📦 where this page comes from