shmsnoop - Trace System V shared memory syscalls. Uses Linux eBPF/bcc. shmsnoop [-h] [-T] [-p] [-t] [-d DURATION] [-n NAME] shmsnoop traces System V shared memory syscalls: shmget, shmat, shmdt, shmctl Since this uses BPF, only the root user can use this tool. CONFIG_BPF and bcc.

-h Print usage message.

-T Include a timestamp column.

-p PID Trace this process ID only (filtered in-kernel).

-t TID Trace this thread ID only (filtered in-kernel).

-d DURATION Total duration of trace in seconds.

-n NAME Only print command lines matching this command name (regex)

Trace all shm* syscalls: # shmsnoop

Trace all shm* syscalls, and include timestamps: # shmsnoop -T

Only trace shm* syscalls where the process contains "server": # shmsnoop -n server

TIME(s) Time of shm syscall return, in seconds.

PID Process ID

COMM Parent process/command name.

RET Return value of shm syscall.

ARGS "arg: value" couples that represent given syscall arguments as described in their manpage

This is from bcc. https://github.com/iovisor/bcc

Also look in the bcc distribution for a companion _examples.txt file containing example usage, output, and commentary for this tool.

Linux Unstable - in development. Jiri Olsa opensnoop(1)