a2o / snoopy Goto Github PK
View Code? Open in Web Editor NEWSnoopy Command Logger is a small library that logs all program executions on your Linux/BSD system.
License: GNU General Public License v2.0
Snoopy Command Logger is a small library that logs all program executions on your Linux/BSD system.
License: GNU General Public License v2.0
When I install Snoopy 1.8.0 on Ubuntu 12.04 using Apt package manager, I get the following scary prompt:
"Snoopy is a library that can only reliably do its work if it is mandatorily preloaded via /etc/ld.so.preload. Since this can potentially do harm to the system, your consent is needed"
Can someone shed some light as to what kind harm may this cause to a system? I've never encountered any issues with Snoopy, and I want to make sure I could use it in a production environment.
Create new data source: timestamp.
It might be useful if Snoopy is logging by writting directly to file.
Bug in master:
#2106 __GI_abort () at abort.c:125
act = {__sigaction_handler = {sa_handler = 0x0, sa_sigaction = 0x0}, sa_mask = {__val = {18446744073709551615 <repeats 16 times>}},
sa_flags = 0, sa_restorer = 0x0}
sigs = {__val = {32, 0 <repeats 15 times>}}
#2107 0x00007fd8fa1f3394 in __libc_message (do_abort=do_abort@entry=1, fmt=fmt@entry=0x7fd8fa301b28 "*** Error in `%s': %s: 0x%s ***\n")
at ../sysdeps/posix/libc_fatal.c:175
ap = {{gp_offset = 40, fp_offset = 32728, overflow_arg_area = 0x7fd85c275470, reg_save_area = 0x7fd85c275400}}
fd = 2
on_2 = <optimized out>
list = <optimized out>
nlist = <optimized out>
cp = <optimized out>
written = <optimized out>
---Type <return> to continue, or q <return> to quit---
#2108 0x00007fd8fa1ff66e in malloc_printerr (ptr=<optimized out>, str=0x7fd8fa301c58 "double free or corruption (out)", action=1) at malloc.c:4996
buf = "00007fd8b84d1b50"
cp = <optimized out>
#2109 _int_free (av=<optimized out>, p=<optimized out>, have_lock=0) at malloc.c:3840
size = <optimized out>
fb = <optimized out>
nextchunk = <optimized out>
nextsize = <optimized out>
nextinuse = <optimized out>
prevsize = <optimized out>
bck = <optimized out>
fwd = <optimized out>
errstr = <optimized out>
locked = <optimized out>
#2110 0x00007fd8fab8bd89 in snoopy_configuration_dtor () at configuration.c:128
No locals.
#2111 0x00007fd8fab8cb57 in snoopy_cleanup () at misc.c:75
No locals.
#2112 0x00007fd8fab8ca98 in snoopy_log_syscall (syscallName=syscallName@entry=0x7fd8fab8f396 "execve") at log.c:398
logMessage = <optimized out>
#2113 0x00007fd8fab8cb33 in snoopy_log_syscall_execve (filename=filename@entry=0x7fd85c2755a0 "/usr/bin/git", argv=argv@entry=0x7fd8dc0247b0,
envp=envp@entry=0x7fd8dc044f60) at log.c:348
No locals.
#2114 0x00007fd8fab8bd35 in execve (filename=0x7fd85c2755a0 "/usr/bin/git", argv=0x7fd8dc0247b0, envp=0x7fd8dc044f60) at libsnoopy.c:76
func = 0x7fd8fa241330 <__execve>
#2115 0x00007fd8f891ee8e in execve_with_shell_fallback () from /usr/lib/jvm/java-8-oracle/jre/lib/amd64/libjava.so
No symbol table info available.
#2116 0x00007fd8f891f0e1 in JDK_execvpe () from /usr/lib/jvm/java-8-oracle/jre/lib/amd64/libjava.so
No symbol table info available.
#2117 0x00007fd8f891f4fb in childProcess () from /usr/lib/jvm/java-8-oracle/jre/lib/amd64/libjava.so
No symbol table info available.
#2118 0x00007fd8f891c474 in vforkChild () from /usr/lib/jvm/java-8-oracle/jre/lib/amd64/libjava.so
No symbol table info available.
#2119 0x00007fd8f891cdc0 in Java_java_lang_UNIXProcess_forkAndExec () from /usr/lib/jvm/java-8-oracle/jre/lib/amd64/libjava.so
I have Snoopy (the last version + my pull request) running in many servers, when a server is restarted the jvm falls:
hs_err_pid:
A fatal error has been detected by the Java Runtime Environment:
SIGSEGV (0xb) at pc=0x00007fab985724d7, pid=15146, tid=140374290736896
JRE version: Java(TM) SE Runtime Environment (7.0_40-b43) (build 1.7.0_40-b43)
Java VM: Java HotSpot(TM) 64-Bit Server VM (24.0-b56 mixed mode linux-amd64 compressed oops)
Problematic frame:
C [libc.so.6+0x3a4d7] abort+0x297
...................
...................
...................
