killsnoop.bt

#!/usr/bin/env bpftrace
/*
 * killsnoop	Trace signals issued by the kill() syscall.
 *		For Linux, uses bpftrace and eBPF.
 *
 * USAGE: killsnoop.bt
 *
 * Also a basic example of bpftrace.
 *
 * This is a bpftrace version of the bcc tool of the same name.
 *
 * Copyright 2018 Netflix, Inc.
 * Licensed under the Apache License, Version 2.0 (the "License")
 *
 * 07-Sep-2018	Brendan Gregg	Created this.
 */

BEGIN
{
	printf("Tracing kill() signals... Hit Ctrl-C to end.\n");
	printf("%-15s %7s %-16s %4s %6s %s\n",
		"TIME", "PID", "COMM", "SIG", "TPID", "RESULT");
}

tracepoint:syscalls:sys_enter_kill
{
	@tpid[tid] = args.pid;
	@tsig[tid] = args.sig;
}

tracepoint:syscalls:sys_exit_kill
/@tpid[tid]/
{
	printf("%-15s %7d %-16s %4d %6d %6d\n",
		strftime("%H:%M:%S.%f", nsecs),
		pid, comm, @tsig[tid], @tpid[tid], args.ret);
	delete(@tpid, tid);
	delete(@tsig, tid);
}