opensnoop.bt(8)

📦 version 0.17.0, in debian bookworm

💅 opensnoop.bt — the tea ☕

okay bestie, so you know how this whole thing lives in section 8 of the System Manager's Manual? yeah. that's the vibe. let's get into it 🫶

✨ NAME ✨

opensnoop.bt — traces open() syscalls. and it does it with bpftrace/eBPF, which is lowkey iconic 💖

🦋 SYNOPSIS 🦋

opensnoop.bt

that's it. no flags, no args, no drama. she's a one-liner. periodt.

🌸 DESCRIPTION 🌸

so opensnoop traces the open() syscall and shows you which processes are trying to open which files. genuinely so useful, no cap — it's giving "where tf is my config file" energy, and it's also the move when an app is failing and you need to troubleshoot it. especially at startup, when everything is chaos and nothing tells you why 😭

the way it works: it traces the open() syscall tracepoint. that's the whole trick.

⚠️ okay so because this uses BPF, only the root user can use this tool. no root, no sniffs. sorry babe 💀

🎀 REQUIREMENTS 🎀

  • CONFIG_BPF
  • bcc

both. or nothing. 💅

🔥 EXAMPLES 🔥

trace all the open() syscalls, every single one, unbothered, moisturized:

# opensnoop.bt

👑 FIELDS 👑

here's what every column is serving, bestie:

  • PID — Process ID
  • TID — Thread ID
  • COMM — Process name
  • FD — File descriptor (if success), or -1 (if failed)
  • ERR — Error number (see the system's errno.h)
  • PATH — Open path

💜 OVERHEAD 💜

so this traces the open tracepoint and prints output for each event. the rate of these is generally expected to be low — like, < 1000/s low — so the overhead is also expected to be negligible. cute, right? 🌈

😬 but if you've got an application calling a high rate of open()s, then please test and understand the overhead before use. do not just yolo it. test first. i'm serious. fr fr.

🧚 SOURCE 🧚

this is from bpftrace 💖

also — look in the bpftrace distribution for a companion _examples.txt file, because it's got example usage, output, and commentary for this tool. very much worth the read, iykyk ✨

and! this is a bpftrace version of the bcc tool of the same name. the bcc tool may provide more options and customizations, so if you want the deluxe edition:

🌈 OS 🌈

Linux 🐧 (obviously)

💀 STABILITY 💀

Unstable - in development.

she's still growing, okay. be nice to her 🙈

⭐ AUTHOR ⭐

Brendan Gregg 👑

🍓 SEE ALSO 🍓

and that's the whole page, bestie!! this one came from the USER COMMANDS corner of the manual, dated 2018-09-08 — so yeah, a lil vintage, but she still slays. go trace something. responsibly. with root. 💅✨

📦 where this page comes from