Stack: [0x00007fab6fac2000,0x00007fab6fbc3000], sp=0x00007fab6fbbf900, free space=1014k
Native frames: (J=compiled Java code, j=interpreted, Vv=VM code, C=native code)
C [libc.so.6+0x3a4d7] abort+0x297
Java frames: (J=compiled Java code, j=interpreted, Vv=VM code)
j java.lang.UNIXProcess.forkAndExec([B[BI[BI[B[IZ)I+0
j java.lang.UNIXProcess.([B[BI[BI[B[IZ)V+19
j java.lang.ProcessImpl.start([Ljava/lang/String;Ljava/util/Map;Ljava/lang/String;[Ljava/lang/ProcessBuilder$Redirect;Z)Ljava/lang/Process;+433
j java.lang.ProcessBuilder.start()Ljava/lang/Process;+124
j org.apache.hadoop.util.Shell.runCommand()V+125
j org.apache.hadoop.util.Shell.run()V+23
j org.apache.hadoop.util.Shell$ShellCommandExecutor.execute()V+1
j org.apache.hadoop.yarn.server.nodemanager.DefaultContainerExecutor.launchContainer(Lorg/apache/hadoop/yarn/server/nodemanager/containermanager/ container/Container;Lorg/apache/hadoop/fs/Path;Lorg/apache/hadoop/fs/Path;Ljava/lang/String;Ljava/lang/String;Lorg/apache/hadoop/fs/Path;Ljava/util/ List;Ljava/util/List;)I+521
j org.apache.hadoop.yarn.server.nodemanager.containermanager.launcher.ContainerLaunch.call()Ljava/lang/Integer;+1097
j org.apache.hadoop.yarn.server.nodemanager.containermanager.launcher.ContainerLaunch.call()Ljava/lang/Object;+1
j java.util.concurrent.FutureTask.run()V+42
j java.util.concurrent.ThreadPoolExecutor.runWorker(Ljava/util/concurrent/ThreadPoolExecutor$Worker;)V+95
j java.util.concurrent.ThreadPoolExecutor$Worker.run()V+5
j java.lang.Thread.run()V+11
v ~StubRoutines::call_stub
apport.log:
ERROR: apport (pid 26360) Thu Apr 16 10:41:10 2015: called for pid 26323, signal 11, core limit 0
ERROR: apport (pid 26360) Thu Apr 16 10:41:10 2015: executable: /usr/lib/jvm/java-7-oracle/bin/java (command line "/usr/lib/jvm/java-7-oracle//bin/java -Dproc_nodemanager -Xmx4000m -Dhadoop.log.dir=/home/hadoop/hadoop-2.5.0/logs -Dyarn..............
ERROR: apport (pid 26360) Thu Apr 16 10:41:10 2015: is_closing_session(): no DBUS_SESSION_BUS_ADDRESS in environment
ERROR: apport (pid 26360) Thu Apr 16 10:42:51 2015: wrote report /var/crash/_usr_lib_jvm_java-7-oracle_bin_java.1002.crash
The errors were produced using jenkins and hadoop, do you have any idea what could be the problem?
This would probably cause buffer overflow if config file vanished suddenly.
Migrating issue from SourceForge:
https://sourceforge.net/tracker/?func=detail&aid=3437904&group_id=9226&atid=109226
Extensive info here:
https://bugzilla.redhat.com/show_bug.cgi?id=745603
Able to reproduce:
Unable to reproduce on:
Currently message format can be specified like this (in snoopy.ini):
message_format = "ds1=%{datasource1} ds2=%{datasource2:param1,param2}..."
Then only whole message can be filtered, like this:
filter_chain = "exclude_uid:1,2,3;exclude_spawns_of:crond"
It would be splendid if filters could be applied to only specific datasource, right in message format, like this:
message_format = 'ds1:"%{ds1|escape_json_str}" ds2="%{ds2:param1|escape_json_str}"...'
The question that needs to be answered is: do we implement this among existing filters, or do we create new entity class (modifiers, manglers, etc) which does only data mangling.
If, like us, you have users running desktop environments, you'll find pulseaudio filling your logs because of snoopy.
In this instance:
In /etc/pulse/client.conf
If it exists, uncomment "autospawn" and change to "no", otherwise, add a line
"autospawn = no"
(This is not a bug, but is informational, and I saw no where else to put it).
We have users who commonly are required to "sudo su" or "sudo -s" on our servers. We have noticed that we see the commands ran from the user when they login however, when they are sudo'd it shows as uid:0 and there is not a way to trace the command run back to the original uid.
So, if we have 2 users who login, they both sudo su. One runs rm -rf /home, the other runs touch /var/log/logtest.txt.
Snoopy records the commands as both being from root, but which user ran which command?
Is there a way to change this, or am I doing something wrong with Snoopy?
Thanks,
Tim
Create output that sends content as plain UDP packet.
Note: TCP output will not be created - it is stateful and might be blocking, which is undesired when spawning a new process. Or maybe it should be created, but disabled by default and with lots of warnings.
Additionally attention must be paid if remote end is configured as hostname/domain instead of IP address. This could block the whole exec process, which is not good.
Create alternative output - write directly to file.
This is with the current deb package for ubuntu 12.04 (1.8.0-3) so it could be that it's fixed already in later versions, but thought I would let you know just in case.
If the cwd where the program was started has been removed, snoopy log entry gets corrupted and instead of cwd we see some other data apparently from /proc/pid/status:
Nov 3 10:50:53 app-02 snoopy[32273]: [uid:991 sid:10362 tty: cwd:#011 674656 kB#012VmLck:#011 0 kB#012VmPin:#011 0 kB#012VmHWM:#011 148236 kB#012VmRSS:#011 148236 kB#012VmData:#011 498252 kB#012VmStk:#011 136 kB#012VmExe:#011 4 kB#012VmLib:#011 15720 kB#012VmPTE:#011 720 kB#012VmSwap:#011 18564 kB#012Threads:#0111#012SigQ:#0110/241213#012SigPnd:#0110000000000000000#012ShdPnd:#0110000000000000000#012SigBlk:#0110000000000000000#012SigIgn:#0110000000008300801#012SigCgt:#0110000000182007646#012CapInh:#0110000000000000000#012CapPrm:#0110000000000000000#012CapEff:#0110000000000000000#012CapBnd:#011ffffffffffffffff#012Cpus_allowed:#0117fff#012Cpus_allowed_list:#0110-14#012Mems_allowed:#01100000000,00000001#012Mems_allowed_list:#0110#012voluntary_ctxt_switches:#0110#012nonvoluntary_ctxt_switches:#0110#012#031�#003 filename:/path/to/file]: ...```
hello
snoopy only logs root , how i change it to log all users ?
