1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
|
#! /usr/bin/env stap
// Copyright (c) 2009, 2015 Red Hat Inc.
//
// This file is part of systemtap, and is free software. You can
// redistribute it and/or modify it under the terms of the GNU General
// Public License (GPL); either version 2, or (at your option) any
// later version.
probe kernel.function("autofs4_lookup") !,
module("autofs4").function("autofs4_lookup")
{
/*
* Don't log automounts travels in its own directory hierarchy, as
* they are treated differently, and certainly not something that is
* useful for admins to see.
*/
if (!isinstr(execname(), "automount")) {
printf("%s process %s[%d] looking up %s%s\n",
ctime(gettimeofday_s()), execname(), pid(),
(@defined($nd) ? fullpath_struct_nameidata($nd)
: inode_name($dir)),
d_name($dentry));
}
}
probe kernel.function("autofs4_follow_link") !,
module("autofs4").function("autofs4_follow_link")
{
if (!isinstr(execname(), "automount")) {
/*
* dentry->d_name will be '/' for the mount trigger. Thus,
* the path that the trigger lives on is one level up the
* directory stack, and the root of that is yet another level
* up.
*/
printf("%s process %s[%d] following mount trigger %s\n",
ctime(gettimeofday_s()), execname(), pid(),
(@defined($nd) ? d_path($nd)
: reverse_path_walk($dentry)))
}
}
probe kernel.function("autofs4_expire_direct").return !,
module("autofs4").function("autofs4_expire_direct").return ?
{
if ($return != 0) {
if (@defined($mnt->mnt_mountpoint)) {
relative_path = reverse_path_walk(@entry($mnt->mnt_mountpoint))
root_path = sprintf("/%s", reverse_path_walk(@entry($mnt->mnt_parent->mnt_mountpoint)))
}
else {
relative_path = ""
root_path = task_dentry_path(task_current(), @entry($mnt->mnt_root), @entry($mnt))
}
printf("%s process %s[%d] expiring direct mount %s/%s\n",
ctime(gettimeofday_s()), execname(), pid(),
root_path, relative_path)
}
}
/*
probe
module("autofs4").statement("autofs4_expire_direct@fs/autofs4/expire.c+17").nearest ?
{
relative_path = reverse_path_walk($mnt->mnt_mountpoint)
root_path = reverse_path_walk($mnt->mnt_parent->mnt_mountpoint)
printf("%s process %s[%d] expiring direct mount /%s/%s\n",
ctime(gettimeofday_s()), execname(), pid(),
root_path, relative_path)
}
*/
probe kernel.function("autofs4_expire_indirect").return !,
module("autofs4").function("autofs4_expire_indirect").return
{
if ($return != 0) {
relative_path = reverse_path_walk($return)
root_path = (@defined($mnt->mnt_root)
? task_dentry_path(task_current(),
@entry($mnt->mnt_root), @entry($mnt))
: reverse_path_walk(@entry($mnt->mnt_mountpoint)))
printf("%s process %s[%d] expiring indirect mount %s/%s\n",
ctime(gettimeofday_s()), execname(), pid(),
root_path, relative_path)
}
}
/*
* The struct dentry's name may be '/' if this is a mount trigger, which
* is not really something that is useful to print out. Instead, we just
* indicate whether a mount or umount succeeded or failed. Coupled with the
* messages printed out when looking up a directory and traversing a symlink,
* this should be relatively easy to correlate to the appropriate directory.
*/
probe kernel.function("autofs4_wait").return !,
module("autofs4").function("autofs4_wait").return
{
if (@entry($notify) > 0) {
dname = d_name(@entry($dentry))
printf("%s %s of %s %s\n",
ctime(gettimeofday_s()),
(@entry($notify)==1?"mount":"unmount"),
dname,
$return == 0?"succeeded":"failed")
}
}
|
