Ever had to strace a process, and got all this information, and honestly, did not need half of it?
What if you want to see which files the process opens?
How about what does the script execute? And what's the environment, like cwd(current working directory), and other variables which may change the results of the output?
Or, did you want to see how your memory is mapped and utilized during that process?
I've written a script, that does all of the above. I've tried not to miss anything, but I may have, and if I have, please let me know.
Here is the script:
Code:[root@hsvz41.dal.tektonic.net ~]# cat stracereader #!/bin/bash #strace decoder/reader. Written by: Greg Borbonus echo -e "\t\t\tStrace Processor" echo -e "\t This utility will help you to see exactly what a process is doing" echo -e "" echo -e "" echo -e "File processed by this reader should have been run with the following format:" echo -e "strace -Ffvs 4096 -o /path/to/output/file COMMAND" echo -e "" echo -e "" if [ -z $1 ];then echo -n "Which strace file would you like to view?" read file; else echo file=$1 fi echo -e "OPTIONS:" echo -e "\t1\tShow which files were Opened" echo -e "\t2\tShow what was executed with environment" echo -e "\t3\tShow Memory Mapping and protection" echo -e "\t4\tSHOW Environment at time of execution" echo -ne "\nPlease select your option: " read option case $option in 1) echo -e "File\t\t\t\t\t\t\tSTATUS\t\t\t\t\tHANDLE\n\n" grep 'open(' $file \ |cut -d'(' -f2\ |sed -e s/'"'//g\ |sed -e s/')'//g\ |sed -e s/'='/'\,'/g\ |awk -F',' '{ length1=7-(int(length($1)/8)) ; for (i=0;i<length1;i++){ tab=tab"\t" } length2=5-(int(length($2)/8)); for (t=0;t<length2;t++){ tab2=tab2"\t" } print $1 tab $2 tab2 $3; tab=""; tab2=""; }' ;; 2) #execs #Grab all execve, and Environments for i in `grep 'execve' $file \ |grep -v 'resumed'\ |cut -d'(' -f2\ |sed -e s/'\],'/"\n"/g\ |sed -e s/' '/':::'/g`; do chk=`echo $i|grep 'HOSTNAME'`; if [ -z $chk ]; then echo Command:; echo -e $i\ |sed -e s/':::'//g\ |sed -e s/',\['/"\n\t"/g\ |sed -e s/'"'//g\ |sed -e s/','/' '/g; else echo ENVIRONMENT: echo $i\ |cut -d[ -f2\ |cut -d] -f1\ |sed -e s/':::'//g\ |sed -e s/','/"\n\t"/g\ |sed -e s/'"'//g; fi; done ;; 3) echo -e "Memory Process \t Bytes\t\t\tWR Protocol\t\t\tMap Protocol\t\t\tMem Sector" lngth=`grep -c 'mmap(\|mprotect' $file|awk '{print $1+10}'`; grep 'mmap(\|mprotect' $file \ |sed -e s/'=\|)\|('/','/g\ |sed -e s/' '/','/g\ |sed -e s/','/' '/g\ |sed -e s/'mprotect'/'mpro...'/g\ |awk '{ if ($6 == "0"){ $9=$3; $6="" } if ($3="NULL"){ $3=$4 } print $2"\t "$3"\n"$5"\n"$6"\n"$9 }'\ |pr --colum 4 -a -W 140 -l $lngth -t ;; 4) #Env for i in `head -1 $file\ |cut -d'(' -f2\ |sed -e s/'\],'/"\n"/g\ |sed -e s/' '/':::'/g` do chk=`echo $i|grep 'HOSTNAME'`; if [ -z $chk ]; then echo Command: echo -e $i\ |sed -e s/':::'//g\ |sed -e s/',\['/"\n\t"/g\ |sed -e s/'"'//g\ |sed -e s/','/' '/g; else echo ENVIRONMENT:; echo $i\ |cut -d[ -f2\ |cut -d] -f1\ |sed -e s/':::'//g\ |sed -e s/','/"\n\t"/g\ |sed -e s/'"'//g; fi; done ;; *) echo "You picked an invalid option. Please try again" exit ;; esac
Please feel free to edit it, but please leave the credits in place.