and i only what to log the command and not what the sheel script do inside,
thanks
libtool: compile: gcc -DHAVE_CONFIG_H -I. -I.. -Wall -Werror -g -O2 -MT misc.lo -MD -MP -MF .deps/misc.Tpo -c misc.c -fPIC -DPIC -o .libs/misc.o
cc1: warnings being treated as errors
misc.c: In function 'snoopy_string_append':
misc.c:112: error: call to function 'snoopy_error_handler' without a real prototype
error.h:28: note: 'snoopy_error_handler' was declared here
Migrating issue from sourceforge (and closing issue tracker there):
https://sourceforge.net/tracker/?func=detail&atid=359226&aid=3598683&group_id=9226
At first, I was thinking of making a patch vaguely along the lines of:
--- a/snoopy.h
+++ b/snoopy.h
@@ -9,5 +9,5 @@
*
- Maximum size of any argument.
*/
-#define SNOOPY_MAX_ARG_LENGTH 4096
-
+#include <unistd.h>
+#define SNOOPY_MAX_ARG_LENGTH sysconf(_SC_ARG_MAX)
To make sure snoopy is logging the max default (without futzing with rlimit stack sizes) possible execve() command line. Then I noticed you mentioned on the forum to open a bug and track the progress here. Since snoopy is auditing software (vaguely reminiscent of the keystroke logging aspect of power broker), I'd like it to have the ability to log the maximum available execve() line. Does something like the above patch make sense? If so, I'd like to create a proper git patch and sen you a pull request on github. If not, how could we make it configurable? Build time is fine.
I actually wish this was the github issue tracker bug as it makes it much easier to link to specific code or annotate the code inline via markdown, but I digress! Awesome software by the way!
(originally submitted by Jeff Schroeder)
Create output that sends content as plain UDP SYSLOG packet.
Note: TCP SYSLOG output will not be created - it is stateful and might be blocking, which is undesired when spawning a new process. Or maybe it should be created, but disabled by default and with lots of warnings.
Starting AutoTools run:
AM_PROG_AR' not found in library libtoolize:
./ltmain.sh' is newer: use --force' to overwrite libtoolize:
m4/libtool.m4' is newer: use --force' to overwrite libtoolize:
m4/ltoptions.m4' is newer: use --force' to overwrite libtoolize:
m4/ltversion.m4' is newer: use --force' to overwrite libtoolize:
m4/lt~obsolete.m4' is newer: use --force' to overwrite libtoolize:
AC_PROG_RANLIB' is rendered obsolete by LT_INIT' configure.ac:13: warning: macro
AM_PROG_AR' not found in libraryAny idea why the build isn't working? I cloned from master/latest. I'll try a tag next.
Now all outputs are iterated in configfile.c and snoopy.h. We must use outputregistry to check if configured output is valid.
b.
I tried to show the ppid but not displayed correctly, if I enter to a machine via ssh, the ppid would not have to be the ppid of sshd?
Flag named "--enable-filter" is a historic remaining from the past when Snoopy implemented a feature called "external filter", which ended in disaster (too easy to lockup a system by careless external filter implementation.
Now --enable-filter inaccurately represents filtering facility of Snoopy. In future we will implement separate ./configure flags for each data source, filter and output. Then --enable-filter would be very ambiguous. Therefore naming flags to --enable-filtering and --with-filter-X is a proper thing to do.
There should be a possibility to add filtering capability to snoopy.
Background:
Certain versions of snoopy had a feature called "external filter". What it did was it called external program to filter log line just before snoopy would send it so syslog, giving users a possibility to manipulate log entries.
Needless to say, it was a disaster, lots of hanged systems because of execution loops (snoopy->filter->snoopyLogFilter->filter->...)
The idea was formed then, that filtering implementation should be moved from external to internal. This would give users free hands at log line manipulation, but at the expense of complexity (it must be done in C instead in bash+sed, for example).
The suggested implementation would be somewhere along these lines:
Comments?
b.
Here is the official feature discussion about customisable logging format.
It seems we have two options:
Configuration file seems more flexible, but also more prone to errors. Using compile-time configuration would be more cumbersome for those who do not compile packages themselves.
The most sensible way to go about this would be to make two things available at configuration time
The flow would then go like this:
Would anyone care to share an opinion about this?
b.
Using snoopy version 2.2.4.
Seems to be the same issue as this one
I tried updating the kernel to a newer one : no difference, same problem.
Executing the command /usr/local/sbin/snoopy-disable
before doing a reboot/shutdown will make the reboot/shutdown go smoothly but snoopy will be disabled after the reboot so that's not a solution.
With snoopy enabled, I'm able to force a shutdown with this command sync && poweroff -f
. According to this site it means that the problem is not the kernel and is in fact systemd.
With this howto I redirected the console output to the serial port so I could get the error message when the system hangs. The error message tells that there was a problem in the libsnoopy library that made systemd crash.
