/usr/share/sysdig/chisels/lsof.lua is in sysdig 0.8.0-1.
This file is owned by root:root, with mode 0o644.
The actual contents of the file can be viewed below.
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 | --[[
Copyright (C) 2014 Draios inc.
This program is free software: you can redistribute it and/or modify
it under the terms of the GNU General Public License version 2 as
published by the Free Software Foundation.
This program is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
GNU General Public License for more details.
You should have received a copy of the GNU General Public License
along with this program. If not, see <http://www.gnu.org/licenses/>.
--]]
-- Chisel description
description = "This chisel prints the open file descriptors for every process in the system, with an output that is similar to the one of lsof. Output is at a point in time; adjust this in the filter. It defaults to time of evt.num=0";
short_description = "List (and optionally filter) the open file descriptors.";
category = "System State";
-- Argument list
args =
{
{
name = "filter",
description = "A sysdig-like filter expression that allows restricting the FD list. E.g. 'proc.name=foo and fd.name contains /etc'.",
argtype = "filter",
optional = true
}
}
-- Argument initialization Callback
function on_set_arg(name, val)
if name == "filter" then
filter = val
return true
end
return false
end
-- Imports and globals
require "common"
local dctable = {}
local capturing = false
local filter = nil
local match = false
-- Argument notification callback
function on_set_arg(name, val)
if name == "filter" then
filter = val
return true
end
return false
end
-- Initialization callback
function on_init()
return true
end
-- Final chisel initialization
function on_capture_start()
capturing = true
return true
end
-- Event parsing callback
function on_event()
sysdig.end_capture()
match = true
return false
end
-- Called by the engine at the end of the capture (Ctrl-C)
function on_capture_end()
if not capturing then
return
end
if match == false then
print("empty capture or no event matching the filter")
return
end
local ttable = sysdig.get_thread_table(filter)
local sorted_ttable = pairs_top_by_val(ttable, 0, function(t,a,b) return a < b end)
print(extend_string("COMMAND", 20) ..
extend_string("PID", 8) ..
extend_string("TID", 8) ..
extend_string("USER", 8) ..
extend_string("FD", 8) ..
extend_string("TYPE", 12) ..
"NAME")
for tid, proc in sorted_ttable do
local fdtable = proc.fdtable
for fd, fdinfo in pairs(fdtable) do
print(extend_string(proc.comm, 20) ..
extend_string(tostring(proc.pid), 8) ..
extend_string(tostring(tid), 8) ..
extend_string(proc.username, 8) ..
extend_string(tostring(fd), 8) ..
extend_string(tostring(fdinfo.type), 12) ..
tostring(fdinfo.name))
end
end
end
|