opensnoop(8)

✨ opensnoop(8) — System Manager's Manual ✨

Okay bestie, this is the manual page for opensnoop 🦋 Let's get into it.

✨ NAME ✨

opensnoop is a tool that traces the open() syscall, and it runs on Linux with eBPF/bcc 💜

🎀 SYNOPSIS 🎀

opensnoop [-h] [-T] [-U] [-x] [-p PID] [-t TID] [-u UID]
             [-d DURATION] [-n NAME] [-e] [-f FLAG_FILTER] [-F]
             [--cgroupmap MAPPATH] [--mntnsmap MAPPATH]

💖 DESCRIPTION 💖

okay so opensnoop traces the open() syscall and shows you which processes are trying to open which files 👀 It's honestly so useful for finding where config and log files live, or for figuring out why an app keeps failing, especially on startup 😭

Under the hood it traces the kernel sys_open() function using dynamic tracing. Heads up, it'll need updating if that function ever changes 💅

It uses a Linux 4.4 feature (bpf_perf_event_output()). If you're on a kernel older than 4.4, check out the version under tools/old, which uses an older mechanism 🙈

Since this uses BPF, only the root user can use this tool. No exceptions, periodt 👑

🧚 REQUIREMENTS 🧚

You'll need CONFIG_BPF and bcc ✨

🌸 OPTIONS 🌸

• -h — Prints the usage message 🫶
• -T — Adds a timestamp column ⏰
• -U — Shows the UID 🪪
• -x — Only prints failed opens 💀
• -p PID — Traces only this process ID, filtered in-kernel 🎯
• -t TID — Traces only this thread ID, filtered in-kernel 🧵
• -u UID — Traces only this UID, filtered in-kernel 👤
• -d DURATION — The total duration of the trace, in seconds ⏳
• -n name — Only prints processes whose name partially matches name 🔍
• -e — Shows the extended fields 🔥
• -f FLAG — Filters on open() flags, like O_WRONLY 🌈
• -F — Shows the full path for a file that was opened with a relative path 🗺️
• --cgroupmap MAPPATH — Traces only the cgroups in this BPF map, filtered in-kernel 🍓
• --mntnsmap MAPPATH — Traces only the mount namespaces in this BPF map, filtered in-kernel 🦋

💅 EXAMPLES 💅

# Trace all open() syscalls
opensnoop

# Trace all open() syscalls, but only for 10 seconds
opensnoop -d 10

# Trace all open() syscalls and include timestamps
opensnoop -T

# Show the UID
opensnoop -U

# Trace only the open() syscalls that failed
opensnoop -x

# Trace PID 181 only
opensnoop -p 181

# Trace UID 1000 only
opensnoop -u 1000

# Trace all open() syscalls from processes whose name partially
# matches 'ed'
opensnoop -n ed

# Show the extended fields
opensnoop -e

# Only print calls for writing
opensnoop -f O_WRONLY -f O_RDWR

# Trace a set of cgroups only (see special_filtering.md from the
# bcc sources for more details)
opensnoop --cgroupmap /sys/fs/bpf/test01

🧾 FIELDS 🧾

• TIME(s) — When the call happened, in seconds ⏱️
• UID — The User ID 🪪
• PID — The Process ID 🆔
• TID — The Thread ID 🧵
• COMM — The process name 🏷️
• FD — The file descriptor if it succeeded, or -1 if it failed 📂
• ERR — The error number (check the system's errno.h) 💀
• FLAGS — The flags passed to open(2), in octal 🔢
• PATH — The path that was opened 🛣️

🫧 OVERHEAD 🫧

This traces the kernel open function and prints output for each event. The rate is generally expected to be low (< 1000/s), so the overhead is also expected to be negligible 🥰

If you have an app that's calling a high rate of open()s, test it and understand the overhead before you use this 😭

🌐 SOURCE 🌐

This comes from bcc 🦋

https://github.com/iovisor/bcc

Also look in the bcc distribution for a companion _examples.txt file. It has example usage, output, and commentary for this tool 📚

💻 OS 💻

Linux 🐧

🚧 STABILITY 🚧

Unstable, it's still in development 🛠️

👑 AUTHOR 👑

Brendan Gregg and Rocky Xing 🫶

🔗 SEE ALSO 🔗

execsnoop(8), funccount(1) 💜

---

Bye bestie, that's the whole page 💖 Shoutout to bcc for the source, the 2020-02-20 USER COMMANDS version, and the opensnoop(8) manual section 🧚✨