killsnoop.bt(8)

📦
version 0.27.0 · 5 versions
, in alpine 3.24, arch rolling, centos-stream 10, centos-stream 9, nixos 26.05, nixpkgs unstable, ubuntu resolute, ubuntu stonking

✨ killsnoop.bt — the manual page, but make it cute ✨

okay bestie, pull up a chair, we're reading the killsnoop.bt page from the System Manager's Manual together and it's gonna be a whole vibe 💖

🌸 NAME 🌸

killsnoop.bt — this lil icon traces signals issued by the kill(), tkill(), tgkill() syscall. and yes, it uses bpftrace/eBPF, no cap 🔥

🎀 SYNOPSIS 🎀

killsnoop.bt

that's it. that's the whole thing. she's low maintenance 💅

🦋 DESCRIPTION 🦋

so killsnoop traces the kill(), tkill(), tgkill() syscall, so you can actually see the signals getting sent this way. ngl this is lowkey perfect for troubleshooting failing applications when some unknown mechanism is out there sending signals and you're like "who?? who did this??" 😭

the way it works: it traces the kill(), tkill(), tgkill() syscall tracepoints. tracing, but make it ✨telepathic✨

since this uses BPF, only the root user can use this tool. root only, bestie. no sneaking in 🙈

🌈 REQUIREMENTS 🌈

  • CONFIG_BPF
  • bpftrace

both. you need both. that's the vibe check 💜

⭐ EXAMPLES ⭐

trace all the kill(), tkill(), tgkill() syscalls, every single one, main character energy:

# killsnoop.bt

👑 FIELDS 👑

here's what each column is giving, one by one, no skipping 🫶

  • TIME — time of the kill call. when it happened ⏰
  • PID — source process ID
  • COMM — source process name
  • SIG — signal number or name. see signal(7)
  • TPID — target process ID
  • RESULT — the result. 0 == success, and a negative value (of the error code) for failure. so if it's negative, something said no 💀

💀 OVERHEAD 💀

this traces the kernel kill function and prints output for every single event. and because the rate of this is generally expected to be low (< 100/s), the overhead is also expected to be negligible. obsessed with a low-overhead tool honestly 🍓

but listen — if you have an application that is calling a very high rate of kill()|tkill()|tgkill()s for some reason, then test and understand overhead before use. fr fr. test first, then send it. not the other way around 🙈

🧚 SOURCE 🧚

this is from bpftrace.

https://github.com/bpftrace/bpftrace

also look in the bpftrace distribution for a companion _examples.txt file containing example usage, output, and commentary for this tool. it's giving bonus content, we love her 💖

this is a bpftrace version of the bcc tool of the same name. the bcc tool may provide more options and customizations, iykyk 👑

https://github.com/iovisor/bcc

🌸 OS 🌸

Linux. (obviously, she's a kernel tool 💅)

⚠️ STABILITY ⚠️

Unstable — in development. she's still growing, be gentle 🎀

💜 AUTHOR 💜

Brendan Gregg, Rong Tao. absolute legends, we thank them for their service 🫶

🌟 SEE ALSO 🌟

okay that's the whole page, you ate that 🍽️✨

this beauty lives under USER COMMANDS, and she was dated 2018-09-07. go forth and trace some signals, bestie 💖🦋🎀

📦 where this page comes from