a2o / snoopy

Snoopy Command Logger is a small library that logs all program executions on your Linux/BSD system.

Snoopy Command Logger

Table of contents

• What is Snoopy?
• News
• Latest version
• Installation
• Output
• Configuration
• FAQ - Frequently asked questions
• Security disclaimer
• Contributing to Snoopy development
• Getting support
• License
• Online resources
• Credits

What is Snoopy?

Snoopy is a small library that logs all program executions on your Linux/BSD system.

Developer documentation outlines how it actually does that (a fairly technical read). And don't miss the security disclaimer about it.

News

Date	What?	Details
2022-09-28	Snoopy 2.5.1 released.	Bugfix release - fixed 32-bit builds.
2022-08-19	Snoopy 2.5.0 released.	Thread safety by default & binary distribution packages are finally here! :)
2021-10-17	Snoopy 2.4.15 released.	Bugfix release (work around the unexpected NULL argv, #201).

Consult ChangeLog for more information.

Latest version

Latest release	Version	Status	Download location
Stable	2.5.1		All release packages can be found over there 👉 in the Releases section.
Development	master	SonarCloud:	git clone [email protected]:a2o/snoopy

Installation

Starting with version 2.5.0, repositories with binary packages are provided for major Linux distributions. Here is a guide to installing Snoopy from package repositories.

WARNING: If you've installed Snoopy from source (i.e. using the install-snoopy.sh script method below) before, it's best to remove it before installing it from a package repository. This guide contains steps to remove "manually" installed Snoopy from your system.

Alternatively, the original method of installing Snoopy from source is still available:

wget -O install-snoopy.sh https://github.com/a2o/snoopy/raw/install/install/install-snoopy.sh &&
chmod 755 install-snoopy.sh &&
sudo ./install-snoopy.sh stable

More information is available in the doc/INSTALL.md document.

Output

This is what typical Snoopy output looks like:

2015-02-11T19:05:10+00:00 labrat-1 snoopy[896]: [uid:0 sid:11679 tty:/dev/pts/2 cwd:/root filename:/usr/bin/cat]: cat /etc/fstab.BAK
2015-02-11T19:05:15+00:00 labrat-1 snoopy[896]: [uid:0 sid:11679 tty:/dev/pts/2 cwd:/root filename:/usr/bin/rm]: rm -f /etc/fstab.BAK
2015-02-11T19:05:19+00:00 labrat-1 snoopy[896]: [uid:0 sid:11679 tty:/dev/pts/2 cwd:/root filename:/usr/bin/tail]: tail -f /var/log/messages

These are default output locations on various Linux distributions:

Distribution	Snoopy output location	Notes
CentOS	/var/log/secure
Debian	/var/log/auth.log
Ubuntu	/var/log/auth.log
(others)	/var/log/messages	(potentially, could be elsewhere)

For actual output format and destination, check your Snoopy and syslog configuration.

Configuration

If the configuration file support is available in your Snoopy build (it probably is), Snoopy can be reconfigured on-the-fly.

The configuration file is (most likely, but depending on the build) located at /etc/snoopy.ini.

Supported configuration directives are explained in the default configuration file.

FAQ - Frequently asked questions

Frequently asked questions and answers are collected in the doc/FAQ.md file in this repository.

Security disclaimer

WARNING: Snoopy is not a reliable auditing solution.

Rogue users can easily manipulate environment to avoid their actions being logged by Snoopy. Consult this FAQ entry for more information.

Contributing to Snoopy development

Consult the following documents for information related to Snoopy development:

• CONTRIBUTING.md
• HACKING-OVERVIEW.md
• HACKING-INTERNALS.md
• HACKING-QA.md (Autoscan, Travis-CI and Valgrind-related sections)

Getting support

Information is available in a dedicated document about getting support.

License

Snoopy is released under GNU General Public License version 2.

Online resources

Snoopy development is located at the following URI:

• https://github.com/a2o/snoopy/

Additional git repository mirrors (read-only) are available here:

• https://gitlab.com/a2o/snoopy/
• https://bitbucket.org/snoopylogger/snoopy/

Credits

Snoopy Command Logger was originally created and maintained by:

• Marius Aamodt Eriksen [email protected]
• Mike Baker [email protected]

Contribution acknowledgements are available at the following locations:

• In the ChangeLog,
• In pull requests,
• In git history.

Snoopy is currently maintained by Bostjan Skufca Jese.

snoopy's Issues

Add ability to apply filters to specific data source only

Currently message format can be specified like this (in snoopy.ini):
message_format = "ds1=%{datasource1} ds2=%{datasource2:param1,param2}..."

Then only whole message can be filtered, like this:
filter_chain = "exclude_uid:1,2,3;exclude_spawns_of:crond"

It would be splendid if filters could be applied to only specific datasource, right in message format, like this:
message_format = 'ds1:"%{ds1|escape_json_str}" ds2="%{ds2:param1|escape_json_str}"...'

The question that needs to be answered is: do we implement this among existing filters, or do we create new entity class (modifiers, manglers, etc) which does only data mangling.

Segmentation fault in cmdline input provider

Originally reported by @ajzach in issue #39:

Error with master version (ff587e):

#  SIGSEGV (0xb) at pc=0x00007fbd09d93a03, pid=1507, tid=140447328962304
#
# JRE version: Java(TM) SE Runtime Environment (8.0_11-b12) (build 1.8.0_11-b12)
# Java VM: Java HotSpot(TM) 64-Bit Server VM (25.11-b03 mixed mode linux-amd64 compressed oops)
# Problematic frame:
# C  [libc.so.6+0x4ba03]  _IO_vfprintf+0x1d13
..............................
..............................
..............................
Stack: [0x00007fbc71170000,0x00007fbc71271000],  sp=0x00007fbc7126bc20,  free space=1007k
Native frames: (J=compiled Java code, j=interpreted, Vv=VM code, C=native code)
C  [libc.so.6+0x4ba03]  _IO_vfprintf+0x1d13

