mountsnoop(8)

📦 version 0.36.1, in centos-stream 10, centos-stream 9, fedora 43, fedora 44

🎀 mountsnoop(8) 🎀

mountsnoop ✨ is a tracing tool that sneaks a peek at the mount() and umount() syscalls. It's a Linux eBPF/bcc tool, so it's built on the good stuff. 💅

🌸 NAME 🌸

mountsnoop - Trace mount() and umount() syscalls. Uses Linux eBPF/bcc.

💖 SYNOPSIS 💖

mountsnoop

✨ DESCRIPTION ✨

okay so mountsnoop watches the mount() and umount() syscalls and shows you which processes are mounting and unmounting filesystems, and which mount namespaces they're doing it in. 🧚 This is seriously useful when you're troubleshooting system or container setup. 🫶

Under the hood, it works by tracing the kernel sys_mount() and sys_umount() functions using dynamic tracing. 🔍 The catch? If those functions ever change in the kernel, this tool will need updating to match. 🙈

It also makes use of a Linux 4.8 feature, bpf_get_current_task(), so your kernel needs to be at least that new. 💀

⚠️ Since this uses BPF, only the root user can use this tool. No cap, it's a root-only situation. 👑

🦋 REQUIREMENTS 🦋

You'll need CONFIG_BPF enabled in your kernel, plus bcc installed. 💜

🍓 FIELDS 🍓

Here's what shows up in the output:

  • COMM — the process name 🐣
  • PID — the process ID 🪪
  • TID — the thread ID 🧵
  • MNT_NS — the mount namespace inode number 🌈
  • CALL — the system call, its arguments, and its return value 📞

🌈 OVERHEAD 🌈

Okay, the vibe check on performance: mountsnoop traces the kernel mount and umount functions and prints output for every event. Since these calls are generally expected to happen at a very low rate, the overhead is also expected to be negligible. 😌

Lowkey though, if your system calls mount() and umount() at a high rate, you need to test and understand the overhead before you use it. 🚨

🔗 SOURCE 🔗

This one comes from bcc, the BPF Compiler Collection, which lives at:

https://github.com/iovisor/bcc

Also, go check the bcc distribution for a companion _examples.txt file. It has example usage, output, and commentary for this tool, and it's giving very helpful energy. 📚

🫧 OS 🫧

Linux only, bestie. 🐧

🧪 STABILITY 🧪

Unstable - in development. 🚧 Don't be shocked if things shift around.

👑 AUTHOR 👑

Written by Omar Sandoval. Iconic. 🙌

🔮 SEE ALSO 🔮

🌸 Bestie, that's the whole page. This is the USER COMMANDS section, last updated 2016-10-14, and it's a manual page for mountsnoop(8). Now go trace some mounts and be obsessed with it. 💅✨🦋

📦 where this page comes from