aDriv4 - MANAGER

Edit File: killsnoop_example.txt

Demonstrations of killsnoop, the Linux bpftrace/eBPF version. This traces signals sent via the kill() syscall. For example: # ./killsnoop.bt Attaching 3 probes... Tracing kill() signals... Hit Ctrl-C to end. TIME PID COMM SIG TPID RESULT 00:09:37.345938 22485 bash 2 23856 0 00:09:40.838452 22485 bash 2 23856 -3 00:09:31.437104 22485 bash 15 23814 -3 The first line showed a SIGINT (2) sent from PID 22485 (a bash shell) to PID 23856. The result, 0, means success. The next line shows the same signal sent, which resulted in -3, a failure (likely because the target process no longer existed). There is another version of this tool in bcc: https://github.com/iovisor/bcc The bcc version provides command line options to customize the output.