Trace sending and receiving of SIGKILL on Linux systems

sigkill_tracer.stp

#!/usr/bin/env stap

probe begin {
        printf("Watching for signal(9) and reporting sender and receiver statuses...\n");
}

probe signal.syskill {
        if(sig == 9) {
                printf("[%s] SEND===> PID %d (%s) sent signal %d (%s) to PID %d (%s)\n",
                        ctime(gettimeofday_s()),
                        pid(),
                        execname(),
                        sig,
                        sig_name,
                        sig_pid,
                        pid_name);
                print_backtrace()
        }
}

probe signal.handle {
        if(sig == 9) {
                printf("[%s] RECV<=== PID %d (%s) has received signal %d (%s)\n",
                        ctime(gettimeofday_s()),
                        pid(),
                        execname(),
                        sig,
                        sig_name);
                print_backtrace()
        }
}