[ 51.825594] systemd-shutdow[1]: segfault at 0 ip 00007fbc63ea8cfe sp 00007fff47409240 error 4 in libsnoopy.so.0.0.0[7fbc63ea3000+8000]
[ 51.828672] Kernel panic - not syncing: Attempted to kill init! exitcode=0x0000000b
[ 51.828672]
[ 51.830418] CPU: 0 PID: 1 Comm: systemd-shutdow Not tainted 3.19.0-1.el7.elrepo.x86_64 #1
[ 51.832048] Hardware name: VMware, Inc. VMware Virtual Platform/440BX Desktop Reference Platform, BIOS 6.00 07/30/2013
[ 51.834178] 0000000000000000 0000000010433703 ffff88013a407c58 ffffffff816991bd
[ 51.835784] 0000000000000000 ffffffff818e3058 ffff88013a407cd8 ffffffff81693510
[ 51.837400] ffff880100000010 ffff88013a407ce8 ffff88013a407c88 0000000010433703
[ 51.839000] Call Trace:
[ 51.839512] [<ffffffff816991bd>] dump_stack+0x45/0x57
[ 51.840552] [<ffffffff81693510>] panic+0xd0/0x204
[ 51.841515] [<ffffffff8107a2ef>] do_exit+0xa3f/0xb30
[ 51.842524] [<ffffffff8107a46f>] do_group_exit+0x3f/0xa0
[ 51.843605] [<ffffffff810860d3>] get_signal+0x1e3/0x730
[ 51.844666] [<ffffffff81014537>] do_signal+0x37/0x750
[ 51.845694] [<ffffffff810cd0e9>] ? vprintk_default+0x29/0x40
[ 51.846842] [<ffffffff811ac26f>] ? do_munmap+0x29f/0x3b0
[ 51.847918] [<ffffffff81014cb9>] do_notify_resume+0x69/0xb0
[ 51.849047] [<ffffffff816a1d62>] retint_signal+0x48/0x86
[ 51.850178] Kernel Offset: 0x0 from 0xffffffff81000000 (relocation range: 0xffffffff80000000-0xffffffff9fffffff)
[ 51.852174] ---[ end Kernel panic - not syncing: Attempted to kill init! exitcode=0x0000000b
[ 51.852174]
Originally reported by @ajzach in issue #39:
Error with master version (ff587e):
# SIGSEGV (0xb) at pc=0x00007fbd09d93a03, pid=1507, tid=140447328962304
#
# JRE version: Java(TM) SE Runtime Environment (8.0_11-b12) (build 1.8.0_11-b12)
# Java VM: Java HotSpot(TM) 64-Bit Server VM (25.11-b03 mixed mode linux-amd64 compressed oops)
# Problematic frame:
# C [libc.so.6+0x4ba03] _IO_vfprintf+0x1d13
..............................
..............................
..............................
Stack: [0x00007fbc71170000,0x00007fbc71271000], sp=0x00007fbc7126bc20, free space=1007k
Native frames: (J=compiled Java code, j=interpreted, Vv=VM code, C=native code)
C [libc.so.6+0x4ba03] _IO_vfprintf+0x1d13
Java frames: (J=compiled Java code, j=interpreted, Vv=VM code)
j java.lang.UNIXProcess.forkAndExec(I[B[B[BI[BI[B[IZ)I+0
j java.lang.UNIXProcess.<init>([B[BI[BI[B[IZ)V+28
J 12594 C1 java.lang.ProcessImpl.start([Ljava/lang/String;Ljava/util/Map;Ljava/lang/String;[Ljava/lang/ProcessBuilder$Redirect;Z)Ljava/lang/Process; (634 bytes) @ 0x00007fbcf7129fd4 [0x00007fbcf7128fc0+0x1014]
J 12304 C1 java.lang.ProcessBuilder.start()Ljava/lang/Process; (303 bytes) @ 0x00007fbcf70184cc [0x00007fbcf7017ac0+0xa0c]
j hudson.Proc$LocalProc.<init>(Ljava/lang/String;Ljava/lang/ProcessBuilder;Ljava/io/InputStream;Ljava/io/OutputStream;Ljava/io/OutputStream;)V+55
J 12588 C1 hudson.Proc$LocalProc.<init>([Ljava/lang/String;[Ljava/lang/String;Ljava/io/InputStream;Ljava/io/OutputStream;Ljava/io/OutputStream;Ljava/io/File;)V (52 bytes) @ 0x00007fbcf7124f7c [0x00007fbcf7124b40+0x43c]
#2085 __GI_abort () at abort.c:125
---Type <return> to continue, or q <return> to quit---
act = {__sigaction_handler = {sa_handler = 0x7fbd04146ce4, sa_sigaction = 0x7fbd04146ce4}, sa_mask = {__val = {140449793993955,
140449793993955, 140449885647857, 11, 140447328939072, 140449793993956, 0, 0, 0, 0, 140449898820457, 0, 140449883661430, 0,
140449898820457, 0}}, sa_flags = 158114934, sa_restorer = 0x7fbc7126a9a0}
sigs = {__val = {0, 0, 0, 0, 0, 140447328938208, 140447328938928, 140447328938400, 11, 140447328939072, 140447328938928, 140449881522244,
206158430248, 140447328938416, 140447328938224, 140449793993956}}
#2086 0x00007fbd096bd339 in os::die() () from /usr/lib/jvm/java-8-oracle/jre/lib/amd64/server/libjvm.so
No symbol table info available.
#2087 0x00007fbd0984f7c2 in VMError::report_and_die() () from /usr/lib/jvm/java-8-oracle/jre/lib/amd64/server/libjvm.so
No symbol table info available.
#2088 0x00007fbd0984fe4e in crash_handler(int, siginfo*, void*) () from /usr/lib/jvm/java-8-oracle/jre/lib/amd64/server/libjvm.so
No symbol table info available.
#2089 <signal handler called>
No locals.