Java frames: (J=compiled Java code, j=interpreted, Vv=VM code)
j  java.lang.UNIXProcess.forkAndExec(I[B[B[BI[BI[B[IZ)I+0
j  java.lang.UNIXProcess.<init>([B[BI[BI[B[IZ)V+28
J 12594 C1 java.lang.ProcessImpl.start([Ljava/lang/String;Ljava/util/Map;Ljava/lang/String;[Ljava/lang/ProcessBuilder$Redirect;Z)Ljava/lang/Process; (634 bytes) @ 0x00007fbcf7129fd4 [0x00007fbcf7128fc0+0x1014]
J 12304 C1 java.lang.ProcessBuilder.start()Ljava/lang/Process; (303 bytes) @ 0x00007fbcf70184cc [0x00007fbcf7017ac0+0xa0c]
j  hudson.Proc$LocalProc.<init>(Ljava/lang/String;Ljava/lang/ProcessBuilder;Ljava/io/InputStream;Ljava/io/OutputStream;Ljava/io/OutputStream;)V+55
J 12588 C1 hudson.Proc$LocalProc.<init>([Ljava/lang/String;[Ljava/lang/String;Ljava/io/InputStream;Ljava/io/OutputStream;Ljava/io/OutputStream;Ljava/io/File;)V (52 bytes) @ 0x00007fbcf7124f7c [0x00007fbcf7124b40+0x43c]

#2085 __GI_abort () at abort.c:125
---Type <return> to continue, or q <return> to quit---
        act = {__sigaction_handler = {sa_handler = 0x7fbd04146ce4, sa_sigaction = 0x7fbd04146ce4}, sa_mask = {__val = {140449793993955, 
              140449793993955, 140449885647857, 11, 140447328939072, 140449793993956, 0, 0, 0, 0, 140449898820457, 0, 140449883661430, 0, 
              140449898820457, 0}}, sa_flags = 158114934, sa_restorer = 0x7fbc7126a9a0}
        sigs = {__val = {0, 0, 0, 0, 0, 140447328938208, 140447328938928, 140447328938400, 11, 140447328939072, 140447328938928, 140449881522244, 
            206158430248, 140447328938416, 140447328938224, 140449793993956}}
#2086 0x00007fbd096bd339 in os::die() () from /usr/lib/jvm/java-8-oracle/jre/lib/amd64/server/libjvm.so
No symbol table info available.
#2087 0x00007fbd0984f7c2 in VMError::report_and_die() () from /usr/lib/jvm/java-8-oracle/jre/lib/amd64/server/libjvm.so
No symbol table info available.
#2088 0x00007fbd0984fe4e in crash_handler(int, siginfo*, void*) () from /usr/lib/jvm/java-8-oracle/jre/lib/amd64/server/libjvm.so
No symbol table info available.
#2089 <signal handler called>
No locals.
#2090 __GI_abort () at abort.c:125
        act = {__sigaction_handler = {sa_handler = 0x0, sa_sigaction = 0x0}, sa_mask = {__val = {18446744073709551615 <repeats 16 times>}}, 
          sa_flags = 0, sa_restorer = 0x0}
        sigs = {__val = {32, 0 <repeats 15 times>}}
#2091 0x00007fbd096bf115 in os::abort(bool) () from /usr/lib/jvm/java-8-oracle/jre/lib/amd64/server/libjvm.so
No symbol table info available.
#2092 0x00007fbd0984f9a3 in VMError::report_and_die() () from /usr/lib/jvm/java-8-oracle/jre/lib/amd64/server/libjvm.so
No symbol table info available.
#2093 0x00007fbd096c44e2 in JVM_handle_linux_signal () from /usr/lib/jvm/java-8-oracle/jre/lib/amd64/server/libjvm.so
No symbol table info available.
#2094 0x00007fbd096bb463 in signalHandler(int, siginfo*, void*) () from /usr/lib/jvm/java-8-oracle/jre/lib/amd64/server/libjvm.so
No symbol table info available.
#2095 <signal handler called>
No locals.
#2096 0x00007fbd09d93a03 in _IO_vfprintf_internal (s=s@entry=0x7fbc7126c210, format=<optimized out>, format@entry=0x7fbd0a7578d0 "%s", 
    ap=ap@entry=0x7fbc7126c378) at vfprintf.c:1661
        len = <optimized out>
        string_malloced = <optimized out>
        step0_jumps = {0, -9485, -2676, -2589, 2607, 2694, 2015, 2291, 2998, -574, -238, 3335, 2510, 3607, -2495, -15046, -727, 1092, 1034, 1620, 
          -14278, -28, 1449, -10481, -10405, -15728, 1138, 3510, 3510, 2188}
        space = 0
        is_short = 0
        use_outdigits = 0
        step1_jumps = {0, 0, 0, 0, 0, 0, 0, 0, 0, -574, -238, 3335, 2510, 3607, -2495, -15046, -727, 1092, 1034, 1620, -14278, -28, 1449, -10481, 
          -10405, -15728, 1138, 3510, 3510, 0}
---Type <return> to continue, or q <return> to quit---
        group = 0
        prec = -1
        step2_jumps = {0, 0, 0, 0, 0, 0, 0, 0, 0, 0, -238, 3335, 2510, 3607, -2495, -15046, -727, 1092, 1034, 1620, -14278, -28, 1449, -10481, 
          -10405, -15728, 1138, 3510, 3510, 0}
        string = <optimized out>
        left = 0
        is_long_double = 0
        width = 0
        step3a_jumps = {0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 3238, 0, 0, 0, -2495, -15046, -727, 1092, 1034, 0, 0, 0, 0, -10481, 0, 0, 0, 0, 0, 0}
        alt = 0
        showsign = 0
        is_long = 0
        is_char = 0
        pad = 32 ' '
        step3b_jumps = {0 <repeats 11 times>, 2510, 0, 0, -2495, -15046, -727, 1092, 1034, 1620, -14278, -28, 1449, -10481, -10405, -15728, 1138, 0, 
          0, 0}
        step4_jumps = {0 <repeats 14 times>, -2495, -15046, -727, 1092, 1034, 1620, -14278, -28, 1449, -10481, -10405, -15728, 1138, 0, 0, 0}
        is_negative = <optimized out>
        number = <optimized out>
        base = <optimized out>
        the_arg = {pa_wchar = 175470802 L'\xa7578d2', pa_int = 175470802, pa_long_int = 140449901017298, pa_long_long_int = 140449901017298, 
          pa_u_int = 175470802, pa_u_long_int = 140449901017298, pa_u_long_long_int = 140449901017298, pa_double = 6.9391471054450486e-310, 
          pa_long_double = <invalid float value>, pa_string = 0x7fbd0a7578d2 "", 
          pa_wstring = 0x7fbd0a7578d2 <error: Cannot access memory at address 0x7fbd0a7578d2>, pa_pointer = 0x7fbd0a7578d2, pa_user = 0x7fbd0a7578d2}
        spec = 115 's'
        _buffer = {__routine = 0x3000000018, __arg = 0x7fbc7126c470, __canceltype = 1898365872, __prev = 0x0}
        _avail = <optimized out>
        thousands_sep = 0x0
        grouping = 0xffffffffffffffff <error: Cannot access memory at address 0xffffffffffffffff>
        done = 0
        f = 0x7fbd0a7578d1 "s"
        lead_str_end = <optimized out>
        end_of_spec = <optimized out>
        work_buffer = "(\000\000\000\060\000\000\000\240\304&q\274\177\000\000\340\303&q\274\177\000\000\240\304&q\274\177\000\000\340\303&q\274\177", '\000' <repeats 589 times>...
        workstart = 0x0
        workend = <optimized out>
        ap_save = {{gp_offset = 24, fp_offset = 48, overflow_arg_area = 0x7fbc7126c450, reg_save_area = 0x7fbc7126c390}}
---Type <return> to continue, or q <return> to quit---
        nspecs_done = 0
        save_errno = <optimized out>
        readonly_format = 0
        args_malloced = 0x0
        specs = <optimized out>
        specs_malloced = false


