killsnoop(8)

🎀 NAME 🎀

Okay bestie, meet killsnoop(8) from the System Manager's Manual 💅. It traces signals sent with the kill() syscall, and it runs on Linux using eBPF/bcc ✨.

🦋 SYNOPSIS 🦋

killsnoop [-h] [-x] [-p PID] [-T PID] [-s SIGNAL]

💖 DESCRIPTION 💖

So killsnoop watches the kill() syscall and shows you every signal that gets sent that way 👀. This is lowkey perfect when an app is failing and you have no clue what's sending it signals 😭.

It works by tracing the kernel sys_kill() function with dynamic tracing. Because of that, it'll need updating whenever that function changes 🛠️.

It uses a Linux 4.4 feature, bpf_perf_event_output(). If your kernel is older than 4.4, check out the version under tools/old, which uses an older mechanism 🌸.

Also, since this runs on BPF, only the root user can use this tool 🔥. No cap.

🌈 REQUIREMENTS 🌈

You need CONFIG_BPF and bcc ✨.

✨ OPTIONS ✨

• -h — Shows the usage message 💜.
• -x — Only shows kill() syscalls that failed 💀.
• -p PID — Only traces this process ID, the one sending the signal. It gets filtered in-kernel 🧚.
• -T PID — Only traces this target process ID, the one receiving the signal. It also gets filtered in-kernel 🎯.
• -s SIGNAL — Only traces this signal. It gets filtered in-kernel too 🍓.

🫶 EXAMPLES 🫶

Trace all kill() syscalls:

# killsnoop

Trace only the kill() syscalls that failed:

# killsnoop -x

Trace PID 181 only:

# killsnoop -p 181

Trace target PID 189 only:

# killsnoop -T 189

Trace signal 9 only:

# killsnoop -s 9

🧚 FIELDS 🧚

• TIME — When the kill call happened ⏰.
• PID — The source process ID 🪪.
• COMM — The source process name 📛.
• SIG — The signal number. Check out signal(7) for the details 📖.
• TPID — The target process ID 🎯.
• RES — The result. 0 means success. A negative value (the error code) means it failed 💔.

⏳ OVERHEAD ⏳

This traces the kernel kill function and prints output for every event. The rate is usually expected to be low (< 100/s), so the overhead should be negligible 🌷. But if your app is calling kill() at a super high rate for some reason, test and understand the overhead before you use it 😬.

🌐 SOURCE 🌐

This comes from bcc 💜. Source: https://github.com/iovisor/bcc

Also look in the bcc distribution for a companion _examples.txt file. It has example usage, output, and commentary for this tool 📚.

💻 OS 💻

Linux 🐧.

🧪 STABILITY 🧪

Unstable, still in development 🚧.

👑 AUTHOR 👑

Brendan Gregg, the legend himself 🙌.

🔗 SEE ALSO 🔗

opensnoop(8), funccount(8) 🫶.

---

Okay that's the tea, bestie 💅🎀. This page is from the USER COMMANDS section and was last updated on 2015-08-20 🌸. Stay iconic and keep tracing those signals 🦋✨.