Giter Club home page Giter Club logo

colinianking / forkstat Goto Github PK

View Code? Open in Web Editor NEW
68.0 6.0 16.0 448 KB

Forkstat is a program that logs process fork(), exec() and exit() activity. It is useful for monitoring system behaviour and to track down rogue processes that are spawning off processes and potentially abusing the system.

Home Page: https://github.com/ColinIanKing/forkstat

License: GNU General Public License v2.0

Makefile 4.09% C 88.17% Roff 7.73%
exec fork linux process-monitor

forkstat's Introduction

Forkstat

Packaging status

Forkstat is a program that logs process fork(), exec() and exit() activity. It is useful for monitoring system behaviour and to track down rogue processes that are spawning off processes and potentially abusing the system.

Note that forkstat uses the Linux netlink connector to gather process activity and this may miss events if the system is overly busy. Netlink connector also requires root privilege.

forkstat command line options:

  • -d strip off the directory path from the process name
  • -D specify run duration in seconds.
  • -e select which events to monitor.
  • -h show brief help summary
  • -l set stdout to line-buffered mode
  • -r run with real time FIFO scheduler.
  • -s show short process name information
  • -S show event statistics at end of the run.
  • -q run quietly and enable -S option.
  • -x show extra process related information.

Example Output:

sudo forkstat -S -e all
Time     Event  PID  Info  Duration Process
09:42:49 fork  3525 parent          compiz
09:42:49 fork 19257 child           compiz
09:42:49 fork 19257 parent          compiz
09:42:49 fork 19258 child           compiz
09:42:49 exit 19257      0    0.008 compiz
09:42:49 exec 19258                 gnome-terminal
09:42:49 fork  3258 parent          gnome-session --session=ubuntu
09:42:49 fork 19259 child           compiz
09:42:49 comm 19259                 compiz -> pool
09:42:49 fork  3258 parent          gnome-session --session=ubuntu
09:42:49 fork 19260 child           compiz
09:42:49 comm 19260                 compiz -> pool
09:42:49 fork  2990 parent          init --user --state-fd 29 --restart
09:42:49 fork 19261 child           gnome-terminal
09:42:49 comm 19261                 gnome-terminal -> dconf worker
09:42:49 fork  2990 parent          init --user --state-fd 29 --restart
09:42:49 fork 19262 child           gnome-terminal
09:42:49 comm 19262                 gnome-terminal -> gdbus
09:42:49 fork  2990 parent          init --user --state-fd 29 --restart
09:42:49 fork 19263 child           gnome-terminal
09:42:49 comm 19263                 gnome-terminal -> pool
09:42:49 exit 19261      0    0.063 gnome-terminal
09:42:49 exit 19263      0    0.036 gnome-terminal
09:42:49 exit 19258      0    0.092 gnome-terminal
09:42:49 exit 19262      0    0.060 gnome-terminal
Time     Event  PID  Info  Duration Process
09:42:49 fork  4394 parent          gnome-terminal
09:42:49 fork 19264 child           gnome-terminal
09:42:49 exec 19264                 bash
09:42:49 fork 19264 parent          bash
09:42:49 fork 19265 child           bash
09:42:49 fork 19265 parent          bash
09:42:49 fork 19266 child           bash
09:42:49 exec 19266                 groups
09:42:49 exit 19266      0    0.002 groups
09:42:49 exit 19265      0    0.003 bash
09:42:49 fork 19264 parent          bash
09:42:49 fork 19267 child           bash
09:42:49 fork 19267 parent          bash
09:42:49 fork 19268 child           bash
09:42:49 exec 19268                 /bin/sh /usr/bin/lesspipe
09:42:49 fork 19268 parent          /bin/sh /usr/bin/lesspipe
09:42:49 fork 19269 child           /bin/sh /usr/bin/lesspipe
09:42:49 exec 19269                 basename /usr/bin/lesspipe
09:42:49 exit 19269      0    0.004 basename /usr/bin/lesspipe
09:42:49 fork 19268 parent          /bin/sh /usr/bin/lesspipe
09:42:49 fork 19270 child           /bin/sh /usr/bin/lesspipe
09:42:49 fork 19270 parent          /bin/sh /usr/bin/lesspipe
09:42:49 fork 19271 child           /bin/sh /usr/bin/lesspipe
09:42:49 exec 19271                 dirname /usr/bin/lesspipe
Time     Event  PID  Info  Duration Process
09:42:49 exit 19271      0    0.001 dirname /usr/bin/lesspipe
09:42:49 exit 19270      0    0.001 /bin/sh /usr/bin/lesspipe
09:42:49 exit 19268      0    0.014 /bin/sh /usr/bin/lesspipe
09:42:49 exit 19267      0    0.015 bash
09:42:49 fork 19264 parent          bash
09:42:49 fork 19272 child           bash
09:42:49 fork 19272 parent          bash
09:42:49 fork 19273 child           bash
09:42:49 exec 19273                 dircolors -b
09:42:49 exit 19273      0    0.004 dircolors -b
09:42:49 exit 19272      0    0.007 bash
09:42:49 fork 19264 parent          bash
09:42:49 fork 19274 child           bash
09:42:49 fork 19274 parent          bash
09:42:49 fork 19275 child           bash
09:42:49 exec 19275                 ls /etc/bash_completion.d
09:42:49 exit 19275      0    0.002 ls /etc/bash_completion.d
09:42:49 exit 19274      0    0.004 bash