#2090 __GI_abort () at abort.c:125
act = {__sigaction_handler = {sa_handler = 0x0, sa_sigaction = 0x0}, sa_mask = {__val = {18446744073709551615 <repeats 16 times>}},
sa_flags = 0, sa_restorer = 0x0}
sigs = {__val = {32, 0 <repeats 15 times>}}
#2091 0x00007fbd096bf115 in os::abort(bool) () from /usr/lib/jvm/java-8-oracle/jre/lib/amd64/server/libjvm.so
No symbol table info available.
#2092 0x00007fbd0984f9a3 in VMError::report_and_die() () from /usr/lib/jvm/java-8-oracle/jre/lib/amd64/server/libjvm.so
No symbol table info available.
#2093 0x00007fbd096c44e2 in JVM_handle_linux_signal () from /usr/lib/jvm/java-8-oracle/jre/lib/amd64/server/libjvm.so
No symbol table info available.
#2094 0x00007fbd096bb463 in signalHandler(int, siginfo*, void*) () from /usr/lib/jvm/java-8-oracle/jre/lib/amd64/server/libjvm.so
No symbol table info available.
#2095 <signal handler called>
No locals.
#2096 0x00007fbd09d93a03 in _IO_vfprintf_internal (s=s@entry=0x7fbc7126c210, format=<optimized out>, format@entry=0x7fbd0a7578d0 "%s",
ap=ap@entry=0x7fbc7126c378) at vfprintf.c:1661
len = <optimized out>
string_malloced = <optimized out>
step0_jumps = {0, -9485, -2676, -2589, 2607, 2694, 2015, 2291, 2998, -574, -238, 3335, 2510, 3607, -2495, -15046, -727, 1092, 1034, 1620,
-14278, -28, 1449, -10481, -10405, -15728, 1138, 3510, 3510, 2188}
space = 0
is_short = 0
use_outdigits = 0
step1_jumps = {0, 0, 0, 0, 0, 0, 0, 0, 0, -574, -238, 3335, 2510, 3607, -2495, -15046, -727, 1092, 1034, 1620, -14278, -28, 1449, -10481,
-10405, -15728, 1138, 3510, 3510, 0}
---Type <return> to continue, or q <return> to quit---
group = 0
prec = -1
step2_jumps = {0, 0, 0, 0, 0, 0, 0, 0, 0, 0, -238, 3335, 2510, 3607, -2495, -15046, -727, 1092, 1034, 1620, -14278, -28, 1449, -10481,
-10405, -15728, 1138, 3510, 3510, 0}
string = <optimized out>
left = 0
is_long_double = 0
width = 0
step3a_jumps = {0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 3238, 0, 0, 0, -2495, -15046, -727, 1092, 1034, 0, 0, 0, 0, -10481, 0, 0, 0, 0, 0, 0}
alt = 0
showsign = 0
is_long = 0
is_char = 0
pad = 32 ' '
step3b_jumps = {0 <repeats 11 times>, 2510, 0, 0, -2495, -15046, -727, 1092, 1034, 1620, -14278, -28, 1449, -10481, -10405, -15728, 1138, 0,
0, 0}
step4_jumps = {0 <repeats 14 times>, -2495, -15046, -727, 1092, 1034, 1620, -14278, -28, 1449, -10481, -10405, -15728, 1138, 0, 0, 0}
is_negative = <optimized out>
number = <optimized out>
base = <optimized out>
the_arg = {pa_wchar = 175470802 L'\xa7578d2', pa_int = 175470802, pa_long_int = 140449901017298, pa_long_long_int = 140449901017298,
pa_u_int = 175470802, pa_u_long_int = 140449901017298, pa_u_long_long_int = 140449901017298, pa_double = 6.9391471054450486e-310,
pa_long_double = <invalid float value>, pa_string = 0x7fbd0a7578d2 "",
pa_wstring = 0x7fbd0a7578d2 <error: Cannot access memory at address 0x7fbd0a7578d2>, pa_pointer = 0x7fbd0a7578d2, pa_user = 0x7fbd0a7578d2}
spec = 115 's'
_buffer = {__routine = 0x3000000018, __arg = 0x7fbc7126c470, __canceltype = 1898365872, __prev = 0x0}
_avail = <optimized out>
thousands_sep = 0x0
grouping = 0xffffffffffffffff <error: Cannot access memory at address 0xffffffffffffffff>
done = 0
f = 0x7fbd0a7578d1 "s"
lead_str_end = <optimized out>
end_of_spec = <optimized out>
work_buffer = "(\000\000\000\060\000\000\000\240\304&q\274\177\000\000\340\303&q\274\177\000\000\240\304&q\274\177\000\000\340\303&q\274\177", '\000' <repeats 589 times>...
