trace_open
The trace_open gadget emits events when files are opened.
Requirements
- Minimum Kernel Version : 5.4
Getting started
Running the gadget:
- kubectl gadget
- ig
$ kubectl gadget run ghcr.io/inspektor-gadget/gadget/trace_open:v0.58.0 [flags]
$ sudo ig run ghcr.io/inspektor-gadget/gadget/trace_open:v0.58.0 [flags]
Flags
--collect-ustack
Collect user stack traces
Default value: "false"
--failed
Show only failed events
Default value: "false"
--pid
Show only events generated by processes with this pid
Default value: ""
--uid
Show only events generated by processes with this uid
Default value: ""
Guide
This example shows how to use this gadget.
First, we need to run an application that generates some events.
- kubectl gadget
- ig
$ kubectl run --restart=Never --image=busybox mypod -- sh -c 'while /bin/true ; do whoami ; sleep 3 ; done'
pod/mypod created
$ docker run --name test-trace-open -d busybox /bin/sh -c 'while /bin/true ; do whoami ; sleep 3 ; done'
Then, let's run the gadget:
- kubectl gadget
- ig
Using the trace_open gadget, we can see which processes open what files. We can simply filter for the pod "mypod" and omit specifying the node, thus tracing on all nodes for a pod called "mypod":
$ kubectl gadget run trace_open:v0.58.0 --podname mypod
K8S.NODE K8S.NAMESPACE K8S.PODNAME K8S.CONTAINE… COMM PID TID ERROR FD MODE FNAME
minikube-docker default mypod mypod true 511559 511559 ENOEN 0 ------… /etc/ld.so.cache
minikube-docker default mypod mypod true 511559 511559 ENOEN 0 ------… /lib/x86_64-linux-gnu/g…
minikube-docker default mypod mypod true 511559 511559 ENOEN 0 ------… /lib/x86_64-linux-gnu/g…
minikube-docker default mypod mypod true 511559 511559 ENOEN 0 ------… /lib/x86_64-linux-gnu/t…
minikube-docker default mypod mypod true 511559 511559 ENOEN 0 ------… /lib/x86_64-linux-gnu/t…
minikube-docker default mypod mypod true 511559 511559 ENOEN 0 ------… /lib/x86_64-linux-gnu/t…
minikube-docker default mypod mypod true 511559 511559 ENOEN 0 ------… /lib/x86_64-linux-gnu/t…
minikube-docker default mypod mypod true 511559 511559 ENOEN 0 ------… /lib/x86_64-linux-gnu/x…
minikube-docker default mypod mypod true 511559 511559 ENOEN 0 ------… /lib/x86_64-linux-gnu/x…
minikube-docker default mypod mypod true 511559 511559 ENOEN 0 ------… /lib/x86_64-linux-gnu/x…
minikube-docker default mypod mypod true 511559 511559 ENOEN 0 ------… /lib/x86_64-linux-gnu/l…
...
minikube-docker default mypod mypod whoami 511560 511560 ENOEN 0 ------… /lib/x86_64/libm.so.6
minikube-docker default mypod mypod whoami 511560 511560 3 ------… /lib/libm.so.6
minikube-docker default mypod mypod whoami 511560 511560 3 ------… /lib/libresolv.so.2
minikube-docker default mypod mypod whoami 511560 511560 3 ------… /lib/libc.so.6
minikube-docker default mypod mypod whoami 511560 511560 3 ------… /etc/passwd
^C
Seems the whoami command opens "/etc/passwd" to map the user ID to a user name. We can stop the gadget by hitting Ctrl-C.
$ sudo ig run trace_open:v0.58.0 --containername test-trace-open
RUNTIME.CONTAINERNA… COMM PID TID ERROR FD MODE FNAME
test-trace-open true 515458 515458 ENOENT 0 ---------- /etc/ld.so.cache
test-trace-open true 515458 515458 ENOENT 0 ---------- /lib/x86_64-linux-gnu/g…
test-trace-open true 515458 515458 ENOENT 0 ---------- /lib/x86_64-linux-gnu/g…
test-trace-open true 515458 515458 ENOENT 0 ---------- /lib/x86_64-linux-gnu/t…
test-trace-open true 515458 515458 ENOENT 0 ---------- /lib/x86_64-linux-gnu/t…
test-trace-open true 515458 515458 ENOENT 0 ---------- /lib/x86_64-linux-gnu/t…
test-trace-open true 515458 515458 ENOENT 0 ---------- /lib/x86_64-linux-gnu/t…
test-trace-open true 515458 515458 ENOENT 0 ---------- /lib/x86_64-linux-gnu/x…
test-trace-open true 515458 515458 ENOENT 0 ---------- /lib/x86_64-linux-gnu/x…
test-trace-open true 515458 515458 ENOENT 0 ---------- /lib/x86_64-linux-gnu/x…
...
test-trace-open whoami 515459 515459 ENOENT 0 ---------- /lib/tls/x86_64/libm.so…
test-trace-open whoami 515459 515459 ENOENT 0 ---------- /lib/tls/libm.so.6
test-trace-open whoami 515459 515459 ENOENT 0 ---------- /lib/x86_64/x86_64/libm…
test-trace-open whoami 515459 515459 ENOENT 0 ---------- /lib/x86_64/libm.so.6
test-trace-open whoami 515459 515459 ENOENT 0 ---------- /lib/x86_64/libm.so.6
test-trace-open whoami 515459 515459 3 ---------- /lib/libm.so.6
test-trace-open whoami 515459 515459 3 ---------- /lib/libresolv.so.2
test-trace-open whoami 515459 515459 3 ---------- /lib/libc.so.6
test-trace-open whoami 515459 515459 3 ---------- /etc/passwd
^C
Finally, clean the system:
- kubectl gadget
- ig
$ kubectl delete pod mypod
$ docker rm -f test-trace-open