09:42:49 fork 19264 parent          bash
09:42:49 fork 19276 child           bash
09:42:49 fork 19276 parent          bash
09:42:49 fork 19277 child           bash
09:42:49 fork 19277 parent          bash
09:42:49 fork 19278 child           bash
Time     Event  PID  Info  Duration Process
09:42:49 exec 19278                 ubuntu-distro-info --all
09:42:49 exit 19278      0    0.001 ubuntu-distro-info --all
09:42:49 fork 19277 parent          bash
09:42:49 fork 19279 child           bash
09:42:49 exec 19279                 debian-distro-info --all
09:42:49 exit 19279      0    0.001 debian-distro-info --all
09:42:49 exit 19277      0    0.003 bash
09:42:49 exit 19276      0    0.009 bash
09:42:49 fork 19264 parent          bash
09:42:49 fork 19280 child           bash
09:42:49 fork 19280 parent          bash
09:42:49 exit 19280      0    0.002 bash
09:42:49 fork 19264 parent          bash
09:42:49 fork 19282 child           bash
09:42:49 exec 19282                 /usr/bin/python /usr/bin/bzr whoami Colin King 
09:42:49 exit 19282      0    0.102 /usr/bin/python /usr/bin/bzr whoami Colin King 
09:42:49 exit 19259      0    0.501 compiz
09:42:50 fork  2990 parent          init --user --state-fd 29 --restart
09:42:50 fork 19283 child           /usr/lib/x86_64-linux-gnu/indicator-session/indicator-session-service
09:42:50 comm 19283                 /usr/lib/x86_64-linux-gnu/indicator-session/indicator-session-service -> pool
09:42:50 fork  1247 parent          /usr/lib/accountsservice/accounts-daemon
Time     Event  PID  Info  Duration Process
09:42:50 fork 19284 child           /usr/lib/accountsservice/accounts-daemon
09:42:50 exec 19284                 /bin/sh -e /usr/share/language-tools/language-validate en_GB:en
09:42:50 fork 19284 parent          /bin/sh -e /usr/share/language-tools/language-validate en_GB:en
09:42:50 fork 19285 child           /bin/sh -e /usr/share/language-tools/language-validate en_GB:en
09:42:50 exec 19285                 /usr/bin/perl /usr/share/language-tools/language-options
09:42:50 fork 19285 parent          /usr/bin/perl /usr/share/language-tools/language-options
09:42:50 fork 19286 child           /usr/bin/perl /usr/share/language-tools/language-options
09:42:50 exec 19286                 sh -c locale -a | grep -F .utf8 
09:42:50 fork 19286 parent          sh -c locale -a | grep -F .utf8 
09:42:50 fork 19287 child           sh -c locale -a | grep -F .utf8 
09:42:50 fork 19286 parent          sh -c locale -a | grep -F .utf8 
09:42:50 fork 19288 child           sh -c locale -a | grep -F .utf8 
09:42:50 exec 19288                 grep -F .utf8
09:42:50 exec 19287                 locale -a
09:42:50 exit 19287      0    0.002 locale -a
09:42:50 exit 19288      0    0.003 grep -F .utf8
09:42:50 exit 19286      0    0.004 sh -c locale -a | grep -F .utf8 
09:42:50 exit 19285      0    0.012 /usr/bin/perl /usr/share/language-tools/language-options
09:42:50 exit 19284      0    0.015 /bin/sh -e /usr/share/language-tools/language-validate en_GB:en
09:42:50 fork  1247 parent          /usr/lib/accountsservice/accounts-daemon
09:42:50 fork 19289 child           /usr/lib/accountsservice/accounts-daemon
09:42:50 exec 19289                 /bin/sh -e /usr/share/language-tools/language-validate en_GB:en
09:42:50 fork 19289 parent          /bin/sh -e /usr/share/language-tools/language-validate en_GB:en
09:42:50 fork 19290 child           /bin/sh -e /usr/share/language-tools/language-validate en_GB:en
Time     Event  PID  Info  Duration Process
09:42:50 exec 19290                 /usr/bin/perl /usr/share/language-tools/language-options
09:42:50 fork 19290 parent          /usr/bin/perl /usr/share/language-tools/language-options
09:42:50 fork 19291 child           /usr/bin/perl /usr/share/language-tools/language-options
09:42:50 exec 19291                 sh -c locale -a | grep -F .utf8 
09:42:50 fork 19291 parent          sh -c locale -a | grep -F .utf8 
09:42:50 fork 19292 child           sh -c locale -a | grep -F .utf8 
09:42:50 fork 19291 parent          sh -c locale -a | grep -F .utf8 
09:42:50 fork 19293 child           grep
09:42:50 exec 19292                 
09:42:50 exec 19293                 
09:42:50 exit 19292      0    0.001 sh -c locale -a | grep -F .utf8 
09:42:50 exit 19293      0    0.000 grep
09:42:50 exit 19291      0    0.002 sh -c locale -a | grep -F .utf8 
09:42:50 exit 19290      0    0.008 /usr/bin/perl /usr/share/language-tools/language-options
09:42:50 exit 19289      0    0.010 /bin/sh -e /usr/share/language-tools/language-validate en_GB:en
09:42:50 fork  1247 parent          /usr/lib/accountsservice/accounts-daemon
09:42:50 fork 19294 child           /usr/lib/accountsservice/accounts-daemon
09:42:50 exec 19294                 /bin/sh -e /usr/share/language-tools/language-validate en_GB:en
09:42:50 fork 19294 parent          /bin/sh -e /usr/share/language-tools/language-validate en_GB:en
09:42:50 fork 19295 child           /bin/sh -e /usr/share/language-tools/language-validate en_GB:en
