0xtools icon indicating copy to clipboard operation
0xtools copied to clipboard

add few syscalls to report dir as filename

Open timurakhmadeev opened this issue 3 years ago • 3 comments

getdents, unlinkat calls can be seen when working with directories with large number of files/inodes. I'm not 100% sure it will work everywhere, and tested it on Ubuntu 20.04 only. It kinda works :)


Linux Process Snapper v0.18 by Tanel Poder [https://0x.tools]
Sampling /proc/syscall, wchan, stat for 3 seconds... finished.


=== Active Threads ======================================================================================================================

 samples | avg_threads | comm                   | state                  | syscall         | wchan                | filename             
-----------------------------------------------------------------------------------------------------------------------------------------
      17 |        0.53 | (rm)                   | Disk (Uninterruptible) | unlinkat        | jbd2_log_wait_commit | /home/tiak/psn-test  
      11 |        0.34 | (rm)                   | Disk (Uninterruptible) | unlinkat        | rq_qos_wait          | /home/tiak/psn-test  
       9 |        0.28 | (jbd*/dm-*-*)          | Disk (Uninterruptible) | [kernel_thread] | __wait_on_buffer     |                      
       7 |        0.22 | (jbd*/dm-*-*)          | Disk (Uninterruptible) | [kernel_thread] | rq_qos_wait          |                      
       3 |        0.09 | (llvmpipe-*)           | Running (ON CPU)       | [running]       | 0                    |                      
       3 |        0.09 | (rm)                   | Running (ON CPU)       | [running]       | 0                    |                      
       1 |        0.03 | (kworker/*:*H+kblockd) | Running (ON CPU)       | [running]       | 0                    |                      
       1 |        0.03 | (rcu_sched)            | Running (ON CPU)       | [running]       | 0                    |                      
       1 |        0.03 | (rm)                   | Disk (Uninterruptible) | unlinkat        | submit_bio_wait      | /home/tiak/psn-test  

timurakhmadeev avatar Mar 17 '21 08:03 timurakhmadeev

Work in Oracle Linux too

   3116 |       18.12 | (XXXXXXXXXXX)     | Disk (Uninterruptible) | getdents        | iterate_dir           | <snipped>/log
    142 |        0.83 | (XXXXXXXXXXX)     | Disk (Uninterruptible) | getdents        | rpc_wait_bit_killable | <snipped>/log

timurakhmadeev avatar Mar 19 '21 07:03 timurakhmadeev

Great addition! There may be more syscalls that have a single file descriptor as an argument, so they all could be enhanced. If you find any, more PRs welcome :-) I was gonna write some wild grep command for finding all of them programmatically, but haven't gotten to this yet. I'll merge this to the next release.

tanelpoder avatar Mar 19 '21 17:03 tanelpoder

Welcome, Tanel! As you wish :)

timurakhmadeev avatar Mar 23 '21 09:03 timurakhmadeev