Systemtap 在父进程退出后监控子进程答案

【问题标题】：Systemtap monitor child processes after parent exitsSystemtap 在父进程退出后监控子进程
【发布时间】：2021-10-30 08:53:02
【问题描述】：
我在这里使用示例脚本，“follow_fork”设置为 1：https://sourceware.org/systemtap/examples/process/strace.stp
我只有一个调用 fork() 三次的 C 程序，称为“forker”。 systemtap 输出日志如下。可以看到它只能监控一个子进程。运行几次后，它记录的子进程数量（0 到 6）有所不同，我认为这是并发预期的。
如何指示 systemtap 在初始父进程退出后继续监视子进程？这是一个问题，因为我没有获得子进程的完整日志，因为 systemtap 在父进程退出时退出，通常在子进程完成之前。有没有办法在运行时向目标 pid 添加新的 pid，或者有其他方法来完成这个？
这是在 Fedora34 上运行的
Mon Aug 30 23:52:49 2021.647560 rt_sigaction(SIGUSR1, {SIG_DFL}, 0x0, 8) = 0
Mon Aug 30 23:52:49 2021.647579 rt_sigprocmask(SIG_SETMASK, [EMPTY], 0x0, 8) = 0
Mon Aug 30 23:52:49 2021.647600 alarm(0) = 57
Mon Aug 30 23:52:49 2021.647623 write(2, "stapio:start_cmd:218 ", 21) = 21
Mon Aug 30 23:52:49 2021.647757 write(2, "execing target_cmd sh -c /tmp/forker\n", 37) = 37
Mon Aug 30 23:52:49 2021.647908 execve("/usr/local/sbin/sh", ["sh", "-c", "/tmp/forker"], ["XAUTHORITY=/root/.Xauthority", "DISPLAY=:0", "MAIL=/var/mail/root", "PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/var/lib/snapd/snap/bin", "LOGNAME=root", "USER=root", "HOME=/root", "SHELL=/bin/bash", "TERM=unknown", "SUDO_COMMAND=/usr/bin/staprun -vv -o stap.log /root/.cuckoo/stap_.ko -c sh -c /tmp/forker", "SUDO_USER=root", "SUDO_UID=0", "SUDO_GID=0", "SYSTEMTAP_VERBOSE=2", "SYSTEMTAP_MODULE=stap_"]) = -2 (ENOENT)
Mon Aug 30 23:52:49 2021.648085 execve("/usr/local/bin/sh", ["sh", "-c", "/tmp/forker"], ["XAUTHORITY=/root/.Xauthority", "DISPLAY=:0", "MAIL=/var/mail/root", "PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/var/lib/snapd/snap/bin", "LOGNAME=root", "USER=root", "HOME=/root", "SHELL=/bin/bash", "TERM=unknown", "SUDO_COMMAND=/usr/bin/staprun -vv -o stap.log /root/.cuckoo/stap_.ko -c sh -c /tmp/forker", "SUDO_USER=root", "SUDO_UID=0", "SUDO_GID=0", "SYSTEMTAP_VERBOSE=2", "SYSTEMTAP_MODULE=stap_"]) = -2 (ENOENT)
Mon Aug 30 23:52:49 2021.648169 execve("/usr/sbin/sh", ["sh", "-c", "/tmp/forker"], ["XAUTHORITY=/root/.Xauthority", "DISPLAY=:0", "MAIL=/var/mail/root", "PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/var/lib/snapd/snap/bin", "LOGNAME=root", "USER=root", "HOME=/root", "SHELL=/bin/bash", "TERM=unknown", "SUDO_COMMAND=/usr/bin/staprun -vv -o stap.log /root/.cuckoo/stap_.ko -c sh -c /tmp/forker", "SUDO_USER=root", "SUDO_UID=0", "SUDO_GID=0", "SYSTEMTAP_VERBOSE=2", "SYSTEMTAP_MODULE=stap_"]) = -2 (ENOENT)
Mon Aug 30 23:52:49 2021.649393 brk(0x0) = 94435928932352
Mon Aug 30 23:52:49 2021.650148 arch_prctl(12289, 140732394314512) = -22 (EINVAL)
Mon Aug 30 23:52:49 2021.650226 access("/etc/ld.so.preload", R_OK) = -2 (ENOENT)
Mon Aug 30 23:52:49 2021.650269 openat(AT_FDCWD, "/etc/ld.so.cache", O_RDONLY|O_CLOEXEC) = 3
