killsnoop(8)

✨ killsnoop(8) ✨

okay bestie, welcome to killsnoop from the System Manager's Manual — she traces kill() syscalls and gives you the process AND signal deets, using Linux ftrace. it's giving detective energy fr fr 🔍💅

---

🌸 SYNOPSIS 🌸

killsnoop [-hst] [-d secs] [-p pid] [-n name]

---

💖 DESCRIPTION 💖

so basically, this traces kill() syscalls. it shows you which process killed which pid, and it hands you the returncode too — that's 0 for success, -1 for error. slay.

this implementation was built to work on older kernel versions and without kernel debuginfo. the way it does it: dynamic tracing of the return value of kill(), then associating that with the previous kill() syscall return. ngl, this approach is kernel version specific and may not work on your version 😭. it's a workaround, and a proof of concept for ftrace, until more kernel tracing functionality is available. periodt.

since this uses ftrace, only the root user can use this tool. no root, no vibes. 💀

---

🎀 REQUIREMENTS 🎀

• FTRACE and KPROBE CONFIG
• the kernel tracepoints syscalls:sys_enter_kill and syscalls:sys_exit_kill (you may already have these on recent kernels, lucky you ✨)
• and awk

---

💅 OPTIONS 💅

• -d secs — set how long you wanna trace, in seconds. trace output gets buffered and printed at the end. this also reduces overheads by buffering in-kernel instead of printing events as they occur. iconic efficiency behavior.

the ftrace buffer has a fixed size per-CPU (see /sys/kernel/debug/tracing/buffer_size_kb). if you think events are missing, try increasing that size. don't let the buffer ghost you 👻

• -h — print the usage message. that's it, that's the whole job 🫶
• -n name — only show processes matching this process name. partial strings and regular expressions are allowed. this one is post-filtered using awk.
• -p PID — only trace this process ID. this is filtered in-kernel (fancy!).
• -s — use human readable signal names instead of signal numbers. because SIGKILL just hits different than 9 💅
• -t — include timestamps, in seconds. ⏰

---

🌈 EXAMPLES 🌈

trace all kill() syscalls with details:

# killsnoop

trace kill() syscalls with readable signal names, and times:

# killsnoop -st

track kill() syscalls for processes named "httpd":

# killsnoop -n httpd

---

🦋 FIELDS 🦋

• TIMEs — time of open() completion, in units of seconds.
• COMM — process name (if known) of the process that issued the signal.
• PID — process ID that issued the signal.
• TPID — target PID for the signal.
• SIGNAL — signal number sent to the target process, or name if -s is used.
• RETURN — return status: 0 for success, -1 for failure.

---

🔥 OVERHEAD 🔥

this reads kill() syscalls as they occur. for high rates of kills (> 500/s), the overhead may begin to be measurable — however, the rate is unlikely to get this high. and if it is: you should investigate why 👀. test yourself. you can also use the -d mode to buffer output, reducing overheads.

---

⭐ SOURCE ⭐

this is from the perf-tools collection.

https://github.com/brendangregg/perf-tools

also look under the examples directory for a text file containing example usage, output, and commentary for this tool. iykyk 🎀

---

💜 OS 💜

Linux 🐧

---

👑 STABILITY 👑

Unstable - in development. (she's growing, okay?! main character development arc ✨)

---

🌸 AUTHOR 🌸

Martin Probst

---

🫶 SEE ALSO 🫶

tpoint(8), execsnoop(8), opensnoop(8)

---

okay that's the whole page bestie, no cap 💖 this one's from USER COMMANDS, dated 2014-09-15, and it's the killsnoop(8) era — go forth and trace those signals, you absolute icon 🦋✨