        jump_table = "\001\000\000\004\000\016\000\006\000\000\a\002\000\003\t\000\005\b\b\b\b\b\b\b\b\b\000\000\000\000\000\000\000\032\000\031\000\023\023\023\000\035\000\000\f\000\000\000\000\000\000\025\000\000\000\000\022\000\r\000\000\000\000\000\000\032\000\024\017\023\023\023\n\017\034\000\v\030\027\021\026\f\000\025\033\020\000\000\022\000\r"
        __PRETTY_FUNCTION__ = "_IO_vfprintf_internal"
#2097 0x00007fbd09dba579 in _IO_vsnprintf (string=0x7fbcd4030636 "", maxlen=<optimized out>, format=0x7fbd0a7578d0 "%s", 
    args=args@entry=0x7fbc7126c378) at vsnprintf.c:119
        sf = {f = {_sbf = {_f = {_flags = -72515583, _IO_read_ptr = 0x7fbcd4030636 "", _IO_read_end = 0x7fbcd4030636 "", 
                _IO_read_base = 0x7fbcd4030636 "", _IO_write_base = 0x7fbcd4030636 "", _IO_write_ptr = 0x7fbcd4030636 "", 
                _IO_write_end = 0x7fbcd4030642 "", _IO_buf_base = 0x7fbcd4030636 "", _IO_buf_end = 0x7fbcd4030642 "", _IO_save_base = 0x0, 
                _IO_backup_base = 0x0, _IO_save_end = 0x0, _markers = 0x0, _chain = 0x0, _fileno = 1898365760, _flags2 = 0, 
                _old_offset = 140447328944960, _cur_column = 0, _vtable_offset = 38 '&', _shortbuf = "q", _lock = 0x0, _offset = 0, _codecvt = 0x0, 
                _wide_data = 0xffffffffffffffff, _freeres_list = 0x0, _freeres_buf = 0x400000000, _freeres_size = 0, _mode = -1, 
                _unused2 = '\000' <repeats 19 times>}, vtable = 0x7fbd0a104fe0 <_IO_strn_jumps>}, _s = {_allocate_buffer = 0x0, 
              _free_buffer = 0x0}}, 
          overflow_buf = "\377\377\377\377\377\377\377\377\000\000\000\000\000\000\000\000\377\377\377\377", '\000' <repeats 12 times>, "\377\377\377\377\000\000\000\000\340O\020\n\275\177\000\000\000\000\000\000\000\000\000\000\340O\020\n\275\177\000"}
        ret = <optimized out>
#2098 0x00007fbd09d9c532 in __snprintf (s=s@entry=0x7fbcd4030636 "", maxlen=maxlen@entry=13, format=format@entry=0x7fbd0a7578d0 "%s")
    at snprintf.c:33
        arg = {{gp_offset = 32, fp_offset = 48, overflow_arg_area = 0x7fbc7126c450, reg_save_area = 0x7fbc7126c390}}
        done = 0
#2099 0x00007fbd0a756307 in snprintf (__fmt=0x7fbd0a7578d0 "%s", __n=13, __s=0x7fbcd4030636 "") at /usr/include/x86_64-linux-gnu/bits/stdio2.h:64
No locals.
#2100 snoopy_input_cmdline (input=0x7fbc7126cd20 "", arg=<optimized out>) at cmdline.c:75
        cmdLine = 0x7fbcd40305f0 "git config remote.origin.url http://git.xxxxxxxx.it/git/yyyyy/ (null) "
        cmdLineSize = 83
        argc = <optimized out>
        i = <optimized out>
        n = 70
#2101 0x00007fbd0a7546e4 in snoopy_log_message_generate (
    logMessage=logMessage@entry=0x7fbcd4034110 "[rpname:daemon user:jenkins ip:(undefined) uid:115 sid:1269 tty:(none) cwd:/ filename:/usr/bin/git]: ", logMessageFormat=<optimized out>) at log.c:140
---Type <return> to continue, or q <return> to quit---
        lengthToCopy = <optimized out>
        inputTag = "cmdline\000\000LIENT", '\000' <repeats 18 times>, "B\000\000\000\000\000\000\000\070\345&q\274\177\000\000snoopy:message_format\000\357D\313'k\"\207Մ\020\003\374/\323\037E;NQ\307\"\322Fa\b\257\b#\372", <incomplete sequence \351>
        fmtPos_inputTagArg = <optimized out>
        inputProviderNamePtr = 0x7fbc7126c4b0 "cmdline"
        inputProviderArgPtr = 0x7fbc7126c920 ""
        inputProviderMsg = "\000usr/bin/git\000ername} ip:%{env:SSH_CLIENT} uid:%{uid} sid:%{sid} tty:%{tty} cwd:%{cwd} filename:%{filename}]: %{cmdline}\"\000\317&q\274\177\000\000\360\316&q\274\177", '\000' <repeats 18 times>, "PE\270\n\275\177\000\000h\266\270\n\275\177\000\000ɫ\226\n\275\177\000\000\001", '\000' <repeats 19 times>, "\274\177\000\000h"...
        fmtStaticText = "]: \000ename:\000\b\275\177\000\000\220\345&q\274\177\000\000P\305&q\274\177\000\000\320\313Fq\274\177\000\000P\305&q\274\177\000\000\n\345&q\274\177\000\000@\265Cq\274\177\000\000\270\310Fqit --version\330\016Dqimeout=10\177\000\000(d\031\000\001\000\000\000\300\305&q\274\177\000\000\320QDq\000\000\000\000\060\306&q\274\177\000\000\220\306&q\274\177\000\000(d\031\000\001\000\000\000\360\305&q\274\177\000\000(\204\023p\275\177\000\000H\345Cq\274\177\000\000\000P/\300\274\177\000\000\020\334&q\274\177\000\000 \026Dq\274\177\000\000\000\000\000\000\000\000\000\000"...
        inputProviderArg = "\000LIENT} uid:%{uid} sid:%{sid} tty:%{tty} cwd:%{cwd} filename:%{filename}]: %{cmdline}", '\000' <repeats 891 times>...
        fmtPos_cur = <optimized out>
        fmtPos_nextInputTag = 0x7fbcd402e7cb "%{cmdline}"
        fmtPos_nextInputTagClose = 0x7fbcd402e7d4 "}"
#2102 0x00007fbd0a754a70 in snoopy_log_syscall (syscallName=syscallName@entry=0x7fbd0a757416 "execve") at log.c:385
        logMessage = 0x7fbcd4034110 "[rpname:daemon user:jenkins ip:(undefined) uid:115 sid:1269 tty:(none) cwd:/ filename:/usr/bin/git]: "
#2103 0x00007fbd0a754b33 in snoopy_log_syscall_execve (filename=filename@entry=0x7fbc7126d220 "/usr/bin/git", argv=argv@entry=0x7fbcd402ed30, 
    envp=envp@entry=0x7fbcd402b4f0) at log.c:348
No locals.
#2104 0x00007fbd0a753d25 in execve (filename=0x7fbc7126d220 "/usr/bin/git", argv=0x7fbcd402ed30, envp=0x7fbcd402b4f0) at libsnoopy.c:76
        func = 0x7fbd09e09330 <__execve>
#2105 0x00007fbd084e6e8e in execve_with_shell_fallback () from /usr/lib/jvm/java-8-oracle/jre/lib/amd64/libjava.so
No symbol table info available.
#2106 0x00007fbd084e70e1 in JDK_execvpe () from /usr/lib/jvm/java-8-oracle/jre/lib/amd64/libjava.so
No symbol table info available.
#2107 0x00007fbd084e74fb in childProcess () from /usr/lib/jvm/java-8-oracle/jre/lib/amd64/libjava.so
No symbol table info available.
#2108 0x00007fbd084e4474 in vforkChild () from /usr/lib/jvm/java-8-oracle/jre/lib/amd64/libjava.so
No symbol table info available.
#2109 0x00007fbd084e4dc0 in Java_java_lang_UNIXProcess_forkAndExec () from /usr/lib/jvm/java-8-oracle/jre/lib/amd64/libjava.so