Mon Aug 30 23:52:49 2021.650298 fstatat(3, "", 0x7ffed05f0d40, AT_EMPTY_PATH) = 0
Mon Aug 30 23:52:49 2021.650317 mmap2(0x0, 61580, PROT_READ, MAP_PRIVATE, 3, 0) = 0x7f03051ef000
Mon Aug 30 23:52:49 2021.650336 close(3) = 0
Mon Aug 30 23:52:49 2021.650369 openat(AT_FDCWD, "/lib64/libtinfo.so.6", O_RDONLY|O_CLOEXEC) = 3
Mon Aug 30 23:52:49 2021.650392 read(3, 0x7ffed05f0e98, 832) = 832
Mon Aug 30 23:52:49 2021.650409 fstatat(3, "", 0x7ffed05f0d40, AT_EMPTY_PATH) = 0
Mon Aug 30 23:52:49 2021.650424 mmap2(0x0, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f03051ed000
Mon Aug 30 23:52:49 2021.650448 mmap2(0x0, 190832, PROT_READ, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0x7f03051be000
Mon Aug 30 23:52:49 2021.650472 mmap2(0x7f03051cc000, 57344, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 57344) = 0x7f03051cc000
Mon Aug 30 23:52:49 2021.650495 mmap2(0x7f03051da000, 57344, PROT_READ, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 114688) = 0x7f03051da000
Mon Aug 30 23:52:49 2021.650513 mmap2(0x7f03051e8000, 20480, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 167936) = 0x7f03051e8000
Mon Aug 30 23:52:49 2021.650567 close(3) = 0
Mon Aug 30 23:52:49 2021.650609 openat(AT_FDCWD, "/lib64/libdl.so.2", O_RDONLY|O_CLOEXEC) = 3
Mon Aug 30 23:52:49 2021.650876 read(3, 0x7ffed05f0e78, 832) = 832
Mon Aug 30 23:52:49 2021.650911 fstatat(3, "", 0x7ffed05f0d20, AT_EMPTY_PATH) = 0
Mon Aug 30 23:52:49 2021.650942 mmap2(0x0, 24688, PROT_READ, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0x7f03051b7000
Mon Aug 30 23:52:49 2021.650972 mmap2(0x7f03051b9000, 8192, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 8192) = 0x7f03051b9000
Mon Aug 30 23:52:49 2021.650998 mmap2(0x7f03051bb000, 4096, PROT_READ, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 16384) = 0x7f03051bb000
Mon Aug 30 23:52:49 2021.651015 mmap2(0x7f03051bc000, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 16384) = 0x7f03051bc000
Mon Aug 30 23:52:49 2021.651045 mmap2(0x7f03051bd000, 112, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x7f03051bd000
Mon Aug 30 23:52:49 2021.651079 close(3) = 0
Mon Aug 30 23:52:49 2021.651103 openat(AT_FDCWD, "/lib64/libc.so.6", O_RDONLY|O_CLOEXEC) = 3
Mon Aug 30 23:52:49 2021.651130 read(3, 0x7ffed05f0e58, 832) = 832
Mon Aug 30 23:52:49 2021.651146 pread(3, 0x7ffed05f0a60, 784, 64) = 784
Mon Aug 30 23:52:49 2021.651161 pread(3, 0x7ffed05f0a20, 48, 848) = 48
Mon Aug 30 23:52:49 2021.651173 pread(3, 0x7ffed05f09d0, 68, 896) = 68
Mon Aug 30 23:52:49 2021.651187 fstatat(3, "", 0x7ffed05f0d00, AT_EMPTY_PATH) = 0
Mon Aug 30 23:52:49 2021.651202 pread(3, 0x7ffed05f0950, 784, 64) = 784
