shmsnoop(8)

📦 version 0.36.1, in centos-stream 10, centos-stream 9, fedora 43, fedora 44

✨ shmsnoop(8) ✨

System Manager's Manual 💅 this is the page for shmsnoop, the tool that spies on your System V shared memory syscalls 👀

💖 NAME

shmsnoop - Trace System V shared memory syscalls. Uses Linux eBPF/bcc. ✨

🎀 SYNOPSIS

shmsnoop [-h] [-T] [-p] [-t] [-d DURATION] [-n NAME]

🦋 DESCRIPTION

okay so shmsnoop traces System V shared memory syscalls: shmget, shmat, shmdt, shmctl 🔥 it's literally watching every shm call go by

🔒 Since this uses BPF, only the root user can use this tool. Not you, not me, only root. Sorry bestie 🙈

🌸 REQUIREMENTS

you'll need CONFIG_BPF and bcc 🧚

👑 OPTIONS

  • -h — Shows the usage message. Your go-to when you forget what you're doing 💀
  • -T — Adds a timestamp column so you know exactly when things happened ⏰
  • -p PID — Only traces this process ID. It's filtered in-kernel, so it's fast and focused 🎯
  • -t TID — Only traces this thread ID. Same in-kernel filtering energy, just for a thread 🧵
  • -d DURATION — How long the trace runs, total, in seconds ⏳
  • -n NAME — Only prints command lines matching this command name. It's a regex, so get fancy with it 🌈

🍓 EXAMPLES

Trace all shm* syscalls:

# shmsnoop

Trace all shm* syscalls, and include timestamps:

# shmsnoop -T

Only trace shm* syscalls where the process contains "server":

# shmsnoop -n server

💜 FIELDS

  • TIME(s) — When the shm syscall returned, in seconds ⏱️
  • PID — Process ID 🪪
  • COMM — Process/command name 💅
  • RET — Return value of the shm syscall 🔥
  • ARGS — "arg: value" couples showing the syscall arguments, explained on their own manpage 🧠

🌈 SOURCE

this is from bcc 🫶

🔗 https://github.com/iovisor/bcc

also look in the bcc distribution for a companion _examples.txt file with example usage, output, and commentary for this tool. Lowkey essential reading ✨

🧚 OS

Linux 🐧

🙈 STABILITY

Unstable - in development. Still cooking, so expect some changes 🍳

🫶 AUTHOR

Jiri Olsa 👑

🦋 SEE ALSO

opensnoop(1) 🌸

ok bestie that's the whole page 💖 shmsnoop(8), USER COMMANDS, last updated 2018-09-24, bcc source. Go trace some shm calls and slay 😭✨

📦 where this page comes from