execsnoop tool

execsnoop

一 前言

execsnoop -- Short-term progress tracking tool,It is capable of grabbing commands that are executed instantaneously on the server,类似 history 但是execsnoop It is a real-time recording of the commands executed by the whole system.

When we run into performance issues,但是通过 vmstat,dstat,top Other tools cannot analyze the process that caused the problem,可以考虑使用 execsnoop .See if you can catch instantaneous command requests. The case mentioned above is 一例. 当机器 cpu 负载持续高涨却抓取不到 top 进程时,可以采用 execsnoop 抓取短时进程.

二 使用

execsnoop 的安装非常简单,其实它就是一个 可执行的 shell .

下载:

https://github.com/brendangregg/perf-tools/blob/master/execsnoop

安装 ,It is to download or copy the content of the file 写到 /usr/bin/execsnoop ,并执行 chmod +x /usr/bin/execsnoop

使用方法:

execsnoop 的参数

[[email protected] ~]# execsnoop -h
USAGE: execsnoop [-hrt] [-a argc] [-d secs] [name]
                 -d seconds      # trace duration, and use buffers
                 -a argc         # max args to show (default 8)
                 -r              # include re-execs
                 -t              # include time (seconds)
                 -h              # this usage message
                 name            # process name to match (REs allowed)
  eg,
       execsnoop                 # watch exec()s live (unbuffered)
       execsnoop -d 1            # trace 1 sec (buffered)
       execsnoop grep            # trace process names containing grep
       execsnoop 'udevd$'        # process names ending in "udevd"

For example, we want to crawl who visited mysql

[[email protected] ~]# execsnoop  mysql   ## mysql 是指 进程的name 
Tracing exec()s issued by process name "mysql". Ctrl-C to end.
Instrumenting sys_execve
   PID   PPID ARGS
 22632  22631 /data/sandboxes/mysql_binary/5.7.31/bin/mysql --defaults-file=/data/msb_5_7_31/my.sandbox.cnf
 22661  22660 /data/sandboxes/mysql_binary/5.7.31/bin/mysql --defaults-file=/data/msb_5_7_31/my.sandbox.cnf
 22700  22699 /data/sandboxes/mysql_binary/5.7.31/bin/mysql --defaults-file=/data/msb_5_7_31/my.sandbox.cnf -e select now();
^C
Ending tracing...

The tool can only grab commands for one-time execution,If it is a long connection such as throughtcp ip 连接,然后发送SQL The requested situation cannot be fetched.