workstart = 0x0
workend = <optimized out>
ap_save = {{gp_offset = 24, fp_offset = 48, overflow_arg_area = 0x7fbc7126c450, reg_save_area = 0x7fbc7126c390}}
---Type <return> to continue, or q <return> to quit---
nspecs_done = 0
save_errno = <optimized out>
readonly_format = 0
args_malloced = 0x0
specs = <optimized out>
specs_malloced = false
jump_table = "\001\000\000\004\000\016\000\006\000\000\a\002\000\003\t\000\005\b\b\b\b\b\b\b\b\b\000\000\000\000\000\000\000\032\000\031\000\023\023\023\000\035\000\000\f\000\000\000\000\000\000\025\000\000\000\000\022\000\r\000\000\000\000\000\000\032\000\024\017\023\023\023\n\017\034\000\v\030\027\021\026\f\000\025\033\020\000\000\022\000\r"
__PRETTY_FUNCTION__ = "_IO_vfprintf_internal"
#2097 0x00007fbd09dba579 in _IO_vsnprintf (string=0x7fbcd4030636 "", maxlen=<optimized out>, format=0x7fbd0a7578d0 "%s",
args=args@entry=0x7fbc7126c378) at vsnprintf.c:119
sf = {f = {_sbf = {_f = {_flags = -72515583, _IO_read_ptr = 0x7fbcd4030636 "", _IO_read_end = 0x7fbcd4030636 "",
_IO_read_base = 0x7fbcd4030636 "", _IO_write_base = 0x7fbcd4030636 "", _IO_write_ptr = 0x7fbcd4030636 "",
_IO_write_end = 0x7fbcd4030642 "", _IO_buf_base = 0x7fbcd4030636 "", _IO_buf_end = 0x7fbcd4030642 "", _IO_save_base = 0x0,
_IO_backup_base = 0x0, _IO_save_end = 0x0, _markers = 0x0, _chain = 0x0, _fileno = 1898365760, _flags2 = 0,
_old_offset = 140447328944960, _cur_column = 0, _vtable_offset = 38 '&', _shortbuf = "q", _lock = 0x0, _offset = 0, _codecvt = 0x0,
_wide_data = 0xffffffffffffffff, _freeres_list = 0x0, _freeres_buf = 0x400000000, _freeres_size = 0, _mode = -1,
_unused2 = '\000' <repeats 19 times>}, vtable = 0x7fbd0a104fe0 <_IO_strn_jumps>}, _s = {_allocate_buffer = 0x0,
_free_buffer = 0x0}},
overflow_buf = "\377\377\377\377\377\377\377\377\000\000\000\000\000\000\000\000\377\377\377\377", '\000' <repeats 12 times>, "\377\377\377\377\000\000\000\000\340O\020\n\275\177\000\000\000\000\000\000\000\000\000\000\340O\020\n\275\177\000"}
ret = <optimized out>
#2098 0x00007fbd09d9c532 in __snprintf (s=s@entry=0x7fbcd4030636 "", maxlen=maxlen@entry=13, format=format@entry=0x7fbd0a7578d0 "%s")
at snprintf.c:33
arg = {{gp_offset = 32, fp_offset = 48, overflow_arg_area = 0x7fbc7126c450, reg_save_area = 0x7fbc7126c390}}
done = 0
#2099 0x00007fbd0a756307 in snprintf (__fmt=0x7fbd0a7578d0 "%s", __n=13, __s=0x7fbcd4030636 "") at /usr/include/x86_64-linux-gnu/bits/stdio2.h:64
No locals.
#2100 snoopy_input_cmdline (input=0x7fbc7126cd20 "", arg=<optimized out>) at cmdline.c:75
cmdLine = 0x7fbcd40305f0 "git config remote.origin.url http://git.xxxxxxxx.it/git/yyyyy/ (null) "
cmdLineSize = 83
argc = <optimized out>
i = <optimized out>
n = 70
#2101 0x00007fbd0a7546e4 in snoopy_log_message_generate (
logMessage=logMessage@entry=0x7fbcd4034110 "[rpname:daemon user:jenkins ip:(undefined) uid:115 sid:1269 tty:(none) cwd:/ filename:/usr/bin/git]: ", logMessageFormat=<optimized out>) at log.c:140
---Type <return> to continue, or q <return> to quit---
lengthToCopy = <optimized out>
inputTag = "cmdline\000\000LIENT", '\000' <repeats 18 times>, "B\000\000\000\000\000\000\000\070\345&q\274\177\000\000snoopy:message_format\000\357D\313'k\"\207Մ\020\003\374/\323\037E;NQ\307\"\322Fa\b\257\b#\372", <incomplete sequence \351>
fmtPos_inputTagArg = <optimized out>
inputProviderNamePtr = 0x7fbc7126c4b0 "cmdline"
inputProviderArgPtr = 0x7fbc7126c920 ""
inputProviderMsg = "\000usr/bin/git\000ername} ip:%{env:SSH_CLIENT} uid:%{uid} sid:%{sid} tty:%{tty} cwd:%{cwd} filename:%{filename}]: %{cmdline}\"\000\317&q\274\177\000\000\360\316&q\274\177", '\000' <repeats 18 times>, "PE\270\n\275\177\000\000h\266\270\n\275\177\000\000ɫ\226\n\275\177\000\000\001", '\000' <repeats 19 times>, "\274\177\000\000h"...
fmtStaticText = "]: \000ename:\000\b\275\177\000\000\220\345&q\274\177\000\000P\305&q\274\177\000\000\320\313Fq\274\177\000\000P\305&q\274\177\000\000\n\345&q\274\177\000\000@\265Cq\274\177\000\000\270\310Fqit --version\330\016Dqimeout=10\177\000\000(d\031\000\001\000\000\000\300\305&q\274\177\000\000\320QDq\000\000\000\000\060\306&q\274\177\000\000\220\306&q\274\177\000\000(d\031\000\001\000\000\000\360\305&q\274\177\000\000(\204\023p\275\177\000\000H\345Cq\274\177\000\000\000P/\300\274\177\000\000\020\334&q\274\177\000\000 \026Dq\274\177\000\000\000\000\000\000\000\000\000\000"...
inputProviderArg = "\000LIENT} uid:%{uid} sid:%{sid} tty:%{tty} cwd:%{cwd} filename:%{filename}]: %{cmdline}", '\000' <repeats 891 times>...
fmtPos_cur = <optimized out>
fmtPos_nextInputTag = 0x7fbcd402e7cb "%{cmdline}"
fmtPos_nextInputTagClose = 0x7fbcd402e7d4 "}"
#2102 0x00007fbd0a754a70 in snoopy_log_syscall (syscallName=syscallName@entry=0x7fbd0a757416 "execve") at log.c:385
logMessage = 0x7fbcd4034110 "[rpname:daemon user:jenkins ip:(undefined) uid:115 sid:1269 tty:(none) cwd:/ filename:/usr/bin/git]: "
#2103 0x00007fbd0a754b33 in snoopy_log_syscall_execve (filename=filename@entry=0x7fbc7126d220 "/usr/bin/git", argv=argv@entry=0x7fbcd402ed30,
envp=envp@entry=0x7fbcd402b4f0) at log.c:348
No locals.
