killsnoop.bt(8)

📦 version 0.17.0, in debian bookworm

💅 killsnoop.bt — the tea ☕

okay bestie, listen. killsnoop.bt lives in section 8 of the system manager's manual, and it's about to become your new fave. it traces the signals that get sent through the kill() syscall, using bpftrace/eBPF. no cap. ✨

🌸 NAME 🌸

killsnoop.bt — trace signals issued by the kill() syscall. uses bpftrace/eBPF. periodt. 💖

🎀 SYNOPSIS 🎀

killsnoop.bt

that's it. that's the whole vibe. she takes no arguments, she just goes. 👑

✨ DESCRIPTION ✨

so killsnoop traces the kill() syscall, and it shows you the signals that get sent this way. why do you care? because sometimes an app is just out here failing for no apparent reason, and some unknown mechanism is out there sending signals like it's a secret admirer. this tool exposes them. 🕵️♀️💅

the way it works: it traces the kill() syscall tracepoints. that's the whole trick.

🚨 real talk: since this uses BPF, only the root user can use this tool. not a suggestion, that's just the rules. 🔒

🦋 REQUIREMENTS 🦋

  • CONFIG_BPF
  • bpftrace

that's the list. go get 'em. 🫶

🌈 EXAMPLES 🌈

trace all kill() syscalls:

# killsnoop.bt

iconic. one line. she ate. 🔥

🍓 FIELDS 🍓

here's what every column means, bestie, so you're not out here squinting:

  • TIME — time of the kill call. ⏰
  • PID — source process ID (who's doing the killing 👀)
  • COMM — source process name
  • SIG — signal number. see signal(7) for the lore.
  • TPID — target process ID (who's getting got)
  • RES — the result. 0 == success 🎉, a negative value (of the error code) for failure 😭

💜 OVERHEAD 💜

so this traces the kernel kill function and prints output for each and every event. normally the rate of this is expected to be low (< 100/s), so the overhead is also expected to be negligible. she's lightweight, she's chill. 🧚

BUT. if you've got an application that's calling a very high rate of kill()s for some reason (ma'am, why), then test and understand overhead before use. do not just rawdog it into production. 🙈

⭐ SOURCE ⭐

this is from bpftrace.

https://github.com/iovisor/bpftrace

also, go look in the bpftrace distribution for a companion _examples.txt file — it's got example usage, output, and commentary for this tool. basically the director's cut. 🎬

this is a bpftrace version of the bcc tool of the same name. heads up: the bcc tool may provide more options and customizations, so if you want extra toppings, check that one out too.

https://github.com/iovisor/bcc

👑 OS 👑

Linux — that's the one. 🐧

💀 STABILITY 💀

Unstable — in development. she's a work in progress and we love her for it. 🚧

🌸 AUTHOR 🌸

Brendan Gregg — the blueprint, the moment, the legend. 🫶

🔥 SEE ALSO 🔥

okay that's the whole page!! 💖 this one was brought to you by the USER COMMANDS section, dated 2018-09-07, filed under killsnoop.bt(8) — go forth and trace those signals, bestie. slay. ✨🎀🦋

📦 where this page comes from