philipsal
Reputation: 21
Systemtap monitor child processes after parent exits
I'm using the example script here with "follow_fork" set to 1: https://sourceware.org/systemtap/examples/process/strace.stp
I just have a C program that calls fork() three times called "forker". A systemtap output log is below. You can see that it was only able to monitor one child process. After running it several times, it varied in the number of child processes it logs (0 to 6) which I think is expected with concurrency.
How can I instruct systemtap to continue monitoring children processes after the initial parent exits? This is an issue because I'm not getting the complete logs for the children processes since systemtap exits when the parent exits, often before the children complete. Is there a way to add new pids to the target pids while running, or something else to accomplish this?
This is running on Fedora34
Mon Aug 30 23:52:49 2021.647560 rt_sigaction(SIGUSR1, {SIG_DFL}, 0x0, 8) = 0
Mon Aug 30 23:52:49 2021.647579 rt_sigprocmask(SIG_SETMASK, [EMPTY], 0x0, 8) = 0
Mon Aug 30 23:52:49 2021.647600 alarm(0) = 57
Mon Aug 30 23:52:49 2021.647623 write(2, "stapio:start_cmd:218 ", 21) = 21
Mon Aug 30 23:52:49 2021.647757 write(2, "execing target_cmd sh -c /tmp/forker\n", 37) = 37
Mon Aug 30 23:52:49 2021.647908 execve("/usr/local/sbin/sh", ["sh", "-c", "/tmp/forker"], ["XAUTHORITY=/root/.Xauthority", "DISPLAY=:0", "MAIL=/var/mail/root", "PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/var/lib/snapd/snap/bin", "LOGNAME=root", "USER=root", "HOME=/root", "SHELL=/bin/bash", "TERM=unknown", "SUDO_COMMAND=/usr/bin/staprun -vv -o stap.log /root/.cuckoo/stap_.ko -c sh -c /tmp/forker", "SUDO_USER=root", "SUDO_UID=0", "SUDO_GID=0", "SYSTEMTAP_VERBOSE=2", "SYSTEMTAP_MODULE=stap_"]) = -2 (ENOENT)
Mon Aug 30 23:52:49 2021.648085 execve("/usr/local/bin/sh", ["sh", "-c", "/tmp/forker"], ["XAUTHORITY=/root/.Xauthority", "DISPLAY=:0", "MAIL=/var/mail/root", "PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/var/lib/snapd/snap/bin", "LOGNAME=root", "USER=root", "HOME=/root", "SHELL=/bin/bash", "TERM=unknown", "SUDO_COMMAND=/usr/bin/staprun -vv -o stap.log /root/.cuckoo/stap_.ko -c sh -c /tmp/forker", "SUDO_USER=root", "SUDO_UID=0", "SUDO_GID=0", "SYSTEMTAP_VERBOSE=2", "SYSTEMTAP_MODULE=stap_"]) = -2 (ENOENT)
Mon Aug 30 23:52:49 2021.648169 execve("/usr/sbin/sh", ["sh", "-c", "/tmp/forker"], ["XAUTHORITY=/root/.Xauthority", "DISPLAY=:0", "MAIL=/var/mail/root", "PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/var/lib/snapd/snap/bin", "LOGNAME=root", "USER=root", "HOME=/root", "SHELL=/bin/bash", "TERM=unknown", "SUDO_COMMAND=/usr/bin/staprun -vv -o stap.log /root/.cuckoo/stap_.ko -c sh -c /tmp/forker", "SUDO_USER=root", "SUDO_UID=0", "SUDO_GID=0", "SYSTEMTAP_VERBOSE=2", "SYSTEMTAP_MODULE=stap_"]) = -2 (ENOENT)
Mon Aug 30 23:52:49 2021.649393 brk(0x0) = 94435928932352