#2104 0x00007fbd0a753d25 in execve (filename=0x7fbc7126d220 "/usr/bin/git", argv=0x7fbcd402ed30, envp=0x7fbcd402b4f0) at libsnoopy.c:76
func = 0x7fbd09e09330 <__execve>
#2105 0x00007fbd084e6e8e in execve_with_shell_fallback () from /usr/lib/jvm/java-8-oracle/jre/lib/amd64/libjava.so
No symbol table info available.
#2106 0x00007fbd084e70e1 in JDK_execvpe () from /usr/lib/jvm/java-8-oracle/jre/lib/amd64/libjava.so
No symbol table info available.
#2107 0x00007fbd084e74fb in childProcess () from /usr/lib/jvm/java-8-oracle/jre/lib/amd64/libjava.so
No symbol table info available.
#2108 0x00007fbd084e4474 in vforkChild () from /usr/lib/jvm/java-8-oracle/jre/lib/amd64/libjava.so
No symbol table info available.
#2109 0x00007fbd084e4dc0 in Java_java_lang_UNIXProcess_forkAndExec () from /usr/lib/jvm/java-8-oracle/jre/lib/amd64/libjava.so
b.
Looking at the tickets #8, #9, #10, #11 and #12, it makes sense to make use of configuration file an optional feature, configurable at ./configure time. Those who would not want to use it (for any reason), can disable it.
Proposed features of configuration file:
Comments?
b.
Version 3.1 has 17 commits, latest master around 50 including many fixes. Upgrade required.
The term 'input provider' does not accurately describe what that part of code does. What is does is it gathers data from specific source. Therefore it should be renamed to something else.
Initial suggestions:
What do Snoopy contributors and users think about this?
b.
Create new data source called 'literal' which just copies input parameter to output.
Therefore, configuring message_format = "literal=%{literal:text to return}" should result in "literal=text to return" output.
This will be useful to determine if data providers actually work when testing facility is implemented.
Due date: 2014-11-11
I would like to add the commands that are executed within MySQL, is that possible using Snoopy? We already use it to monitor many things, but having MySQL there would be awesome.
I installed it by using
apt-get install snoopy
and now no matter what i do it can't be uninstalled
apt-get remove snoopy
didn't do anything
purge either
please HELP!
Snoopy 2.0.x to 2.2.x had iniparser and configuration file routines always included in final library, even if configuration file parsing was not enabled at all.
Snoopy needs generic argument parser that splits comma-separated arguments into array of strings.
This will be useful for datasources, filters and outputs, so that code there is not cluttered with argument parsing functionality.
Additonally a named argument parser might be created, to support list of named arguments, like "argName1=val1,argName2=val2".
Originally reported by @ajzach in issue #39:
__GI_abort () at abort.c:125
act = {__sigaction_handler = {sa_handler = 0x0, sa_sigaction = 0x0}, sa_mask = {__val = {18446744073709551615 <repeats 16 times>}},
sa_flags = 0, sa_restorer = 0x0}
sigs = {__val = {32, 0 <repeats 15 times>}}
#2104 0x00007f7b9bdc3925 in os::abort(bool) () from /usr/lib/jvm/java-7-oracle/jre/lib/amd64/server/libjvm.so
No symbol table info available.
#2105 0x00007f7b9bf42827 in VMError::report_and_die() () from /usr/lib/jvm/java-7-oracle/jre/lib/amd64/server/libjvm.so
No symbol table info available.
#2106 0x00007f7b9bdc82af in JVM_handle_linux_signal () from /usr/lib/jvm/java-7-oracle/jre/lib/amd64/server/libjvm.so
No symbol table info available.
#2107 <signal handler called>
No locals.
#2108 iniparser_getboolean (d=d@entry=0x7f7b189690d0, key=key@entry=0x7f7b9ce274d8 "snoopy:error_logging", notfound=notfound@entry=-1)
at iniparser/src/iniparser.c:478
c = 0x0
#2109 0x00007f7b9ce2435d in snoopy_configuration_load_file (iniFilePath=iniFilePath@entry=0x7f7b9ce27550 "/etc/snoopy.ini") at configuration.c:194
ini = 0x7f7b189690d0
confValString = <optimized out>
confValInt = <optimized out>
#2110 0x00007f7b9ce2444c in snoopy_configuration_ctor () at configuration.c:107
No locals.
#2111 0x00007f7b9ce24b57 in snoopy_init () at misc.c:56
No locals.
#2112 0x00007f7b9ce24a5d in snoopy_log_syscall (syscallName=syscallName@entry=0x7f7b9ce27426 "execve") at log.c:378
logMessage = 0x0
#2113 0x00007f7b9ce24b43 in snoopy_log_syscall_execve (filename=filename@entry=0x7f7b1173c8a0 "/usr/local/bin/git", argv=argv@entry=0x7f7b187e88b0,
envp=envp@entry=0x7f7b18aa3fc0) at log.c:348
No locals.
