sofdsnoop - Trace FDs passed through unix sockets. Uses Linux eBPF/bcc.

       Jiri Olsa

       sofdsnoop traces FDs passed through unix sockets

       Every file descriptor that is passed via unix sockets os displayed on separate line together with process
       info  (TID/COMM  columns), ACTION details (SEND/RECV), file descriptor number (FD) and its translation to
       file if available (NAME).

       Since this uses BPF, only the root user can use this tool.

       Trace all sockets:
              # sofdsnoop

       Trace all sockets, and include timestamps:
              # sofdsnoop-T

       Only trace sockets where the process contains "server":
              # sofdsnoop-nserver

       TIME(s)
              Time of SEDN/RECV actions, in seconds.

       ACTION Operation on the fd SEND/RECV.

       TID    Process TID

       COMM   Parent process/command name.

       SOCKET The socket carrier.

       FD     file descriptor number

       NAME   file name for SEND lines

       sofdsnoop - Trace FDs passed through unix sockets. Uses Linux eBPF/bcc.

       -h     Print usage message.

       -T     Include a timestamp column.

       -p PID Trace this process ID only (filtered in-kernel).

       -t TID Trace this thread ID only (filtered in-kernel).

       -d DURATION
              Total duration of trace in seconds.

       -n NAME
              Only print command lines matching this command name (regex)

       Linux

       CONFIG_BPF and bcc.

opensnoop(1)

USER COMMANDS                                      2018-11-08                                       sofdsnoop(8)

       This is from bcc.

              https://github.com/iovisor/bcc

       Also look in the bcc distribution for a companion _examples.txt file containing  example  usage,  output,
       and commentary for this tool.

       Unstable - in development.

sofdsnoop[-h][-T][-pPID][-tTID][-nNAME][-dDURATION]