exitsnoop(8)

💖 exitsnoop(8) ✨ System Manager's Manual ✨

NAME 🎀

exitsnoop - Trace all process termination (exit, fatal signal). Uses Linux eBPF/bcc. okay so this is the tool that tells you every time a process dies, bestie 💀✨

✨ SYNOPSIS ✨

exitsnoop [-h] [-t] [--utc] [-x] [-p PID] [--label LABEL] [--per-thread]

🌸 DESCRIPTION 🌸

okay so exitsnoop traces process termination, showing the command name and the reason it ended, either a normal exit or a fatal signal 💅

It catches processes of all users 👑, processes running in containers 📦, and processes that become zombie 🧟 (iconic, honestly).

This works by tracing the kernel sched_process_exit() function using dynamic tracing, and it will need updating to match any changes to this function 🔧 so keep an eye on that one, bestie.

⚠️ Since this uses BPF, only the root user can use this tool. no cap, not for you, not for me 🙈

🧚 REQUIREMENTS 🧚

You need CONFIG_BPF and bcc. that's the whole vibe 🫶

💜 OPTIONS 💜

• -h — the lowkey usage message, printed for you 📖
• -t — adds a timestamp column ⏰
• --utc — adds a timestamp column too, but it uses the UTC timezone 🌍
• -x — excludes successful exits, so exit( 0 ) gets filtered out 🚫
• -p PID — traces this process ID only (filtered in-kernel) 🎯
• --label LABEL — labels each line with LABEL in the first column (second if timestamp is there). the default is 'exit' 🏷️
• --per-thread — traces per thread termination 🧵

🎀 EXAMPLES 🎀

Trace all process termination:

# exitsnoop

Trace all process termination, and include timestamps:

# exitsnoop -t

Exclude successful exits, only include non-zero exit codes and fatal signals:

# exitsnoop -x

Trace PID 181 only:

# exitsnoop -p 181

Label each output line with 'EXIT':

# exitsnoop --label EXIT

Trace per thread termination:

# exitsnoop --per-thread

🦋 FIELDS 🦋

• TIME-TZ — time of process termination as HH:MM:SS.sss with milliseconds, where TZ is the local time zone (or UTC with the --utc option) ⏱️
• LABEL — the optional label if the --label option is used. this is super useful with -t timestamps when the output of several tracing tools gets sorted into one combined output 🫧
• PCOMM — process/command name 🐣
• PID — process ID 🔢
• PPID — the process ID of the process that will be notified of the PID termination 👀
• TID — thread ID 🧵
• EXIT_CODE — the exit code for exit(), or the signal number for a fatal signal 🚦

🌈 OVERHEAD 🌈

This traces the kernel sched_process_exit() function and prints output for each event. As the rate of this is generally expected to be low (< 1000/s), the overhead is also expected to be negligible. If you have an application with a high rate of process termination, then test and understand the overhead before using it 🧐 be careful, bestie.

🍓 SOURCE 🍓

This is from bcc. 🐝

https://github.com/iovisor/bcc

Also look in the bcc distribution for a companion _examples.txt file containing example usage, output, and commentary for this tool 📚 very helpful, highkey.

🌙 OS 🌙

Linux 🐧

🧪 STABILITY 🧪

Unstable - in development. it's still cooking 🍳

👑 AUTHOR 👑

Arturo Martin-de-Nicolas 🫶

💅 SEE ALSO 💅

execsnoop(8) 🔗

---

ok bestie, that's the whole tea ☕💖 this page came from bcc, check the _examples.txt for more, and it's a USER COMMANDS page dated 2019-05-28, the manual page for exitsnoop(8) 🎀✨ periodt 💅🦋