Here's a small sample of the open files output:
Code:File STATUS HANDLE /lib64/libtermcap.so.2 O_RDONLY 3 /lib64/libdl.so.2 O_RDONLY 3 /lib64/libc.so.6 O_RDONLY 3 /dev/tty O_RDWR|O_NONBLOCK 3 /usr/lib/locale/locale-archive O_RDONLY 3 /proc/meminfo O_RDONLY 3 /usr/lib64/gconv/gconv-modules.cache O_RDONLY 3 /dev/null O_WRONLY|O_CREAT|O_TRUNC 0666
Here is a small sample of memory mapping:
Code:mmap 8192 PROT_READ|PROT_WRITE MAP_PRIVATE|MAP_FIXED|MAP_DENYWRIT 0x389b481000 mmap 4096 PROT_READ|PROT_WRITE MAP_PRIVATE|MAP_ANONYMOUS 0x2b42850a4000 mmap 4096 PROT_READ|PROT_WRITE MAP_PRIVATE|MAP_ANONYMOUS 0x2b42850a5000 mpro... 4096 PROT_READ 0x389a402000 mpro... 4096 PROT_READ 0x389b801000 mpro... 16384 PROT_READ 0x389a149000 mpro... 4096 PROT_READ 0x3899c1a000 mpro... 4096 PROT_READ 0x389b481000 mmap 4096 PROT_READ|PROT_WRITE MAP_PRIVATE|MAP_ANONYMOUS 0x2b4285099000 mmap 4096 PROT_READ|PROT_WRITE MAP_PRIVATE|MAP_ANONYMOUS 0x2b428509c000
Here is a sample output of executed commands, and evironment(certain information has been removed for security purposes):
Code:Command: /usr/sbin/vzlicview vzlicview --check-status ENVIRONMENT: HOSTNAME=hostname SHELL=/bin/bash TERM=vt100 HISTSIZE=1000 SSH_CLIENT=*********** SSH_TTY=/dev/pts/0 USER=root LS_COLORS=no=00:fi=00:di=01;34:ln=01;36:pi=40;33:so=01;35:bd=40;33;01:cd=40;33;01:or=01;05;37;41:mi=01;05;37;41:ex=01;32:*.cmd=01;32:*.exe=01;32:*.com=01;32:*.btm=01;32:*.bat=01;32:*.sh=01;32:*.csh=01;32:*.tar=01;31:*.tgz=01;31:*.arj=01;31:*.taz=01;31:*.lzh=01;31:*.zip=01;31:*.z=01;31:*.Z=01;31:*.gz=01;31:*.bz2=01;31:*.bz=01;31:*.tz=01;31:*.rpm=01;31:*.cpio=01;31:*.jpg=01;35:*.gif=01;35:*.bmp=01;35:*.xbm=01;35:*.xpm=01;35:*.png=01;35:*.tif=01;35: PATH=/usr/kerberos/sbin:/usr/kerberos/bin:/usr/local/sbin:/usr/local/bin:/sbin:/bin:/usr/sbin:/usr/bin:/root/bin MAIL=/var/spool/mail/root _=/usr/sbin/vzlicview PWD=/root INPUTRC=/etc/inputrc LANG=en_US.UTF-8 HOME=/root SHLVL=2 LOGNAME=root SSH_CONNECTION=********** LESSOPEN=|/usr/bin/lesspipe.sh%s G_BROKEN_FILENAMES=1
Save the script as any filename you'd like, put it in /bin, and change permissions to 0700(dont let other users other then root run it), otherwise, save it in a directory, and run it with the path.
I hope this helps you guys, I know I'm glad I did this, saved me tons of time already.



LinkBack URL
About LinkBacks
Reply With Quote