Mon Aug 30 23:52:49 2021.651216 mmap2(0x0, 1892824, PROT_READ, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0x7f0304fe8000
Mon Aug 30 23:52:49 2021.651249 mprotect(0x7f030500e000, 1679360, PROT_NONE) = 0
Mon Aug 30 23:52:49 2021.651279 mmap2(0x7f030500e000, 1363968, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 155648) = 0x7f030500e000
Mon Aug 30 23:52:49 2021.651300 mmap2(0x7f030515b000, 311296, PROT_READ, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 1519616) = 0x7f030515b000
Mon Aug 30 23:52:49 2021.651317 mmap2(0x7f03051a8000, 24576, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 1830912) = 0x7f03051a8000
Mon Aug 30 23:52:49 2021.651354 mmap2(0x7f03051ae000, 33240, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x7f03051ae000
Mon Aug 30 23:52:49 2021.651403 close(3) = 0
Mon Aug 30 23:52:49 2021.651437 mmap2(0x0, 12288, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f0304fe5000
Mon Aug 30 23:52:49 2021.651460 arch_prctl(ARCH_SET_FS, 139650945406784) = 0
Mon Aug 30 23:52:49 2021.651570 mprotect(0x7f03051a8000, 12288, PROT_READ) = 0
Mon Aug 30 23:52:49 2021.651606 mprotect(0x7f03051bc000, 4096, PROT_READ) = 0
Mon Aug 30 23:52:49 2021.651788 mprotect(0x7f03051e8000, 16384, PROT_READ) = 0
Mon Aug 30 23:52:49 2021.652040 mprotect(0x55e3926ce000, 16384, PROT_READ) = 0
Mon Aug 30 23:52:49 2021.652072 mprotect(0x7f030522f000, 8192, PROT_READ) = 0
Mon Aug 30 23:52:49 2021.652132 munmap(0x7f03051ef000, 61580) = 0
Mon Aug 30 23:52:49 2021.652224 openat(AT_FDCWD, 0x55e3926a6859, O_RDWR|O_NONBLOCK) = 3
Mon Aug 30 23:52:49 2021.652259 close(3) = 0
Mon Aug 30 23:52:49 2021.652374 brk(0x0) = 94435928932352
Mon Aug 30 23:52:49 2021.652392 brk(0x55e394019000) = 94435929067520
Mon Aug 30 23:52:49 2021.652425 getuid() = 0
Mon Aug 30 23:52:49 2021.652453 getgid() = 0
Mon Aug 30 23:52:49 2021.652494 geteuid() = 0
Mon Aug 30 23:52:49 2021.652523 getegid() = 0
Mon Aug 30 23:52:49 2021.652549 rt_sigprocmask(SIG_BLOCK, NULL, 0x55e3926db1a8, 8) = 0
Mon Aug 30 23:52:49 2021.652614 ioctl(-1, 21519, 0x7ffed05f19e4) = -9 (EBADF)
Mon Aug 30 23:52:49 2021.652739 sysinfo({uptime=139650947817952, loads=[0, 140732394313824, 139650945675605], totalram=139650947611568, freeram=140732394313952, sharedram=140732394313872, bufferram=0, totalswap=0, freeswap=139650946429060, procs=47616}) = 0
Mon Aug 30 23:52:49 2021.652812 rt_sigaction(SIGCHLD, {SIG_DFL}, 0x7ffed05f16c0, 8) = 0
Mon Aug 30 23:52:49 2021.652829 rt_sigaction(SIGCHLD, {SIG_DFL}, 0x7ffed05f16c0, 8) = 0
Mon Aug 30 23:52:49 2021.652841 rt_sigaction(SIGINT, {SIG_DFL}, 0x7ffed05f16c0, 8) = 0
Mon Aug 30 23:52:49 2021.652852 rt_sigaction(SIGINT, {SIG_DFL}, 0x7ffed05f16c0, 8) = 0
Mon Aug 30 23:52:49 2021.652864 rt_sigaction(SIGQUIT, {SIG_DFL}, 0x7ffed05f16c0, 8) = 0