Mon Aug 30 23:52:49 2021.650148 arch_prctl(12289, 140732394314512) = -22 (EINVAL)
Mon Aug 30 23:52:49 2021.650226 access("/etc/ld.so.preload", R_OK) = -2 (ENOENT)
Mon Aug 30 23:52:49 2021.650269 openat(AT_FDCWD, "/etc/ld.so.cache", O_RDONLY|O_CLOEXEC) = 3
Mon Aug 30 23:52:49 2021.650298 fstatat(3, "", 0x7ffed05f0d40, AT_EMPTY_PATH) = 0
Mon Aug 30 23:52:49 2021.650317 mmap2(0x0, 61580, PROT_READ, MAP_PRIVATE, 3, 0) = 0x7f03051ef000
Mon Aug 30 23:52:49 2021.650336 close(3) = 0
Mon Aug 30 23:52:49 2021.650369 openat(AT_FDCWD, "/lib64/libtinfo.so.6", O_RDONLY|O_CLOEXEC) = 3
Mon Aug 30 23:52:49 2021.650392 read(3, 0x7ffed05f0e98, 832) = 832
Mon Aug 30 23:52:49 2021.650409 fstatat(3, "", 0x7ffed05f0d40, AT_EMPTY_PATH) = 0
Mon Aug 30 23:52:49 2021.650424 mmap2(0x0, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f03051ed000
Mon Aug 30 23:52:49 2021.650448 mmap2(0x0, 190832, PROT_READ, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0x7f03051be000
Mon Aug 30 23:52:49 2021.650472 mmap2(0x7f03051cc000, 57344, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 57344) = 0x7f03051cc000
Mon Aug 30 23:52:49 2021.650495 mmap2(0x7f03051da000, 57344, PROT_READ, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 114688) = 0x7f03051da000
Mon Aug 30 23:52:49 2021.650513 mmap2(0x7f03051e8000, 20480, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 167936) = 0x7f03051e8000
Mon Aug 30 23:52:49 2021.650567 close(3) = 0
Mon Aug 30 23:52:49 2021.650609 openat(AT_FDCWD, "/lib64/libdl.so.2", O_RDONLY|O_CLOEXEC) = 3
Mon Aug 30 23:52:49 2021.650876 read(3, 0x7ffed05f0e78, 832) = 832
Mon Aug 30 23:52:49 2021.650911 fstatat(3, "", 0x7ffed05f0d20, AT_EMPTY_PATH) = 0
Mon Aug 30 23:52:49 2021.650942 mmap2(0x0, 24688, PROT_READ, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0x7f03051b7000
Mon Aug 30 23:52:49 2021.650972 mmap2(0x7f03051b9000, 8192, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 8192) = 0x7f03051b9000
Mon Aug 30 23:52:49 2021.650998 mmap2(0x7f03051bb000, 4096, PROT_READ, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 16384) = 0x7f03051bb000
Mon Aug 30 23:52:49 2021.651015 mmap2(0x7f03051bc000, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 16384) = 0x7f03051bc000
Mon Aug 30 23:52:49 2021.651045 mmap2(0x7f03051bd000, 112, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x7f03051bd000
Mon Aug 30 23:52:49 2021.651079 close(3) = 0
Mon Aug 30 23:52:49 2021.651103 openat(AT_FDCWD, "/lib64/libc.so.6", O_RDONLY|O_CLOEXEC) = 3
Mon Aug 30 23:52:49 2021.651130 read(3, 0x7ffed05f0e58, 832) = 832
Mon Aug 30 23:52:49 2021.651146 pread(3, 0x7ffed05f0a60, 784, 64) = 784
Mon Aug 30 23:52:49 2021.651161 pread(3, 0x7ffed05f0a20, 48, 848) = 48
Mon Aug 30 23:52:49 2021.651173 pread(3, 0x7ffed05f09d0, 68, 896) = 68
Mon Aug 30 23:52:49 2021.651187 fstatat(3, "", 0x7ffed05f0d00, AT_EMPTY_PATH) = 0
Mon Aug 30 23:52:49 2021.651202 pread(3, 0x7ffed05f0950, 784, 64) = 784