#2114 0x00007f7b9ce23d25 in execve (filename=0x7f7b1173c8a0 "/usr/local/bin/git", argv=0x7f7b187e88b0, envp=0x7f7b18aa3fc0) at libsnoopy.c:76
func = 0x7f7b9c4d9330 <__execve>
#2115 0x00007f7b9ac7824a in execve_with_shell_fallback () from /usr/lib/jvm/java-7-oracle/jre/lib/amd64/libjava.so
No symbol table info available.
#2116 0x00007f7b9ac7849f in JDK_execvpe () from /usr/lib/jvm/java-7-oracle/jre/lib/amd64/libjava.so
No symbol table info available.
#2117 0x00007f7b9ac78c9d in startChild () from /usr/lib/jvm/java-7-oracle/jre/lib/amd64/libjava.so
No symbol table info available.
#2118 0x00007f7b9ac7906b in Java_java_lang_UNIXProcess_forkAndExec () from /usr/lib/jvm/java-7-oracle/jre/lib/amd64/libjava.so
No symbol table info available.
---Type <return> to continue, or q <return> to quit---
@ajzach comment (copied from #39):
No, all problems occur in the forkAndExec of Java, it can be that there is a problem of concurrency?
Hi Bostjan,
As we had discussed in previous items, I am attempting to get Snoopy working properly in CentOS 7. I thought I had figured it out. After successfully building from the RPM spec and installing, I was able to confirm that commands were being properly.
However, upon restart, the system fails to boot because it claims it is timing out waiting for one of the LVM block devices; in my case, the device for my /var partition.
I have debugged my setup extensively and can confirm this is recreatable only when I enable snoopy. After this crash, I can reboot back into rescue mode, disable snoopy, then the system will boot again.
Please see this screen capture of my VM console: http://i.imgur.com/DHmhsI3.png
I'm unsure on how to proceed from here. Do you have any tips on what I can do to remedy? Let me know if you'd like my kickstart file, though I'm guessing you'll be able to recreate on any CentOS 7 install.
Thanks
You can find in my debian branch (https://github.com/renard/snoopy/tree/debian) all required files to build snoopy debian packages.
To build you just need to checkout the debian
dir in current.
git checkout -b build
git checkout debian .
debuild
Hope that helps.
Flag recommendation: --with-default-output=OUTPUT_SPEC.
When configuring snoopy using --enable-config-file, the Makefile in etc gets executed and snoopy.ini gets installed. This is great, but unfortunately it doesn't inherit DESTDIR, so you can't build packages that install into a different build root, as it always installs into sysconfdir.
For now, I've hacked my RPM spec file like this:
%{__sed} -i -e 's/$(sysconfdir)/snoopy.ini/$(DESTDIR)$(sysconfdir)/snoopy.ini/g' etc/Makefile.am
With that said, I'm sure there's a more elegant solution to this. I'm looking into the fix, but you may know the answer before I get there (assuming my solution is wrong) :)
You can see my latest spec file here:
https://github.com/tkimball83/rpm-specs/blob/master/snoopy.spec
Currently it is only possible to configure it with ./configure flags:
--with-syslog-facility=LOG_AUTHPRIV
--with-syslog-level=LOG_INFO
This should be configurable in snoopy.ini:
syslog_facility = "AUTHPRIV"
syslog_level = "INFO"
Also, these should be made case-insensitive and with configure line we should loose LOG_ prefix.
This is intended for users who would like to use snoopy but are afraid of building it manually.
Command should be something in the form of:
wget -q -O - https://github.com/a2o/snoopy/raw/master/bin/snoopy-install.sh | sh
The script should:
Currently snoopy uses a fixed set of data collection routines (get UID, GID, PID, cmd line, args, etc).
It would make great sense to move these into their own functions/modules, which would be all compiled into snoopy. Then these data generators would be available to be used when configuring log format (see #10 for more information) either on the ./configure line or via configuration file.
Comments?
b.
Another interesting feature would be to enable differentiated or redundant logging based on various conditions.
Example:
Implementation proposal:
b.
Installed the latest snoopy release with snoopy-install.sh on Redhat 6.6
After enabling the console is flooded with snoopy logging. Writing the messages to syslog seems broken in this release.
Tried to configure /etc/snoopy.ini
output = syslog
made no difference
Check all the library code for thread safety. Java processes seem to have problems with it, as they are using threads.
It is useful when logging to file.
Currently does not work as expected - sometimes it returns the domain, most of the times it does not.
It could just juse getaddrinfo(), but this call queries DNS if entry is not found in /etc/hosts. But DNS query could be blocking for a long while, so this is unacceptable. An implementation of this datasource must search hosts file only.
Also, when this is fixed, change test - remove xfail.
All individual parts of snoopy should be tested, at least:
Data sources, filters and outputs should be includable individually by ./configure line, main reason being that if certain entity (filter, datasrc, output) is considered buggy, it may be disabled by default, but simple possibility should exist to enable it via ./configure line if knowledgeable user should wish to do so.
Therefore what needs to be implemented are the following ./configure flags:
Q: Should --with be replaced with --enable/--disable variation?
A declarative, efficient, and flexible JavaScript library for building user interfaces.
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
An Open Source Machine Learning Framework for Everyone
The Web framework for perfectionists with deadlines.
A PHP framework for web artisans
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
Some thing interesting about web. New door for the world.
A server is a program made to process requests and deliver data to clients.
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
Some thing interesting about visualization, use data art
Some thing interesting about game, make everyone happy.
We are working to build community through open source technology. NB: members must have two-factor auth.
Open source projects and samples from Microsoft.
Google ❤️ Open Source for everyone.
Alibaba Open Source for everyone
Data-Driven Documents codes.
China tencent open source team.