Mon Aug 30 23:52:49 2021.652875 rt_sigaction(SIGQUIT, {SIG_DFL}, 0x7ffed05f16c0, 8) = 0
Mon Aug 30 23:52:49 2021.652891 rt_sigaction(SIGTSTP, {SIG_DFL}, 0x7ffed05f1690, 8) = 0
Mon Aug 30 23:52:49 2021.652903 rt_sigaction(SIGTSTP, {SIG_DFL}, 0x7ffed05f1690, 8) = 0
Mon Aug 30 23:52:49 2021.652914 rt_sigaction(SIGTTIN, {SIG_DFL}, 0x7ffed05f16c0, 8) = 0
Mon Aug 30 23:52:49 2021.652926 rt_sigaction(SIGTTIN, {SIG_DFL}, 0x7ffed05f16c0, 8) = 0
Mon Aug 30 23:52:49 2021.652945 rt_sigaction(SIGTTOU, {SIG_DFL}, 0x7ffed05f16c0, 8) = 0
Mon Aug 30 23:52:49 2021.652957 rt_sigaction(SIGTTOU, {SIG_DFL}, 0x7ffed05f16c0, 8) = 0
Mon Aug 30 23:52:49 2021.652979 rt_sigprocmask(SIG_BLOCK, NULL, 0x55e3926dada0, 8) = 0
Mon Aug 30 23:52:49 2021.652993 rt_sigaction(SIGQUIT, {SIG_IGN}, 0x7ffed05f16c0, 8) = 0
Mon Aug 30 23:52:49 2021.653009 uname(0x7ffed05f1720) = 0
Mon Aug 30 23:52:49 2021.653067 getcwd(0x55e393ffd3b0, 4096) = 13
Mon Aug 30 23:52:49 2021.653087 getpid() = 2565
Mon Aug 30 23:52:49 2021.653103 getppid() = 2564
Mon Aug 30 23:52:49 2021.653122 fstatat(AT_FDCWD, ".", 0x7ffed05f1740, 0x0) = 0
Mon Aug 30 23:52:49 2021.653152 fstatat(AT_FDCWD, "/usr/local/sbin/sh", 0x7ffed05f1610, 0x0) = -2 (ENOENT)
Mon Aug 30 23:52:49 2021.653173 fstatat(AT_FDCWD, "/usr/local/bin/sh", 0x7ffed05f1610, 0x0) = -2 (ENOENT)
Mon Aug 30 23:52:49 2021.653188 fstatat(AT_FDCWD, "/usr/sbin/sh", 0x7ffed05f1610, 0x0) = -2 (ENOENT)
Mon Aug 30 23:52:49 2021.653204 fstatat(AT_FDCWD, "/usr/bin/sh", 0x7ffed05f1610, 0x0) = 0
Mon Aug 30 23:52:49 2021.653222 fstatat(AT_FDCWD, "/usr/bin/sh", 0x7ffed05f1530, 0x0) = 0
Mon Aug 30 23:52:49 2021.653235 geteuid() = 0
Mon Aug 30 23:52:49 2021.653247 getegid() = 0
Mon Aug 30 23:52:49 2021.653258 getuid() = 0
Mon Aug 30 23:52:49 2021.653269 getgid() = 0
Mon Aug 30 23:52:49 2021.653283 access("/usr/bin/sh", X_OK) = 0
Mon Aug 30 23:52:49 2021.653304 fstatat(AT_FDCWD, "/usr/bin/sh", 0x7ffed05f1530, 0x0) = 0
Mon Aug 30 23:52:49 2021.653317 geteuid() = 0
Mon Aug 30 23:52:49 2021.653327 getegid() = 0
Mon Aug 30 23:52:49 2021.653338 getuid() = 0
Mon Aug 30 23:52:49 2021.653349 getgid() = 0
Mon Aug 30 23:52:49 2021.653361 access("/usr/bin/sh", R_OK) = 0
Mon Aug 30 23:52:49 2021.653378 fstatat(AT_FDCWD, "/usr/bin/sh", 0x7ffed05f1660, 0x0) = 0
Mon Aug 30 23:52:49 2021.653393 fstatat(AT_FDCWD, "/usr/bin/sh", 0x7ffed05f1580, 0x0) = 0
Mon Aug 30 23:52:49 2021.653406 geteuid() = 0
Mon Aug 30 23:52:49 2021.653416 getegid() = 0
Mon Aug 30 23:52:49 2021.653427 getuid() = 0
Mon Aug 30 23:52:49 2021.653437 getgid() = 0
Mon Aug 30 23:52:49 2021.653449 access("/usr/bin/sh", X_OK) = 0
Mon Aug 30 23:52:49 2021.653465 fstatat(AT_FDCWD, "/usr/bin/sh", 0x7ffed05f1580, 0x0) = 0