09:42:50 exec 19295                 /usr/bin/perl /usr/share/language-tools/language-options
09:42:50 fork 19295 parent          /usr/bin/perl /usr/share/language-tools/language-options
09:42:50 fork 19296 child           /usr/bin/perl /usr/share/language-tools/language-options
09:42:50 exec 19296                 sh -c locale -a | grep -F .utf8 
Time     Event  PID  Info  Duration Process
09:42:50 fork 19296 parent          sh -c locale -a | grep -F .utf8 
09:42:50 fork 19297 child           locale
09:42:50 fork 19296 parent          sh -c locale -a | grep -F .utf8 
09:42:50 fork 19298 child           sh -c locale -a | grep -F .utf8 
09:42:50 exec 19297                 locale -a
09:42:50 exit 19297      0    0.001 locale -a
09:42:50 exec 19298                 grep -F .utf8
09:42:50 exit 19298      0    0.001 grep -F .utf8
09:42:50 exit 19296      0    0.002 sh -c locale -a | grep -F .utf8 
09:42:50 exit 19295      0    0.008 /usr/bin/perl /usr/share/language-tools/language-options
09:42:50 exit 19294      0    0.009 /bin/sh -e /usr/share/language-tools/language-validate en_GB:en
09:42:50 fork  1247 parent          /usr/lib/accountsservice/accounts-daemon
09:42:50 fork 19299 child           /usr/lib/accountsservice/accounts-daemon
09:42:50 exec 19299                 /bin/sh -e /usr/share/language-tools/language-validate en_GB:en
09:42:50 fork 19299 parent          /bin/sh -e /usr/share/language-tools/language-validate en_GB:en
09:42:50 fork 19300 child           /bin/sh -e /usr/share/language-tools/language-validate en_GB:en
09:42:50 exec 19300                 /usr/bin/perl /usr/share/language-tools/language-options
09:42:50 fork 19300 parent          /usr/bin/perl /usr/share/language-tools/language-options
09:42:50 fork 19301 child           /usr/bin/perl /usr/share/language-tools/language-options
09:42:50 exec 19301                 sh -c locale -a | grep -F .utf8 
09:42:50 fork 19301 parent          sh -c locale -a | grep -F .utf8 
09:42:50 fork 19302 child           sh -c locale -a | grep -F .utf8 
09:42:50 fork 19301 parent          sh -c locale -a | grep -F .utf8 
09:42:50 fork 19303 child           sh -c locale -a | grep -F .utf8 
Time     Event  PID  Info  Duration Process
09:42:50 exec 19303                 grep -F .utf8
09:42:50 exec 19302                 locale -a
09:42:50 exit 19302      0    0.001 locale -a
09:42:50 exit 19303      0    0.001 grep -F .utf8
09:42:50 exit 19301      0    0.002 sh -c locale -a | grep -F .utf8 
09:42:50 exit 19300      0    0.007 /usr/bin/perl /usr/share/language-tools/language-options
09:42:50 exit 19299      0    0.009 /bin/sh -e /usr/share/language-tools/language-validate en_GB:en
09:42:53 fork 19264 parent          bash
09:42:53 fork 19304 child           bash
09:42:53 exec 19304                 dmesg
09:42:53 exit 19304      0    0.052 dmesg
09:42:54 fork 19264 parent          bash
09:42:54 fork 19305 child           bash
09:42:54 exec 19305                 ps -ef
09:42:54 exit 19305      0    0.024 ps -ef
^C
    Fork     Exec     Exit Coredump     Comm    Total Process
      17       10        7        0        0       34 bash
       8        6        5        0        0       19 sh -c locale -a | grep -F .utf8 
       4        4        4        0        0       12 /usr/bin/perl /usr/share/language-tools/language-options
       4        4        4        0        0       12 /bin/sh -e /usr/share/language-tools/language-validate en_GB:en
       1        1        4        0        3        9 gnome-terminal
       4        4        0        0        0        8 /usr/lib/accountsservice/accounts-daemon
       3        2        2        0        0        7 /bin/sh /usr/bin/lesspipe
       2        1        2        0        2        7 compiz
       4        0        0        0        0        4 init --user --state-fd 29 --restart
       0        0        3        0        0        3 grep -F .utf8
       0        0        3        0        0        3 locale -a
       2        0        0        0        0        2 gnome-session --session=ubuntu
       0        1        1        0        0        2 grep
       0        1        0        0        0        1 locale
       0        0        1        0        0        1 ps -ef
       0        0        1        0        0        1 debian-distro-info --all
       0        0        1        0        0        1 ls /etc/bash_completion.d
       0        0        1        0        0        1 dmesg
       0        0        0        0        1        1 /usr/lib/x86_64-linux-gnu/indicator-session/indicator-session-service
       0        0        1        0        0        1 readlink -f /home/king/.canonistack/novarc
       0        0        1        0        0        1 dircolors -b
       0        0        1        0        0        1 groups
       0        0        1        0        0        1 ubuntu-distro-info --all
       0        0        1        0        0        1 dirname /usr/bin/lesspipe
       0        0        1        0        0        1 basename /usr/bin/lesspipe

