#!/usr/bin/sh
 #
 # execsnoop - snoop process execution as it occurs.
 #             Written using DTrace (Solaris 10 3/05).
 #
 # $Id: execsnoop 3 2007-08-01 10:50:08Z brendan $
 #
 # USAGE:	execsnoop [-a|-A|-ehjsvZ] [-c command]
 #
 #		execsnoop	# default output
 #
 #		-a		# print all data
 #		-A		# dump all data, space delimited
 #		-e		# safe output - parseable
 #		-j		# print project ID
 #		-s		# print start time, us
 #		-v		# print start time, string
 #		-Z		# print zonename
 #		-c command	# command name to snoop
 #	eg,
 #		execsnoop -v		# human readable timestamps
 #		execsnoop -Z		# print zonename
 #		execsnoop -c ls		# snoop ls commands only
 #
 # The parseable output ensures that the ARGS field doesn't contain
 # any "\n"s, which normally sometimes can - and would wreck postprocessing.
 #
 # FIELDS:
 #		UID		User ID
 #		PID		Process ID
 #		PPID		Parent Process ID
 #		COMM		command name for the process
 #		ARGS		argument listing for the process
 #		ZONE		zonename
 #		PROJ		project ID
 #		TIME		timestamp for the command, us
 #		STRTIME		timestamp for the command, string
 #
 # SEE ALSO: BSM auditing.
 #
 # COPYRIGHT: Copyright (c) 2005 Brendan Gregg.
 #
 # CDDL HEADER START
 #
 #  The contents of this file are subject to the terms of the
 #  Common Development and Distribution License, Version 1.0 only
 #  (the "License").  You may not use this file except in compliance
 #  with the License.
 #
 #  You can obtain a copy of the license at Docs/cddl1.txt
 #  or http://www.opensolaris.org/os/licensing.
 #  See the License for the specific language governing permissions
 #  and limitations under the License.
 #
 # CDDL HEADER END
 #
 # Author: Brendan Gregg  [Sydney, Australia]
 #
 # 27-Mar-2004	Brendan Gregg	Created this.
 # 21-Jan-2005	   "	  "	Wrapped in sh to provide options.
 # 08-May-2005 	   "      "	Rewritten for performance.
 # 14-May-2005 	   "      "	Added zonename.
 # 02-Jul-2005 	   "      "	Added projid, safe printing.
 # 11-Sep-2005	   "      "	Increased switchrate.
 # 11-Sep-2005	   "      "	Last update.
 # 
 
 
 ##############################
 # --- Process Arguments ---
 #
 
 ### default variables
 opt_dump=0; opt_cmd=0; opt_time=0; opt_timestr=0; filter=0; command=.
 opt_zone=0; opt_safe=0; opt_proj=0
 
 ### process options
 while getopts aAc:ehjsvZ name
 do
 	case $name in
 	a)	opt_time=1; opt_timestr=1; opt_zone=1; opt_proj=1 ;;
 	A)	opt_dump=1 ;;
 	c)	opt_cmd=1; command=$OPTARG ;;
 	e)	opt_safe=1 ;;
 	j)	opt_proj=1 ;;
 	s)	opt_time=1 ;;
 	v)	opt_timestr=1 ;;
 	Z)	opt_zone=1 ;;
 	h|?)	cat <<-END >&2
 		USAGE: execsnoop [-a|-A|-ehjsvZ] [-c command]
 		       execsnoop                # default output
 		                -a              # print all data
 		                -A              # dump all data, space delimited
 		                -e              # safe output, parseable
 		                -j              # print project ID
 		                -s              # print start time, us
 		                -v              # print start time, string
 		                -Z              # print zonename
 		                -c command      # command name to snoop
 		  eg,
 		        execsnoop -v            # human readable timestamps
 		        execsnoop -Z		# print zonename
 		        execsnoop -c ls         # snoop ls commands only
 		END
 		exit 1
 	esac
 done
 
 ### option logic
 if [ $opt_dump -eq 1 ]; then
 	opt_time=0; opt_timestr=0; opt_zone=0; opt_proj=0
 fi
 if [ $opt_cmd -eq 1 ]; then
 	filter=1
 fi
 
 
 #################################
 # --- Main Program, DTrace ---
 #
 /usr/sbin/dtrace -n '
  /*
   * Command line arguments
   */
  inline int OPT_dump 	= '$opt_dump';
  inline int OPT_cmd 	= '$opt_cmd';
  inline int OPT_time 	= '$opt_time';
  inline int OPT_timestr	= '$opt_timestr';
  inline int OPT_zone 	= '$opt_zone';
  inline int OPT_safe 	= '$opt_safe';
  inline int OPT_proj 	= '$opt_proj';
  inline int FILTER 	= '$filter';
  inline string COMMAND 	= "'$command'";
  
  #pragma D option quiet
  #pragma D option switchrate=10hz
  
  /*
   * Print header
   */
  dtrace:::BEGIN 
  {
 	/* print optional headers */
  	OPT_time    ? printf("%-14s ", "TIME") : 1;
  	OPT_timestr ? printf("%-20s ", "STRTIME") : 1;
  	OPT_zone    ? printf("%-10s ", "ZONE") : 1;
  	OPT_proj    ? printf("%5s ", "PROJ") : 1;
 
 	/* print main headers */
 	OPT_dump    ? printf("%s %s %s %s %s %s %s %s\n",
 	    "TIME", "ZONE", "PROJ", "UID", "PID", "PPID", "COMM", "ARGS") :
 	    printf("%5s %6s %6s %s\n", "UID", "PID", "PPID", "ARGS");
  }
 
  /*
   * Print exec event
   */
  syscall::exec:return, syscall::exece:return
  /(FILTER == 0) || (OPT_cmd == 1 && COMMAND == execname)/ 
  {
 	/* print optional fields */
  	OPT_time ? printf("%-14d ", timestamp/1000) : 1;
 	OPT_timestr ? printf("%-20Y ", walltimestamp) : 1;
  	OPT_zone ? printf("%-10s ", zonename) : 1;
  	OPT_proj ? printf("%5d ", curpsinfo->pr_projid) : 1;
 
 	/* print main data */
 	OPT_dump ? printf("%d %s %d %d %d %d %s ", timestamp/1000,
 	    zonename, curpsinfo->pr_projid, uid, pid, ppid, execname) :
 	    printf("%5d %6d %6d ", uid, pid, ppid);
 	OPT_safe ? printf("%S\n", curpsinfo->pr_psargs) :
 	    printf("%s\n", curpsinfo->pr_psargs);
  }
 '