bpftrace monitor neovim

README.md

run as:

sudo bpftrace neovim_execs.bt | awk -f keep_exit0.awk

keep_exit0.awk

BEGIN { RS = "----" }
/EXIT.* 0\n/ {
  split($0, array, "\n");
  print(array[2]);
}
/exit\(/ {
  split($0, array, "\n");
  print(array[2])
}
/open file/ {
  split($0, array, "\n");
  print(array[2])
}

neovim_execs.bt

tracepoint:syscalls:sys_enter_exec* /comm == "nvim"/ {
  if (str(args->argv[0]) != "/usr/bin/wl-paste") {
    @mark[tid] = 1;
    @start[pid] = nsecs;
    printf("started %d: ", pid);
    join(args->argv);
  }
}

tracepoint:syscalls:sys_exit_exec* /@mark[tid] == 1/ {
  // printf("%d ms\n", (nsecs - @start[tid]) / 1000000);
  printf ("<<<<EXIT %d %d\n", pid, args->ret);
  printf("----\n");
  delete(@mark[tid]);
}

// https://github.com/bpftrace/bpftrace/issues/2195#issuecomment-2079956311
tracepoint:sched:sched_process_exit /@start[pid] != 0/ {
  $task = (struct task_struct *)curtask;
  if ($task->pid == $task->tgid) {
    // printf("- %15s %-7d exit(%d) %s\n", strftime("%H:%M:%S.%f", nsecs), pid, $task->exit_code >> 8, comm);
    printf("%d: %dms exit(%d) %s\n", pid, (nsecs - @start[pid]) / 1000000, $task->exit_code >> 8, comm);
  }
  printf("----\n");
  delete(@start[pid]);
}

tracepoint:syscalls:sys_enter_open,
tracepoint:syscalls:sys_enter_openat
/comm == "nvim"/
{
  if (!strcontains(str(args.filename), "nvim")
      && !strcontains(str(args.filename), "/usr/")
      && !strcontains(str(args.filename), "/etc/")
      && !strcontains(str(args.filename), ".config")
      && !strcontains(str(args.filename), ".local")
      && !strcontains(str(args.filename), ".cache")
      && !strcontains(str(args.filename), "/dev/null")
      && str(args.filename) != "") {
    printf("open file: %s\n", str(args.filename));
    // print(ustack());
    printf("----\n");
  }
}