forkstat's People

Contributors

colinianking avatar phi-gamma avatar

Stargazers

 avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar

Watchers

 avatar  avatar  avatar  avatar  avatar  avatar

forkstat's Issues

socket failed: errno=1 (Operation not permitted)

Hi there,

on
CentOS Linux release 7.9.2009 (Core)
forkstat, version 0.02.16

installed via snap, I get the following error when running as root:

socket failed: errno=1 (Operation not permitted)

Could you advise?

Many thanks!

sched_setscheduler (musl)

Hi, when building with musl instead of glibc (eg. under Alpine),
sched_setscheduler fails (options -r and -X).
This is due to musl's design per se (somewhat relevant threads: 1, 2, 3).

Including pthread.h & replacing it's single occurence in line 1909,
with pthread_setschedparam(pthread_self(),
seems to have done the trick here. Not really a C programmer myself,
would be nice though if such could be worked around in an official / proper manner.

All the best

monitor all processes in a cgroup or process group/tree

I've been looking at using forkstat to more deeply profile what is going on inside a docker container. I can find my container's pid cgroup easily enough and then post-process the forkstat output when my container is finished doing it's job.

But it would be really nice if I could ask forkstat to limit what it reports to a specific cgroup or children of a given pid/pgroup

Thanks :)

Any interest in extending features, to support something similar to the `-e` argument in strace?

