ftrace 로그 분석

실습 코드

1. ftrace 설정

2. pid , ppid 확인

• htop , ps -ely로 확인 가능

pid : 1934 (ppid : 1687)

3. kill process

로그 분석

1687 bash 에서 1934 라즈비안 테스트 파일이 fork되었다.

         bash-1687    [000] .....  6998.934386: sched_process_fork: comm=bash pid=1687 child_comm=bash child_pid=2751
            bash-2515    [000] .....  6999.918379: copy_process+0x4/0x14f8 <-kernel_clone+0x98/0x3f8
            bash-2515    [000] .....  6999.918387: <stack trace>
 => copy_process+0x8/0x14f8
 => kernel_clone+0x98/0x3f8
 => __do_sys_clone+0x6c/0x98
 => __arm64_sys_clone+0x28/0x38
 => invoke_syscall+0x4c/0x110
 => el0_svc_common.constprop.3+0xfc/0x120
 => do_el0_svc+0x34/0xd0
 => el0_svc+0x30/0x88
 => el0t_64_sync_handler+0x98/0xc0
 => el0t_64_sync+0x18c/0x190
            bash-2515    [000] .....  6999.919022: sched_process_fork: comm=bash pid=2515 child_comm=bash child_pid=2752
              ps-2752    [002] .....  6999.998522: do_exit+0x4/0xa90 <-do_group_exit+0x3c/0x98
              ps-2752    [002] .....  6999.998540: <stack trace>
 => do_exit+0x8/0xa90
 => do_group_exit+0x3c/0x98
 => __wake_up_parent+0x0/0x38
 => invoke_syscall+0x4c/0x110
 => el0_svc_common.constprop.3+0xfc/0x120
 => do_el0_svc+0x34/0xd0
 => el0_svc+0x30/0x88
 => el0t_64_sync_handler+0x98/0xc0
 => el0t_64_sync+0x18c/0x190
              ps-2752    [002] .....  6999.999466: sched_process_exit: comm=ps pid=2752 prio=120
          <idle>-0       [000] ..s1.  7000.031186: sched_process_free: comm=ps pid=2752 prio=120
   kworker/dying-2116    [002] .....  7001.267197: do_exit+0x4/0xa90 <-kthread_exit+0x34/0x40
   kworker/dying-2116    [002] .....  7001.267201: <stack trace>
 => do_exit+0x8/0xa90
 => kthread_exit+0x34/0x40
 => kthread+0xdc/0x110
 => ret_from_fork+0x10/0x20
   kworker/dying-2116    [002] .....  7001.267217: sched_process_exit: comm=kworker/dying pid=2116 prio=120
     ksoftirqd/2-25      [002] ..s..  7001.283196: sched_process_free: comm=kworker/dying pid=2116 prio=120
         rpiexit-2751    [001] .....  7007.938975: do_exit+0x4/0xa90 <-do_group_exit+0x3c/0x98
         rpiexit-2751    [001] .....  7007.938984: <stack trace>
 => do_exit+0x8/0xa90
 => do_group_exit+0x3c/0x98
 => __wake_up_parent+0x0/0x38
 => invoke_syscall+0x4c/0x110
 => el0_svc_common.constprop.3+0xfc/0x120
 => do_el0_svc+0x34/0xd0
 => el0_svc+0x30/0x88
 => el0t_64_sync_handler+0x98/0xc0
 => el0t_64_sync+0x18c/0x190
         rpiexit-2751    [001] .....  7007.939387: sched_process_exit: comm=rpiexit pid=2751 prio=120
          <idle>-0       [000] ..s1.  7007.955222: sched_process_free: comm=rpiexit pid=2751 prio=120

2515 bash는 putty에서의 bash 이며

copy되어 생성되었음을 확인할 수 있다.

2751은 1687의 child인 것을 확인할 수 있으며

sched_process_exit를 통해 종료 되었으며 최종적으로 free된 것을 볼 수 있다.