Mon Aug 30 23:52:49 2021.653478 geteuid() = 0
Mon Aug 30 23:52:49 2021.653488 getegid() = 0
Mon Aug 30 23:52:49 2021.653499 getuid() = 0
Mon Aug 30 23:52:49 2021.653509 getgid() = 0
Mon Aug 30 23:52:49 2021.653521 access("/usr/bin/sh", R_OK) = 0
Mon Aug 30 23:52:49 2021.653550 getpid() = 2565
Mon Aug 30 23:52:49 2021.653562 getppid() = 2564
Mon Aug 30 23:52:49 2021.653573 getpid() = 2565
Mon Aug 30 23:52:49 2021.653584 getppid() = 2564
Mon Aug 30 23:52:49 2021.653861 getpgrp() = 2515
Mon Aug 30 23:52:49 2021.653881 ioctl(2, 21519, 0x7ffed05f18a4) = -25 (ENOTTY)
Mon Aug 30 23:52:49 2021.653899 rt_sigaction(SIGCHLD, {0x55e3925e89d0, SA_RESTART|SA_RESTORER, 0x7f0305025320, [EMPTY]}, 0x7ffed05f16b0, 8) = 0
Mon Aug 30 23:52:49 2021.653913 ioctl(2, 21519, 0x7ffed05f1884) = -25 (ENOTTY)
Mon Aug 30 23:52:49 2021.653929 prlimit64(0, RLIMIT_NPROC, NULL, 0x7ffed05f1870) = 0
Mon Aug 30 23:52:49 2021.653990 rt_sigprocmask(SIG_BLOCK, NULL, 0x55e3926db288, 8) = 0
Mon Aug 30 23:52:49 2021.654022 rt_sigprocmask(SIG_BLOCK, NULL, 0x7ffed05f1930, 8) = 0
Mon Aug 30 23:52:49 2021.654102 rt_sigaction(SIGINT, {SIG_DFL}, 0x7ffed05f1400, 8) = 0
Mon Aug 30 23:52:49 2021.654119 rt_sigaction(SIGQUIT, {SIG_DFL}, 0x7ffed05f1400, 8) = 0
Mon Aug 30 23:52:49 2021.654131 rt_sigaction(SIGCHLD, {SIG_DFL}, 0x7ffed05f1400, 8) = 0
Mon Aug 30 23:52:49 2021.654554 brk(0x0) = 94910601707520
Mon Aug 30 23:52:49 2021.655235 arch_prctl(12289, 140720704638272) = -22 (EINVAL)
Mon Aug 30 23:52:49 2021.655284 access("/etc/ld.so.preload", R_OK) = -2 (ENOENT)
Mon Aug 30 23:52:49 2021.655317 openat(AT_FDCWD, "/etc/ld.so.cache", O_RDONLY|O_CLOEXEC) = 3
Mon Aug 30 23:52:49 2021.655340 fstatat(3, "", 0x7ffc179cbf70, AT_EMPTY_PATH) = 0
Mon Aug 30 23:52:49 2021.655356 mmap2(0x0, 61580, PROT_READ, MAP_PRIVATE, 3, 0) = 0x7f3810a02000
Mon Aug 30 23:52:49 2021.655374 close(3) = 0
Mon Aug 30 23:52:49 2021.655395 openat(AT_FDCWD, "/lib64/libc.so.6", O_RDONLY|O_CLOEXEC) = 3
Mon Aug 30 23:52:49 2021.655415 read(3, 0x7ffc179cc0c8, 832) = 832
Mon Aug 30 23:52:49 2021.655430 pread(3, 0x7ffc179cbcd0, 784, 64) = 784
Mon Aug 30 23:52:49 2021.655444 pread(3, 0x7ffc179cbc90, 48, 848) = 48
Mon Aug 30 23:52:49 2021.655456 pread(3, 0x7ffc179cbc40, 68, 896) = 68
Mon Aug 30 23:52:49 2021.655470 fstatat(3, "", 0x7ffc179cbf70, AT_EMPTY_PATH) = 0
Mon Aug 30 23:52:49 2021.655485 mmap2(0x0, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f3810a00000
Mon Aug 30 23:52:49 2021.655506 pread(3, 0x7ffc179cbbc0, 784, 64) = 784
Mon Aug 30 23:52:49 2021.655520 mmap2(0x0, 1892824, PROT_READ, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0x7f3810831000
Mon Aug 30 23:52:49 2021.655537 mprotect(0x7f3810857000, 1679360, PROT_NONE) = 0