Hey there- first, thanks for maintaining this, such a great use of a relatively little-known feature

I was curious if you had any interest in extending the functionality to allow specifying whitelists or blacklists; there would be a fast path to skip processing the event if, for example, the comm value matched a regex, exact string, or contained a substring of those specified on the command-line

Ultimately, this is to reduce a race window that exists as a consequence of the minimal data the netlink event includes. In other words, it's not quite fair or correct to call this a "bug" in forkstat - though enhancements could be made to address it (see the idea regarding threads as a more generic approach - though I'm not sure that would actually solve the issue in my use-case(s)

(Not Actually A) Solution

You may think "why not use forkstat -e exec | grep [-v] to filter out the events you don't want, dummy?" - this is a fair question, but it doesn't help with the race condition

Race When Gathering procfs Data For Short-Lived Processes

I have a somewhat unusual use-case, which is monitoring the system-wide behavior of different embedded devices (think IoT)

I often hit race conditions when exec events I'm not interested in fire, but are followed by another short-lived (but interesting) process and corresponding exec event. It's a surprisingly common thing on these sorts of devices, which constantly take hacky shortcuts like using popen() or system() (depending on whether they need output) rather than doing things properly in C. It results in lots of exec events constantly needing to be processed, which increases the frequency of the race occuring

Having a fast path to exit and forego the processing of procfs for an "uninteresting" process, as specified by the user on the CLI - perhaps based on a match of the comm value, or match on the link @ /proc/<pid>/exe link - could reduce the race window when the subsequent process is short-lived and of interest

It's not a generic or elegant solution, it's obviously very geared towards my issue. A more elegant and generic solution might be using threads to hand off the events, though I haven't tested that

So sure, I can filter useless events out with grep to reduce the stdout/stderr noise- butI can't do anything to reduce the cycles they burn when doing the procfs lookups`; so I end up hitting the race window between two events, because the second process (when short-lived) exits before its procfs data can be grabbed

Is This Really A Problem?

This may sound very edge-casey, and it is for sure on most modern servers and workstations. But for small devices with slow CPUs - especially those with horrid coding practices such as using popen("df -h", ...), popen("ps w | grep watched_proc"), popen("cat /proc/meminfo") - a lazy solution - than using native code to get the data (often EVERY SECOND!) it becomes very common for forkstat to get bogged down processing the uninteresting events long enough to lose a race in retrieving procfs info for the next (possibly interesting) short-lived exec call. The data is no longer available in procfs when the interesting event arrives and is handled, because that process exited quickly (or crashed) for whatever reason - so /proc/<pid> is gone

Hopefully I did a decent job of explaining the issue

Implementation

A regex-based solution might look something like this, to ignore invocations of cat, df and du:

$ forkstat -e exec --exclude-exe ^/bin/(cat|df|du)$

A simpler substring-based or exact-match-based solution would probably be sufficient well - more similar in syntax to strace -e<filter>, like this:

$ forkstat -e exec --filter '!/bin/df,/bin/du,/bin/sleep,/bin/cat

Alternatives

It's possible this might be something that could be solved by having concurrency handling the events- I'm not sure how effective it would be on some of these more limited devices, though it's another thing I'm considering looking into. It would require some locking for the output but that wouldn't really impact the processing of the events

I think the main thread could pretty easily pass off the events to new or pre-spawned threads, that could retrieve the data from procfs concurrently. I may look more into that

Caveats

The filtering wouldn't necessarily completely solve the problem; though in practice in my use-case, hard-coding some simple substring-based exclusions worked in the few cases I had

Development Time / Resourcing

I don't have a ton of free time, but I'm proficient in C, so I would do my best to contribute PRs if you're open to the idea. That said, I completely understand if you don't want to go down this road- it's an extremely powerful tool as-is and probably only a very, very small percentage of users lose the race I described

A Few Other Ideas I Implemented In a Crappy Fork

I have an option for skipping "duplicate" events if they're exact matches on some field to any of the previous N events (via a simple LRU cache style tracking mechanism); it's a great feature but only for certain use-cases. I don't know what most users use forkstat for, but for my case, I rarely care to see the same full path + cmdline exec event more than once during a forkstat session- because I'm really just trying to establish a baseline of the processes that fire, rather than track exactly when/how many times they fire. This is just another idea which happens to often have a side-effect of reducing the race window described above

FIN

Thanks for taking the time to review this. It's totally understandable if you would prefer this work to just remain a fork. But I thought I should at least ask. And to be clear, I don't have anything close to suitable to send as a PR currently

EDIT: Added example invocations of how it might look to use such a feature and fixed much of the language and structure so it's more coherent :>

update homepage URL

The official upstream URL for forkstat was https://kernel.ubuntu.com/~cking/forkstat/ in the past. But it now just gives a 404 error.

