SeeFlowerX / stackplz

基于eBPF的堆栈追踪工具
Apache License 2.0
927 stars 179 forks source link

[feature request] 按进程归属追踪目标 #18

Closed SeeFlowerX closed 1 year ago

SeeFlowerX commented 1 year ago

比如想监控某个路径下的文件到底是谁创建的,那么需要给定一个较大的范围

预计划分如下:

SeeFlowerX commented 1 year ago

实际上这些可以指定uid实现,其中isolated已经有单独选项实现了,也就是再加一个app(10000<=uid<=19999)的选项即可

SeeFlowerX commented 1 year ago

已实现,见 https://github.com/SeeFlowerX/stackplz/commit/57c07f93b7f99a4fe887a9e1c8aeacdc589bac1d

./stackplz -n app --no-uid 10084 --point open[str,int] -o tmp.log

同时支持了syscall分组批量追踪

./stackplz -n com.xingin.xhs -s %file,%net --no-syscall openat,recvfrom