Mon Aug 30 23:52:49 2021.651216 mmap2(0x0, 1892824, PROT_READ, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0x7f0304fe8000
Mon Aug 30 23:52:49 2021.651249 mprotect(0x7f030500e000, 1679360, PROT_NONE) = 0
Mon Aug 30 23:52:49 2021.651279 mmap2(0x7f030500e000, 1363968, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 155648) = 0x7f030500e000
Mon Aug 30 23:52:49 2021.651300 mmap2(0x7f030515b000, 311296, PROT_READ, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 1519616) = 0x7f030515b000
Mon Aug 30 23:52:49 2021.651317 mmap2(0x7f03051a8000, 24576, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 1830912) = 0x7f03051a8000
Mon Aug 30 23:52:49 2021.651354 mmap2(0x7f03051ae000, 33240, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x7f03051ae000
Mon Aug 30 23:52:49 2021.651403 close(3) = 0
Mon Aug 30 23:52:49 2021.651437 mmap2(0x0, 12288, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f0304fe5000
Mon Aug 30 23:52:49 2021.651460 arch_prctl(ARCH_SET_FS, 139650945406784) = 0
Mon Aug 30 23:52:49 2021.651570 mprotect(0x7f03051a8000, 12288, PROT_READ) = 0
Mon Aug 30 23:52:49 2021.651606 mprotect(0x7f03051bc000, 4096, PROT_READ) = 0
Mon Aug 30 23:52:49 2021.651788 mprotect(0x7f03051e8000, 16384, PROT_READ) = 0
Mon Aug 30 23:52:49 2021.652040 mprotect(0x55e3926ce000, 16384, PROT_READ) = 0
Mon Aug 30 23:52:49 2021.652072 mprotect(0x7f030522f000, 8192, PROT_READ) = 0
Mon Aug 30 23:52:49 2021.652132 munmap(0x7f03051ef000, 61580) = 0
Mon Aug 30 23:52:49 2021.652224 openat(AT_FDCWD, 0x55e3926a6859, O_RDWR|O_NONBLOCK) = 3
Mon Aug 30 23:52:49 2021.652259 close(3) = 0
Mon Aug 30 23:52:49 2021.652374 brk(0x0) = 94435928932352
Mon Aug 30 23:52:49 2021.652392 brk(0x55e394019000) = 94435929067520
Mon Aug 30 23:52:49 2021.652425 getuid() = 0
Mon Aug 30 23:52:49 2021.652453 getgid() = 0
Mon Aug 30 23:52:49 2021.652494 geteuid() = 0
Mon Aug 30 23:52:49 2021.652523 getegid() = 0
Mon Aug 30 23:52:49 2021.652549 rt_sigprocmask(SIG_BLOCK, NULL, 0x55e3926db1a8, 8) = 0
Mon Aug 30 23:52:49 2021.652614 ioctl(-1, 21519, 0x7ffed05f19e4) = -9 (EBADF)
Mon Aug 30 23:52:49 2021.652739 sysinfo({uptime=139650947817952, loads=[0, 140732394313824, 139650945675605], totalram=139650947611568, freeram=140732394313952, sharedram=140732394313872, bufferram=0, totalswap=0, freeswap=139650946429060, procs=47616}) = 0
Mon Aug 30 23:52:49 2021.652812 rt_sigaction(SIGCHLD, {SIG_DFL}, 0x7ffed05f16c0, 8) = 0
Mon Aug 30 23:52:49 2021.652829 rt_sigaction(SIGCHLD, {SIG_DFL}, 0x7ffed05f16c0, 8) = 0
Mon Aug 30 23:52:49 2021.652841 rt_sigaction(SIGINT, {SIG_DFL}, 0x7ffed05f16c0, 8) = 0
Mon Aug 30 23:52:49 2021.652852 rt_sigaction(SIGINT, {SIG_DFL}, 0x7ffed05f16c0, 8) = 0
Mon Aug 30 23:52:49 2021.652864 rt_sigaction(SIGQUIT, {SIG_DFL}, 0x7ffed05f16c0, 8) = 0
Mon Aug 30 23:52:49 2021.652875 rt_sigaction(SIGQUIT, {SIG_DFL}, 0x7ffed05f16c0, 8) = 0
Mon Aug 30 23:52:49 2021.652891 rt_sigaction(SIGTSTP, {SIG_DFL}, 0x7ffed05f1690, 8) = 0