b.

New data source: hostname and domain

It is useful when logging to file.

Create configure flags for each data source, filter and output

Data sources, filters and outputs should be includable individually by ./configure line, main reason being that if certain entity (filter, datasrc, output) is considered buggy, it may be disabled by default, but simple possibility should exist to enable it via ./configure line if knowledgeable user should wish to do so.

Therefore what needs to be implemented are the following ./configure flags:

• --with-datasource-XXX
• --with-filter-XXX
• --with-output-XXX

Q: Should --with be replaced with --enable/--disable variation?

Customizable log format

Here is the official feature discussion about customisable logging format.

It seems we have two options:

• compile time configuration
• use of a configuration file

Configuration file seems more flexible, but also more prone to errors. Using compile-time configuration would be more cumbersome for those who do not compile packages themselves.

The most sensible way to go about this would be to make two things available at configuration time

• whether configuration file should be used or not (and path to it)
• possibility of custom format specification

The flow would then go like this:

• if config file enabled, use that
• if parsing config file fails, use custom format specified at configure time
• if that is not specified or fails, revert back to default format

Would anyone care to share an opinion about this?

b.

reboot and shutdown hang on CentOS 7 (with systemd) when specifying message format

Using snoopy version 2.2.4.

Seems to be the same issue as this one

I tried updating the kernel to a newer one : no difference, same problem.

Executing the command /usr/local/sbin/snoopy-disable before doing a reboot/shutdown will make the reboot/shutdown go smoothly but snoopy will be disabled after the reboot so that's not a solution.

With snoopy enabled, I'm able to force a shutdown with this command sync && poweroff -f. According to this site it means that the problem is not the kernel and is in fact systemd.

With this howto I redirected the console output to the serial port so I could get the error message when the system hangs. The error message tells that there was a problem in the libsnoopy library that made systemd crash.