Could you please either bring back the old homepage or change the URL in the project listing and the packages you maintain (for example for ubuntu) to something that works. Thanks.

Request for help - init'ing netlink socket

Hi,

This isn't an issue with forkstat: I hope that's OK -

I am trying to reproduce some of forkstat's functionality in Python. It's a simple application to catch when a particular executable is exec'd or exits. At first, my code appeared not to work. However, when I ran forkstat (and exited) to test my kernel had the required features my code suddenly began working. It continues to work until reboot, after which it doesn't until I run forkstat again.

I think I'm missing the functionality of your netlink_listen function but my attempt at reproducing it doesn't work:

import os
import struct

...

NETLINK_CONNECTOR = 11  # include/uapi/linux/netlink.h
CN_IDX_PROC = 1  # include/uapi/linux/connector.h
CN_VAL_PROC = 1
NLMSG_DONE = 3
PROC_CN_MCAST_LISTEN = 1

...

def netlink_listen(sock):
    # 'III' - 3 x unsigned int
    nlmsghdr_size = struct.calcsize('III')
    # 'II' - 2 x unsigned int
    cn_msg_size = struct.calcsize('II')

    nlmsghdr_data = struct.pack('III', nlmsghdr_size + cn_msg_size + struct.calcsize('I'), os.getpid(), NLMSG_DONE)
    cn_msg_data = struct.pack('II', CN_IDX_PROC, CN_VAL_PROC) + struct.pack('I', cn_msg_size)
    op_data = struct.pack('I', PROC_CN_MCAST_LISTEN)

    message = nlmsghdr_data + cn_msg_data + op_data

    sock.sendall(message)

Can you point me to any documentation on how to initialise the socket, once it's been created and bound (as follows, in case it helps)? -

sock = socket.socket(socket.AF_NETLINK, socket.SOCK_RAW, NETLINK_CONNECTOR)
sock.bind((0, CN_IDX_PROC))

Thank you,

Jim.

EDIT: I've confirmed that the forkstat netlink_listen function is what's causing my code to work. If I replace:

return writev(sock, iov, 3);

with:

return 0;

My code does not receive events (and nor does forkstat, unsurprisingly).

I got the data sent by writev(sock, iov, 3) by adding the following to the end of netlink_listen and tried sending that (converted back to binary) in my Python code but it didn't cause events to be received.

	for (int i = 0; i < sizeof(struct iovec); i++) {
  		printf("%02X ", ((unsigned char*)&iov)[i]);
	}

Empty argument causes the rest to be ignored

Hi,

With all current versions, if a program's command line has a zero-length arg, the forkstat output line stops at that arg and discards everything beyond:

$ /bin/true One Two "" Three Four

Output:

Time     Event     PID Info   Duration Process
07:37:25 fork   538365 parent          bash
07:37:25 fork   538433 child           bash
07:37:25 exec   538433                 /bin/true One Two
07:37:25 exit   538433      0   0.002s /bin/true One Two

Recommend Projects

  • React photo React

    A declarative, efficient, and flexible JavaScript library for building user interfaces.

  • Vue.js photo Vue.js

    ๐Ÿ–– Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.

  • Typescript photo Typescript

    TypeScript is a superset of JavaScript that compiles to clean JavaScript output.

  • TensorFlow photo TensorFlow

    An Open Source Machine Learning Framework for Everyone

  • Django photo Django

    The Web framework for perfectionists with deadlines.

  • D3 photo D3

    Bring data to life with SVG, Canvas and HTML. ๐Ÿ“Š๐Ÿ“ˆ๐ŸŽ‰

Recommend Topics

  • javascript

    JavaScript (JS) is a lightweight interpreted programming language with first-class functions.

  • web

    Some thing interesting about web. New door for the world.

  • server

    A server is a program made to process requests and deliver data to clients.

  • Machine learning

    Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.

  • Game

    Some thing interesting about game, make everyone happy.

Recommend Org

  • Facebook photo Facebook

    We are working to build community through open source technology. NB: members must have two-factor auth.

  • Microsoft photo Microsoft

    Open source projects and samples from Microsoft.

  • Google photo Google

    Google โค๏ธ Open Source for everyone.

  • D3 photo D3

    Data-Driven Documents codes.