Mon Aug 30 23:52:49 2021.652903 rt_sigaction(SIGTSTP, {SIG_DFL}, 0x7ffed05f1690, 8) = 0
Mon Aug 30 23:52:49 2021.652914 rt_sigaction(SIGTTIN, {SIG_DFL}, 0x7ffed05f16c0, 8) = 0
Mon Aug 30 23:52:49 2021.652926 rt_sigaction(SIGTTIN, {SIG_DFL}, 0x7ffed05f16c0, 8) = 0
Mon Aug 30 23:52:49 2021.652945 rt_sigaction(SIGTTOU, {SIG_DFL}, 0x7ffed05f16c0, 8) = 0
Mon Aug 30 23:52:49 2021.652957 rt_sigaction(SIGTTOU, {SIG_DFL}, 0x7ffed05f16c0, 8) = 0
Mon Aug 30 23:52:49 2021.652979 rt_sigprocmask(SIG_BLOCK, NULL, 0x55e3926dada0, 8) = 0
Mon Aug 30 23:52:49 2021.652993 rt_sigaction(SIGQUIT, {SIG_IGN}, 0x7ffed05f16c0, 8) = 0
Mon Aug 30 23:52:49 2021.653009 uname(0x7ffed05f1720) = 0
Mon Aug 30 23:52:49 2021.653067 getcwd(0x55e393ffd3b0, 4096) = 13
Mon Aug 30 23:52:49 2021.653087 getpid() = 2565
Mon Aug 30 23:52:49 2021.653103 getppid() = 2564
Mon Aug 30 23:52:49 2021.653122 fstatat(AT_FDCWD, ".", 0x7ffed05f1740, 0x0) = 0
Mon Aug 30 23:52:49 2021.653152 fstatat(AT_FDCWD, "/usr/local/sbin/sh", 0x7ffed05f1610, 0x0) = -2 (ENOENT)
Mon Aug 30 23:52:49 2021.653173 fstatat(AT_FDCWD, "/usr/local/bin/sh", 0x7ffed05f1610, 0x0) = -2 (ENOENT)
Mon Aug 30 23:52:49 2021.653188 fstatat(AT_FDCWD, "/usr/sbin/sh", 0x7ffed05f1610, 0x0) = -2 (ENOENT)
Mon Aug 30 23:52:49 2021.653204 fstatat(AT_FDCWD, "/usr/bin/sh", 0x7ffed05f1610, 0x0) = 0
Mon Aug 30 23:52:49 2021.653222 fstatat(AT_FDCWD, "/usr/bin/sh", 0x7ffed05f1530, 0x0) = 0
Mon Aug 30 23:52:49 2021.653235 geteuid() = 0
Mon Aug 30 23:52:49 2021.653247 getegid() = 0
Mon Aug 30 23:52:49 2021.653258 getuid() = 0
Mon Aug 30 23:52:49 2021.653269 getgid() = 0
Mon Aug 30 23:52:49 2021.653283 access("/usr/bin/sh", X_OK) = 0
Mon Aug 30 23:52:49 2021.653304 fstatat(AT_FDCWD, "/usr/bin/sh", 0x7ffed05f1530, 0x0) = 0
Mon Aug 30 23:52:49 2021.653317 geteuid() = 0
Mon Aug 30 23:52:49 2021.653327 getegid() = 0
Mon Aug 30 23:52:49 2021.653338 getuid() = 0
Mon Aug 30 23:52:49 2021.653349 getgid() = 0
Mon Aug 30 23:52:49 2021.653361 access("/usr/bin/sh", R_OK) = 0
Mon Aug 30 23:52:49 2021.653378 fstatat(AT_FDCWD, "/usr/bin/sh", 0x7ffed05f1660, 0x0) = 0
Mon Aug 30 23:52:49 2021.653393 fstatat(AT_FDCWD, "/usr/bin/sh", 0x7ffed05f1580, 0x0) = 0
Mon Aug 30 23:52:49 2021.653406 geteuid() = 0
Mon Aug 30 23:52:49 2021.653416 getegid() = 0
Mon Aug 30 23:52:49 2021.653427 getuid() = 0
Mon Aug 30 23:52:49 2021.653437 getgid() = 0
Mon Aug 30 23:52:49 2021.653449 access("/usr/bin/sh", X_OK) = 0
Mon Aug 30 23:52:49 2021.653465 fstatat(AT_FDCWD, "/usr/bin/sh", 0x7ffed05f1580, 0x0) = 0
Mon Aug 30 23:52:49 2021.653478 geteuid() = 0
Mon Aug 30 23:52:49 2021.653488 getegid() = 0
Mon Aug 30 23:52:49 2021.653499 getuid() = 0
Mon Aug 30 23:52:49 2021.653509 getgid() = 0
Mon Aug 30 23:52:49 2021.653521 access("/usr/bin/sh", R_OK) = 0
Mon Aug 30 23:52:49 2021.653550 getpid() = 2565
Mon Aug 30 23:52:49 2021.653562 getppid() = 2564
Mon Aug 30 23:52:49 2021.653573 getpid() = 2565
