| Server IP : 216.250.13.251 / Your IP : 216.73.216.164 Web Server : nginx/1.24.0 System : Linux gunay 6.8.0-134-generic #134-Ubuntu SMP PREEMPT_DYNAMIC Fri Jun 26 18:43:11 UTC 2026 x86_64 User : root ( 0) PHP Version : 7.4.33 Disable Function : pcntl_alarm,pcntl_fork,pcntl_waitpid,pcntl_wait,pcntl_wifexited,pcntl_wifstopped,pcntl_wifsignaled,pcntl_wifcontinued,pcntl_wexitstatus,pcntl_wtermsig,pcntl_wstopsig,pcntl_signal,pcntl_signal_get_handler,pcntl_signal_dispatch,pcntl_get_last_error,pcntl_strerror,pcntl_sigprocmask,pcntl_sigwaitinfo,pcntl_sigtimedwait,pcntl_exec,pcntl_getpriority,pcntl_setpriority,pcntl_async_signals,pcntl_unshare, MySQL : OFF | cURL : ON | WGET : ON | Perl : ON | Python : OFF | Sudo : ON | Pkexec : OFF Directory : /usr/share/doc/bpfcc-tools/examples/doc/ |
Upload File : |
Demonstrations of killsnoop, the Linux eBPF/bcc version.
This traces signals sent via the kill() syscall. For example:
# ./killsnoop
TIME PID COMM SIG TPID RESULT
12:10:51 13967 bash 9 13885 0
12:11:34 13967 bash 9 1024 -3
12:11:41 815 systemd-udevd 15 14076 0
The first line showed a SIGKILL (9) sent from PID 13967 (a bash shell) to
PID 13885. The result, 0, means success.
The second line showed the same signal sent, this time resulting in a -3
(ESRCH: no such process).
USAGE message:
# ./killsnoop -h
usage: killsnoop [-h] [-x] [-p PID] [-T PID] [-s SIGNAL]
Trace signals issued by the kill() syscall
optional arguments:
-h, --help show this help message and exit
-x, --failed only show failed kill syscalls
-p PID, --pid PID trace this PID only which is the sender of signal
-T TPID, --tpid TPID trace this target PID only which is the receiver of
signal
-s SIGNAL, --signal SIGNAL
trace this signal only
examples:
./killsnoop # trace all kill() signals
./killsnoop -x # only show failed kills
./killsnoop -p 181 # only trace PID 181
./killsnoop -T 189 # only trace target PID 189
./killsnoop -s 9 # only trace signal 9