[   51.825594] systemd-shutdow[1]: segfault at 0 ip 00007fbc63ea8cfe sp 00007fff47409240 error 4 in libsnoopy.so.0.0.0[7fbc63ea3000+8000]
[   51.828672] Kernel panic - not syncing: Attempted to kill init! exitcode=0x0000000b
[   51.828672]
[   51.830418] CPU: 0 PID: 1 Comm: systemd-shutdow Not tainted 3.19.0-1.el7.elrepo.x86_64 #1
[   51.832048] Hardware name: VMware, Inc. VMware Virtual Platform/440BX Desktop Reference Platform, BIOS 6.00 07/30/2013
[   51.834178]  0000000000000000 0000000010433703 ffff88013a407c58 ffffffff816991bd
[   51.835784]  0000000000000000 ffffffff818e3058 ffff88013a407cd8 ffffffff81693510
[   51.837400]  ffff880100000010 ffff88013a407ce8 ffff88013a407c88 0000000010433703
[   51.839000] Call Trace:
[   51.839512]  [<ffffffff816991bd>] dump_stack+0x45/0x57
[   51.840552]  [<ffffffff81693510>] panic+0xd0/0x204
[   51.841515]  [<ffffffff8107a2ef>] do_exit+0xa3f/0xb30
[   51.842524]  [<ffffffff8107a46f>] do_group_exit+0x3f/0xa0
[   51.843605]  [<ffffffff810860d3>] get_signal+0x1e3/0x730
[   51.844666]  [<ffffffff81014537>] do_signal+0x37/0x750
[   51.845694]  [<ffffffff810cd0e9>] ? vprintk_default+0x29/0x40
[   51.846842]  [<ffffffff811ac26f>] ? do_munmap+0x29f/0x3b0
[   51.847918]  [<ffffffff81014cb9>] do_notify_resume+0x69/0xb0
[   51.849047]  [<ffffffff816a1d62>] retint_signal+0x48/0x86
[   51.850178] Kernel Offset: 0x0 from 0xffffffff81000000 (relocation range: 0xffffffff80000000-0xffffffff9fffffff)
[   51.852174] ---[ end Kernel panic - not syncing: Attempted to kill init! exitcode=0x0000000b
[   51.852174]

Ubuntu installer prompt

When I install Snoopy 1.8.0 on Ubuntu 12.04 using Apt package manager, I get the following scary prompt:

"Snoopy is a library that can only reliably do its work if it is mandatorily preloaded via /etc/ld.so.preload. Since this can potentially do harm to the system, your consent is needed"

Can someone shed some light as to what kind harm may this cause to a system? I've never encountered any issues with Snoopy, and I want to make sure I could use it in a production environment.

Add distcheck to releasing process

UDP SYSLOG output

Create output that sends content as plain UDP SYSLOG packet.

Note: TCP SYSLOG output will not be created - it is stateful and might be blocking, which is undesired when spawning a new process. Or maybe it should be created, but disabled by default and with lots of warnings.

Error in ini parser

Originally reported by @ajzach in issue #39:

__GI_abort () at abort.c:125
        act = {__sigaction_handler = {sa_handler = 0x0, sa_sigaction = 0x0}, sa_mask = {__val = {18446744073709551615 <repeats 16 times>}}, 
          sa_flags = 0, sa_restorer = 0x0}
        sigs = {__val = {32, 0 <repeats 15 times>}}
#2104 0x00007f7b9bdc3925 in os::abort(bool) () from /usr/lib/jvm/java-7-oracle/jre/lib/amd64/server/libjvm.so
No symbol table info available.
#2105 0x00007f7b9bf42827 in VMError::report_and_die() () from /usr/lib/jvm/java-7-oracle/jre/lib/amd64/server/libjvm.so
No symbol table info available.
#2106 0x00007f7b9bdc82af in JVM_handle_linux_signal () from /usr/lib/jvm/java-7-oracle/jre/lib/amd64/server/libjvm.so
No symbol table info available.
#2107 <signal handler called>
No locals.
#2108 iniparser_getboolean (d=d@entry=0x7f7b189690d0, key=key@entry=0x7f7b9ce274d8 "snoopy:error_logging", notfound=notfound@entry=-1)
    at iniparser/src/iniparser.c:478
        c = 0x0
#2109 0x00007f7b9ce2435d in snoopy_configuration_load_file (iniFilePath=iniFilePath@entry=0x7f7b9ce27550 "/etc/snoopy.ini") at configuration.c:194
        ini = 0x7f7b189690d0
        confValString = <optimized out>
        confValInt = <optimized out>
#2110 0x00007f7b9ce2444c in snoopy_configuration_ctor () at configuration.c:107
No locals.
#2111 0x00007f7b9ce24b57 in snoopy_init () at misc.c:56
No locals.
#2112 0x00007f7b9ce24a5d in snoopy_log_syscall (syscallName=syscallName@entry=0x7f7b9ce27426 "execve") at log.c:378
        logMessage = 0x0
#2113 0x00007f7b9ce24b43 in snoopy_log_syscall_execve (filename=filename@entry=0x7f7b1173c8a0 "/usr/local/bin/git", argv=argv@entry=0x7f7b187e88b0, 
    envp=envp@entry=0x7f7b18aa3fc0) at log.c:348
No locals.
#2114 0x00007f7b9ce23d25 in execve (filename=0x7f7b1173c8a0 "/usr/local/bin/git", argv=0x7f7b187e88b0, envp=0x7f7b18aa3fc0) at libsnoopy.c:76
        func = 0x7f7b9c4d9330 <__execve>
#2115 0x00007f7b9ac7824a in execve_with_shell_fallback () from /usr/lib/jvm/java-7-oracle/jre/lib/amd64/libjava.so
No symbol table info available.
#2116 0x00007f7b9ac7849f in JDK_execvpe () from /usr/lib/jvm/java-7-oracle/jre/lib/amd64/libjava.so
No symbol table info available.
#2117 0x00007f7b9ac78c9d in startChild () from /usr/lib/jvm/java-7-oracle/jre/lib/amd64/libjava.so
No symbol table info available.
#2118 0x00007f7b9ac7906b in Java_java_lang_UNIXProcess_forkAndExec () from /usr/lib/jvm/java-7-oracle/jre/lib/amd64/libjava.so
No symbol table info available.
---Type <return> to continue, or q <return> to quit---

@ajzach comment (copied from #39):
No, all problems occur in the forkAndExec of Java, it can be that there is a problem of concurrency?

New data source: timestamp

Create new data source: timestamp.

It might be useful if Snoopy is logging by writting directly to file.

AM_PROG_AR not found in library

./autogen.sh

Starting AutoTools run:

• '[' -d autom4te.cache ']'
• rm -rf autom4te.cache
• autoreconf -i
  configure.ac:13: warning: macro AM_PROG_AR' not found in library libtoolize:./ltmain.sh' is newer: use --force' to overwrite libtoolize:m4/libtool.m4' is newer: use --force' to overwrite libtoolize:m4/ltoptions.m4' is newer: use --force' to overwrite libtoolize:m4/ltversion.m4' is newer: use --force' to overwrite libtoolize:m4/lt~obsolete.m4' is newer: use --force' to overwrite libtoolize:AC_PROG_RANLIB' is rendered obsolete by LT_INIT' configure.ac:13: warning: macroAM_PROG_AR' not found in library
  configure.ac:13: error: possibly undefined macro: AM_PROG_AR
  If this token and others are legitimate, please use m4_pattern_allow.
  See the Autoconf documentation.
  autoreconf: /usr/bin/autoconf failed with exit status: 1

---

Any idea why the build isn't working? I cloned from master/latest. I'll try a tag next.