Mon Aug 30 23:52:49 2021.653584 getppid() = 2564
Mon Aug 30 23:52:49 2021.653861 getpgrp() = 2515
Mon Aug 30 23:52:49 2021.653881 ioctl(2, 21519, 0x7ffed05f18a4) = -25 (ENOTTY)
Mon Aug 30 23:52:49 2021.653899 rt_sigaction(SIGCHLD, {0x55e3925e89d0, SA_RESTART|SA_RESTORER, 0x7f0305025320, [EMPTY]}, 0x7ffed05f16b0, 8) = 0
Mon Aug 30 23:52:49 2021.653913 ioctl(2, 21519, 0x7ffed05f1884) = -25 (ENOTTY)
Mon Aug 30 23:52:49 2021.653929 prlimit64(0, RLIMIT_NPROC, NULL, 0x7ffed05f1870) = 0
Mon Aug 30 23:52:49 2021.653990 rt_sigprocmask(SIG_BLOCK, NULL, 0x55e3926db288, 8) = 0
Mon Aug 30 23:52:49 2021.654022 rt_sigprocmask(SIG_BLOCK, NULL, 0x7ffed05f1930, 8) = 0
Mon Aug 30 23:52:49 2021.654102 rt_sigaction(SIGINT, {SIG_DFL}, 0x7ffed05f1400, 8) = 0
Mon Aug 30 23:52:49 2021.654119 rt_sigaction(SIGQUIT, {SIG_DFL}, 0x7ffed05f1400, 8) = 0
Mon Aug 30 23:52:49 2021.654131 rt_sigaction(SIGCHLD, {SIG_DFL}, 0x7ffed05f1400, 8) = 0
Mon Aug 30 23:52:49 2021.654554 brk(0x0) = 94910601707520
Mon Aug 30 23:52:49 2021.655235 arch_prctl(12289, 140720704638272) = -22 (EINVAL)
Mon Aug 30 23:52:49 2021.655284 access("/etc/ld.so.preload", R_OK) = -2 (ENOENT)
Mon Aug 30 23:52:49 2021.655317 openat(AT_FDCWD, "/etc/ld.so.cache", O_RDONLY|O_CLOEXEC) = 3
Mon Aug 30 23:52:49 2021.655340 fstatat(3, "", 0x7ffc179cbf70, AT_EMPTY_PATH) = 0
Mon Aug 30 23:52:49 2021.655356 mmap2(0x0, 61580, PROT_READ, MAP_PRIVATE, 3, 0) = 0x7f3810a02000
Mon Aug 30 23:52:49 2021.655374 close(3) = 0
Mon Aug 30 23:52:49 2021.655395 openat(AT_FDCWD, "/lib64/libc.so.6", O_RDONLY|O_CLOEXEC) = 3
Mon Aug 30 23:52:49 2021.655415 read(3, 0x7ffc179cc0c8, 832) = 832
Mon Aug 30 23:52:49 2021.655430 pread(3, 0x7ffc179cbcd0, 784, 64) = 784
Mon Aug 30 23:52:49 2021.655444 pread(3, 0x7ffc179cbc90, 48, 848) = 48
Mon Aug 30 23:52:49 2021.655456 pread(3, 0x7ffc179cbc40, 68, 896) = 68
Mon Aug 30 23:52:49 2021.655470 fstatat(3, "", 0x7ffc179cbf70, AT_EMPTY_PATH) = 0
Mon Aug 30 23:52:49 2021.655485 mmap2(0x0, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f3810a00000
Mon Aug 30 23:52:49 2021.655506 pread(3, 0x7ffc179cbbc0, 784, 64) = 784
Mon Aug 30 23:52:49 2021.655520 mmap2(0x0, 1892824, PROT_READ, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0x7f3810831000
Mon Aug 30 23:52:49 2021.655537 mprotect(0x7f3810857000, 1679360, PROT_NONE) = 0
Mon Aug 30 23:52:49 2021.655557 mmap2(0x7f3810857000, 1363968, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 155648) = 0x7f3810857000
Mon Aug 30 23:52:49 2021.655577 mmap2(0x7f38109a4000, 311296, PROT_READ, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 1519616) = 0x7f38109a4000
Mon Aug 30 23:52:49 2021.655593 mmap2(0x7f38109f1000, 24576, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 1830912) = 0x7f38109f1000
Mon Aug 30 23:52:49 2021.655617 mmap2(0x7f38109f7000, 33240, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x7f38109f7000
Mon Aug 30 23:52:49 2021.655768 close(3) = 0
