Server : Apache System : Linux server2.corals.io 4.18.0-348.2.1.el8_5.x86_64 #1 SMP Mon Nov 15 09:17:08 EST 2021 x86_64 User : corals ( 1002) PHP Version : 7.4.33 Disable Function : exec,passthru,shell_exec,system Directory :  /opt/rh/gcc-toolset-11/root/usr/share/systemtap/examples/network/

Upload File : current_dir [ Writeable ] document_root [ Writeable ]

#!/opt/rh/gcc-toolset-11/root/usr/bin/stap

############################################################
# connect_stat.stp
# Author: Robin Hack <[email protected]>
# An example script show process tree of process
# which tried to call connect with specific ip address
############################################################

function process_tree (ip:string) {
    cur_proc = task_current();
    parent_pid = task_pid(task_parent (cur_proc));

    printf ("%s: ", ip);
    while (parent_pid != 0) {
        printf ("%s (%d),%d,%d -> ", task_execname(cur_proc), task_pid(cur_proc), task_uid(cur_proc),task_gid (cur_proc));
        cur_proc = task_parent(cur_proc);
        parent_pid = task_pid(task_parent (cur_proc));
    }
    # init process
    if (task_pid (cur_proc) == 1) {
        printf ("%s (%d),%d,%d\n", task_execname(cur_proc), task_pid(cur_proc), task_uid(cur_proc),task_gid (cur_proc));
    }
}

probe syscall.connect {
    if ((uaddr_af !~ "AF_INET*") || (uaddr_ip != @1)) {
        next;
    }
    process_tree (uaddr_ip);
}