Corrupted log entries when cwd no longer exists

This is with the current deb package for ubuntu 12.04 (1.8.0-3) so it could be that it's fixed already in later versions, but thought I would let you know just in case.

If the cwd where the program was started has been removed, snoopy log entry gets corrupted and instead of cwd we see some other data apparently from /proc/pid/status:

Nov  3 10:50:53 app-02 snoopy[32273]: [uid:991 sid:10362 tty: cwd:#011  674656 kB#012VmLck:#011       0 kB#012VmPin:#011       0 kB#012VmHWM:#011  148236 kB#012VmRSS:#011  148236 kB#012VmData:#011  498252 kB#012VmStk:#011     136 kB#012VmExe:#011       4 kB#012VmLib:#011   15720 kB#012VmPTE:#011     720 kB#012VmSwap:#011   18564 kB#012Threads:#0111#012SigQ:#0110/241213#012SigPnd:#0110000000000000000#012ShdPnd:#0110000000000000000#012SigBlk:#0110000000000000000#012SigIgn:#0110000000008300801#012SigCgt:#0110000000182007646#012CapInh:#0110000000000000000#012CapPrm:#0110000000000000000#012CapEff:#0110000000000000000#012CapBnd:#011ffffffffffffffff#012Cpus_allowed:#0117fff#012Cpus_allowed_list:#0110-14#012Mems_allowed:#01100000000,00000001#012Mems_allowed_list:#0110#012voluntary_ctxt_switches:#0110#012nonvoluntary_ctxt_switches:#0110#012#031�#003 filename:/path/to/file]: ...```

Cannot uninstall

I installed it by using

apt-get install snoopy

and now no matter what i do it can't be uninstalled

apt-get remove snoopy
didn't do anything
purge either

please HELP!

Add functional build testing facility

All individual parts of snoopy should be tested, at least:

• each data source
• each filter
• each output (this one might be a bit difficult)
• configuration file parsing
• message formatting
• probably something else too

Configurable default output via ./configure flag

Flag recommendation: --with-default-output=OUTPUT_SPEC.

Custom input data collectors

Currently snoopy uses a fixed set of data collection routines (get UID, GID, PID, cmd line, args, etc).

It would make great sense to move these into their own functions/modules, which would be all compiled into snoopy. Then these data generators would be available to be used when configuring log format (see #10 for more information) either on the ./configure line or via configuration file.

Comments?

b.

Refactor output parsing in config file

Now all outputs are iterated in configfile.c and snoopy.h. We must use outputregistry to check if configured output is valid.

b.

UDP output

Create output that sends content as plain UDP packet.

Note: TCP output will not be created - it is stateful and might be blocking, which is undesired when spawning a new process. Or maybe it should be created, but disabled by default and with lots of warnings.

Additionally attention must be paid if remote end is configured as hostname/domain instead of IP address. This could block the whole exec process, which is not good.

Create simple installer which builds and installs snoopy with single command

This is intended for users who would like to use snoopy but are afraid of building it manually.

Command should be something in the form of:
wget -q -O - https://github.com/a2o/snoopy/raw/master/bin/snoopy-install.sh | sh

The script should:

• be distribution-agnostic
• detect latest stable snoopy version
• install all distribution-dependent build tools that are needed to build snoopy
• download latest snoopy package and uncompress it
• configure with config file enabled in /etc/snoopy.ini
• build, install and enable it

Exclude configfile code from Snoopy if not enabled via ./configure --enable-config-file argument

Snoopy 2.0.x to 2.2.x had iniparser and configuration file routines always included in final library, even if configuration file parsing was not enabled at all.

Complie error on OpenSuSE and SLES

libtool: compile: gcc -DHAVE_CONFIG_H -I. -I.. -Wall -Werror -g -O2 -MT misc.lo -MD -MP -MF .deps/misc.Tpo -c misc.c -fPIC -DPIC -o .libs/misc.o
cc1: warnings being treated as errors
misc.c: In function 'snoopy_string_append':
misc.c:112: error: call to function 'snoopy_error_handler' without a real prototype
error.h:28: note: 'snoopy_error_handler' was declared here

Upgrade ini parser to lastest git master version

Version 3.1 has 17 commits, latest master around 50 including many fixes. Upgrade required.

Make Snoopy support multiple message formats, filters and outputs simultaneously

Another interesting feature would be to enable differentiated or redundant logging based on various conditions.

Example:

• log root commands via syslog,
• log regular user activity via syslog and into this one special file, but with more verbose format,
• log each user's commands into his homedir/snoopy.log,
• log apache executed stuff into this another file.

Implementation proposal:

• use sections in snoopy.ini,
• section [snoopy] remains default,
• if another section is introduced, it may contain own message_format, filter_chain and output settings,
• sections may be enabled or disabled via some config flag.

b.

Make syslog configuration configurable in config file too

Currently it is only possible to configure it with ./configure flags:
--with-syslog-facility=LOG_AUTHPRIV
--with-syslog-level=LOG_INFO

This should be configurable in snoopy.ini:
syslog_facility = "AUTHPRIV"
syslog_level = "INFO"

Also, these should be made case-insensitive and with configure line we should loose LOG_ prefix.

Cannot reboot with snoopy installed

Migrating issue from SourceForge:
https://sourceforge.net/tracker/?func=detail&aid=3437904&group_id=9226&atid=109226

Extensive info here:
https://bugzilla.redhat.com/show_bug.cgi?id=745603

Able to reproduce:

Unable to reproduce on:

• Slackware 12.2, 13.0 and 13.1, both x86 and x86_64 variation
• CentOS 6.3 x86_64

New output: file

Create alternative output - write directly to file.

Internal filtering

There should be a possibility to add filtering capability to snoopy.

Background:
Certain versions of snoopy had a feature called "external filter". What it did was it called external program to filter log line just before snoopy would send it so syslog, giving users a possibility to manipulate log entries.
Needless to say, it was a disaster, lots of hanged systems because of execution loops (snoopy->filter->snoopyLogFilter->filter->...)

