Current File : //usr/share/systemtap/examples/profiling/container_check.meta
title: Monitor capabilities and syscalls used by a process and it children
name: container_check.stp
version: 1.0
author: William Cohen
keywords: profiling container syscall
subsystem: any
status: production
exit: user-controlled
output: sorted-list
scope: process
description: The container_check.stp script monitors the use of linux capablities and optionally forbidden syscalls by a process and its children. On exit the script prints out lists showing the capabilies used by each executable, which syscall used specific capabilites for each executable, a list of forbidden syscalls used, and details on any syscalls that failed during monitoring. This script is designed to help diagnose issues caused by restricted capabilies and syscalls when running an application in a container. If the script warns about skipped probes, the number of active kretprobes may need to be increased with "-DKRETACTIVE=100" option on the command line
test_check: stap -p4 container_check.stp
test_installcheck: stap container_check.stp -c "ping -c 1 sourceware.org || true"
Mini Shell