5.44 BCC工具之killsnoop.py解读

一，工具简介

工具用于追踪通过 kill() 系统调用发送的信号，并实时报告相关信息。

二，代码示例

#!/usr/bin/env pythonfrom __future__ import print_function
from bcc import BPF
from bcc.utils import ArgString, printb
import argparse
from time import strftime# 参数
examples = """examples:./killsnoop           # trace all kill() signals./killsnoop -x        # only show failed kills./killsnoop -p 181    # only trace PID 181./killsnoop -T 189    # only trace target PID 189./killsnoop -s 9      # only trace signal 9
"""
parser = argparse.ArgumentParser(description="Trace signals issued by the kill() syscall",formatter_class=argparse.RawDescriptionHelpFormatter,epilog=examples)
parser.add_argument("-x", "--failed", action="store_true",help="only show failed kill syscalls")
parser.add_argument("-p", "--pid",help="t