The idea was formed then, that filtering implementation should be moved from external to internal. This would give users free hands at log line manipulation, but at the expense of complexity (it must be done in C instead in bash+sed, for example).

The suggested implementation would be somewhere along these lines:

1. at configure time, you could enable build of various filters
2. configure time: you can create a default stack of filters from filters being built
3. optionally, if configuration file is enabled, that could be parsed for filter stack, which would be used instead of what was specified at ./configure time

Comments?

b.

ppid does not work

I tried to show the ppid but not displayed correctly, if I enter to a machine via ssh, the ppid would not have to be the ppid of sshd?

Dummy data source: literal

Create new data source called 'literal' which just copies input parameter to output.

Therefore, configuring message_format = "literal=%{literal:text to return}" should result in "literal=text to return" output.

This will be useful to determine if data providers actually work when testing facility is implemented.

User who logs in and uses su or sudo -s is not tracked

We have users who commonly are required to "sudo su" or "sudo -s" on our servers. We have noticed that we see the commands ran from the user when they login however, when they are sudo'd it shows as uid:0 and there is not a way to trace the command run back to the original uid.

So, if we have 2 users who login, they both sudo su. One runs rm -rf /home, the other runs touch /var/log/logtest.txt.

Snoopy records the commands as both being from root, but which user ran which command?

Is there a way to change this, or am I doing something wrong with Snoopy?

Thanks,

Tim

Support DESTDIR in etc/Makefile.am

When configuring snoopy using --enable-config-file, the Makefile in etc gets executed and snoopy.ini gets installed. This is great, but unfortunately it doesn't inherit DESTDIR, so you can't build packages that install into a different build root, as it always installs into sysconfdir.

For now, I've hacked my RPM spec file like this:

%{__sed} -i -e 's/$(sysconfdir)/snoopy.ini/$(DESTDIR)$(sysconfdir)/snoopy.ini/g' etc/Makefile.am

With that said, I'm sure there's a more elegant solution to this. I'm looking into the fix, but you may know the answer before I get there (assuming my solution is wrong) :)

You can see my latest spec file here:

https://github.com/tkimball83/rpm-specs/blob/master/snoopy.spec

(informational) Pulseaudio fills logs with snoopy installed

If, like us, you have users running desktop environments, you'll find pulseaudio filling your logs because of snoopy.

In this instance:

In /etc/pulse/client.conf
If it exists, uncomment "autospawn" and change to "no", otherwise, add a line

"autospawn = no"

(This is not a bug, but is informational, and I saw no where else to put it).

console getting flooded with snoopy-2.2.3

Installed the latest snoopy release with snoopy-install.sh on Redhat 6.6

After enabling the console is flooded with snoopy logging. Writing the messages to syslog seems broken in this release.

Tried to configure /etc/snoopy.ini

output = syslog

made no difference

Change --enable-filter to --enable-filtering

Flag named "--enable-filter" is a historic remaining from the past when Snoopy implemented a feature called "external filter", which ended in disaster (too easy to lockup a system by careless external filter implementation.

Now --enable-filter inaccurately represents filtering facility of Snoopy. In future we will implement separate ./configure flags for each data source, filter and output. Then --enable-filter would be very ambiguous. Therefore naming flags to --enable-filtering and --with-filter-X is a proper thing to do.

Problems With LVM Mounts in CentOS 7 with Snoopy Enabled

Hi Bostjan,

As we had discussed in previous items, I am attempting to get Snoopy working properly in CentOS 7. I thought I had figured it out. After successfully building from the RPM spec and installing, I was able to confirm that commands were being properly.

However, upon restart, the system fails to boot because it claims it is timing out waiting for one of the LVM block devices; in my case, the device for my /var partition.

I have debugged my setup extensively and can confirm this is recreatable only when I enable snoopy. After this crash, I can reboot back into rescue mode, disable snoopy, then the system will boot again.

Please see this screen capture of my VM console: http://i.imgur.com/DHmhsI3.png

I'm unsure on how to proceed from here. Do you have any tips on what I can do to remedy? Let me know if you'd like my kickstart file, though I'm guessing you'll be able to recreate on any CentOS 7 install.

Thanks

Fix domain datasource

Currently does not work as expected - sometimes it returns the domain, most of the times it does not.

It could just juse getaddrinfo(), but this call queries DNS if entry is not found in /etc/hosts. But DNS query could be blocking for a long while, so this is unacceptable. An implementation of this datasource must search hosts file only.

Also, when this is fixed, change test - remove xfail.

Verify thread safety

Check all the library code for thread safety. Java processes seem to have problems with it, as they are using threads.

Debugging support

When Issues #10, #11 and #12 are implemented, the need for debugging functionality will probably arise (especially for filter chains and data gathering modules).

Rename term 'input provider' to something else

The term 'input provider' does not accurately describe what that part of code does. What is does is it gathers data from specific source. Therefore it should be renamed to something else.

Initial suggestions:

• data collector
• data gatherer
• data source <-- this is my favourite ATM (and datasrc/ abbreviation should be used in code)

What do Snoopy contributors and users think about this?

b.

Optional configuration file

Looking at the tickets #8, #9, #10, #11 and #12, it makes sense to make use of configuration file an optional feature, configurable at ./configure time. Those who would not want to use it (for any reason), can disable it.

Proposed features of configuration file:

• adjustment of logging format (using input data collectors #12 at will)
• creating on-the-fly data collectors (env:USER) for example
• assigning filter stack to snoopy output

Comments?

b.

Debian/Ubuntu packaging support

You can find in my debian branch (https://github.com/renard/snoopy/tree/debian) all required files to build snoopy debian packages.

To build you just need to checkout the debian dir in current.

git checkout -b build
git checkout debian .
debuild

Hope that helps.