Mon Aug 30 23:52:49 2021.655805 mmap2(0x0, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f381082f000
Mon Aug 30 23:52:49 2021.655893 arch_prctl(ARCH_SET_FS, 139878773822848) = 0
Mon Aug 30 23:52:49 2021.655971 mprotect(0x7f38109f1000, 12288, PROT_READ) = 0
Mon Aug 30 23:52:49 2021.656000 mprotect(0x565216c01000, 4096, PROT_READ) = 0
Mon Aug 30 23:52:49 2021.656032 mprotect(0x7f3810a42000, 8192, PROT_READ) = 0
Mon Aug 30 23:52:49 2021.656072 munmap(0x7f3810a02000, 61580) = 0
Mon Aug 30 23:52:49 2021.656129 clone(CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, 0x0, 0x0, 0x7f3810a01850) = 2569
Mon Aug 30 23:52:49 2021.656413 clone(CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, 0x0, 0x0, 0x7f3810a01850) = 2570
Mon Aug 30 23:52:49 2021.656463 forker[2569] clone(CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, 0x0, 0x0, 0x7f3810a01850) = 2571
Mon Aug 30 23:52:49 2021.656866 forker[2569] clone(CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, 0x0, 0x0, 0x7f3810a01850) = 2572
Mon Aug 30 23:52:49 2021.657244 forker[2569] fstatat(1, 0x7f38109be95a, 0x7ffc179ccc50, AT_EMPTY_PATH) = 0
Mon Aug 30 23:52:49 2021.657286 forker[2569] brk(0x0) = 94910601707520
Mon Aug 30 23:52:49 2021.657310 forker[2569] brk(0x565218b55000) = 94910601842688
Mon Aug 30 23:52:49 2021.657348 forker[2569] write(1, "Hello world!\n", 13) = 13
Mon Aug 30 23:52:49 2021.658001 forker[2569] exit_group(0) =
Mon Aug 30 23:52:49 2021.656529 clone(CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, 0x0, 0x0, 0x7f3810a01850) = 2573
Mon Aug 30 23:52:49 2021.657517 fstatat(1, 0x7f38109be95a, 0x7ffc179ccc50, AT_EMPTY_PATH) = 0
Mon Aug 30 23:52:49 2021.657572 brk(0x0) = 94910601707520
Mon Aug 30 23:52:49 2021.657603 brk(0x565218b55000) = 94910601842688
Mon Aug 30 23:52:49 2021.657768 write(1, "Hello world!\n", 13) = 13
Mon Aug 30 23:52:49 2021.657844 exit_group(0) =
Upvotes: 0
Views: 118
Answers (1)
fche
Reputation: 2790
If you invoke stap SCRIPT -c CMD, it will indeed stop the session after CMD exits, and not waiting until CMD's children all exit too. Consider wrapping your job into a shell, like: stap -Gfollow_fork=1 --example strace.stp -c /bin/sh, then within that shell, invoke your CMD, and wait as long as you like before hitting ^D. Or wrap that into a shell script with a long sleep at the end.
Upvotes: 0
Related Questions
- Detect death of parent process
- The parent process keep trace of it child's termination status
- How to monitor a child process state in Linux
- How to make parent process invoke wait when child exits with parent unblocked in Linux?
- How can I check when a Linux process and ALL its children exited?
- Get new pid from nd_syscall.vfork.return in systemtap
- How to make systemd monitor background process
- Tracking the death of a child process
- How to list current active systemtap probes
- systemtap: how to determine probe events and args