Mon Aug 30 23:52:49 2021.655557 mmap2(0x7f3810857000, 1363968, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 155648) = 0x7f3810857000
Mon Aug 30 23:52:49 2021.655577 mmap2(0x7f38109a4000, 311296, PROT_READ, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 1519616) = 0x7f38109a4000
Mon Aug 30 23:52:49 2021.655593 mmap2(0x7f38109f1000, 24576, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 1830912) = 0x7f38109f1000
Mon Aug 30 23:52:49 2021.655617 mmap2(0x7f38109f7000, 33240, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x7f38109f7000
Mon Aug 30 23:52:49 2021.655768 close(3) = 0
Mon Aug 30 23:52:49 2021.655805 mmap2(0x0, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f381082f000
Mon Aug 30 23:52:49 2021.655893 arch_prctl(ARCH_SET_FS, 139878773822848) = 0
Mon Aug 30 23:52:49 2021.655971 mprotect(0x7f38109f1000, 12288, PROT_READ) = 0
Mon Aug 30 23:52:49 2021.656000 mprotect(0x565216c01000, 4096, PROT_READ) = 0
Mon Aug 30 23:52:49 2021.656032 mprotect(0x7f3810a42000, 8192, PROT_READ) = 0
Mon Aug 30 23:52:49 2021.656072 munmap(0x7f3810a02000, 61580) = 0
Mon Aug 30 23:52:49 2021.656129 clone(CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, 0x0, 0x0, 0x7f3810a01850) = 2569
Mon Aug 30 23:52:49 2021.656413 clone(CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, 0x0, 0x0, 0x7f3810a01850) = 2570
Mon Aug 30 23:52:49 2021.656463 forker[2569] clone(CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, 0x0, 0x0, 0x7f3810a01850) = 2571
Mon Aug 30 23:52:49 2021.656866 forker[2569] clone(CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, 0x0, 0x0, 0x7f3810a01850) = 2572
Mon Aug 30 23:52:49 2021.657244 forker[2569] fstatat(1, 0x7f38109be95a, 0x7ffc179ccc50, AT_EMPTY_PATH) = 0
Mon Aug 30 23:52:49 2021.657286 forker[2569] brk(0x0) = 94910601707520
Mon Aug 30 23:52:49 2021.657310 forker[2569] brk(0x565218b55000) = 94910601842688
Mon Aug 30 23:52:49 2021.657348 forker[2569] write(1, "Hello world!\n", 13) = 13
Mon Aug 30 23:52:49 2021.658001 forker[2569] exit_group(0) = 
Mon Aug 30 23:52:49 2021.656529 clone(CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, 0x0, 0x0, 0x7f3810a01850) = 2573
Mon Aug 30 23:52:49 2021.657517 fstatat(1, 0x7f38109be95a, 0x7ffc179ccc50, AT_EMPTY_PATH) = 0
Mon Aug 30 23:52:49 2021.657572 brk(0x0) = 94910601707520
Mon Aug 30 23:52:49 2021.657603 brk(0x565218b55000) = 94910601842688
Mon Aug 30 23:52:49 2021.657768 write(1, "Hello world!\n", 13) = 13
Mon Aug 30 23:52:49 2021.657844 exit_group(0) =
【问题讨论】：
标签： linux linux-kernel fedora systemtap
【解决方案1】：
如果你调用stap SCRIPT -c CMD，它确实会在 CMD 退出后停止会话，而不是等到 CMD 的孩子也全部退出。考虑将您的工作包装到一个外壳中，例如：stap -Gfollow_fork=1 --example strace.stp -c /bin/sh，然后在该外壳中，调用您的 CMD，并在点击 ^D 之前等待您喜欢的时间。或者将其包装到一个 shell 脚本中，并在最后进行长时间休眠。
【讨论】：