Snoopy crash the jvm

I have Snoopy (the last version + my pull request) running in many servers, when a server is restarted the jvm falls:

hs_err_pid:

A fatal error has been detected by the Java Runtime Environment:

SIGSEGV (0xb) at pc=0x00007fab985724d7, pid=15146, tid=140374290736896

JRE version: Java(TM) SE Runtime Environment (7.0_40-b43) (build 1.7.0_40-b43)
Java VM: Java HotSpot(TM) 64-Bit Server VM (24.0-b56 mixed mode linux-amd64 compressed oops)
Problematic frame:
C [libc.so.6+0x3a4d7] abort+0x297
...................
...................
...................
Stack: [0x00007fab6fac2000,0x00007fab6fbc3000], sp=0x00007fab6fbbf900, free space=1014k
Native frames: (J=compiled Java code, j=interpreted, Vv=VM code, C=native code)
C [libc.so.6+0x3a4d7] abort+0x297

Java frames: (J=compiled Java code, j=interpreted, Vv=VM code)
j java.lang.UNIXProcess.forkAndExec([B[BI[BI[B[IZ)I+0
j java.lang.UNIXProcess.([B[BI[BI[B[IZ)V+19
j java.lang.ProcessImpl.start([Ljava/lang/String;Ljava/util/Map;Ljava/lang/String;[Ljava/lang/ProcessBuilder$Redirect;Z)Ljava/lang/Process;+433
j java.lang.ProcessBuilder.start()Ljava/lang/Process;+124
j org.apache.hadoop.util.Shell.runCommand()V+125
j org.apache.hadoop.util.Shell.run()V+23
j org.apache.hadoop.util.Shell$ShellCommandExecutor.execute()V+1
j org.apache.hadoop.yarn.server.nodemanager.DefaultContainerExecutor.launchContainer(Lorg/apache/hadoop/yarn/server/nodemanager/containermanager/ container/Container;Lorg/apache/hadoop/fs/Path;Lorg/apache/hadoop/fs/Path;Ljava/lang/String;Ljava/lang/String;Lorg/apache/hadoop/fs/Path;Ljava/util/ List;Ljava/util/List;)I+521
j org.apache.hadoop.yarn.server.nodemanager.containermanager.launcher.ContainerLaunch.call()Ljava/lang/Integer;+1097
j org.apache.hadoop.yarn.server.nodemanager.containermanager.launcher.ContainerLaunch.call()Ljava/lang/Object;+1
j java.util.concurrent.FutureTask.run()V+42
j java.util.concurrent.ThreadPoolExecutor.runWorker(Ljava/util/concurrent/ThreadPoolExecutor$Worker;)V+95
j java.util.concurrent.ThreadPoolExecutor$Worker.run()V+5
j java.lang.Thread.run()V+11
v ~StubRoutines::call_stub

apport.log:
ERROR: apport (pid 26360) Thu Apr 16 10:41:10 2015: called for pid 26323, signal 11, core limit 0
ERROR: apport (pid 26360) Thu Apr 16 10:41:10 2015: executable: /usr/lib/jvm/java-7-oracle/bin/java (command line "/usr/lib/jvm/java-7-oracle//bin/java -Dproc_nodemanager -Xmx4000m -Dhadoop.log.dir=/home/hadoop/hadoop-2.5.0/logs -Dyarn..............
ERROR: apport (pid 26360) Thu Apr 16 10:41:10 2015: is_closing_session(): no DBUS_SESSION_BUS_ADDRESS in environment
ERROR: apport (pid 26360) Thu Apr 16 10:42:51 2015: wrote report /var/crash/_usr_lib_jvm_java-7-oracle_bin_java.1002.crash

The errors were produced using jenkins and hadoop, do you have any idea what could be the problem?

Snoopy configuration: when free()-ing config values, reset them back to defaults

This would probably cause buffer overflow if config file vanished suddenly.

Configurable argument lenght

Migrating issue from sourceforge (and closing issue tracker there):
https://sourceforge.net/tracker/?func=detail&atid=359226&aid=3598683&group_id=9226

At first, I was thinking of making a patch vaguely along the lines of:

--- a/snoopy.h
+++ b/snoopy.h
@@ -9,5 +9,5 @@
*
- Maximum size of any argument.
  */
  -#define SNOOPY_MAX_ARG_LENGTH 4096
  -
  +#include <unistd.h>
  +#define SNOOPY_MAX_ARG_LENGTH sysconf(_SC_ARG_MAX)

To make sure snoopy is logging the max default (without futzing with rlimit stack sizes) possible execve() command line. Then I noticed you mentioned on the forum to open a bug and track the progress here. Since snoopy is auditing software (vaguely reminiscent of the keystroke logging aspect of power broker), I'd like it to have the ability to log the maximum available execve() line. Does something like the above patch make sense? If so, I'd like to create a proper git patch and sen you a pull request on github. If not, how could we make it configurable? Build time is fine.

I actually wish this was the github issue tracker bug as it makes it much easier to link to specific code or annotate the code inline via markdown, but I digress! Awesome software by the way!

(originally submitted by Jeff Schroeder)

only logs root

hello

snoopy only logs root , how i change it to log all users ?

and i only what to log the command and not what the sheel script do inside,

thanks

Upcoming 2.0.0 release

Due date: 2014-11-11

Generic argument parser for comma-separated argument list

Snoopy needs generic argument parser that splits comma-separated arguments into array of strings.

This will be useful for datasources, filters and outputs, so that code there is not cluttered with argument parsing functionality.

Additonally a named argument parser might be created, to support list of named arguments, like "argName1=val1,argName2=val2".

How to find MySQL data for logging into Snoopy

I would like to add the commands that are executed within MySQL, is that possible using Snoopy? We already use it to monitor many things, but having MySQL there would be awesome.

Double free or corruption

Bug in master:

#2106 __GI_abort () at abort.c:125
        act = {__sigaction_handler = {sa_handler = 0x0, sa_sigaction = 0x0}, sa_mask = {__val = {18446744073709551615 <repeats 16 times>}}, 
          sa_flags = 0, sa_restorer = 0x0}
        sigs = {__val = {32, 0 <repeats 15 times>}}
#2107 0x00007fd8fa1f3394 in __libc_message (do_abort=do_abort@entry=1, fmt=fmt@entry=0x7fd8fa301b28 "*** Error in `%s': %s: 0x%s ***\n")
    at ../sysdeps/posix/libc_fatal.c:175
        ap = {{gp_offset = 40, fp_offset = 32728, overflow_arg_area = 0x7fd85c275470, reg_save_area = 0x7fd85c275400}}
        fd = 2
        on_2 = <optimized out>
        list = <optimized out>
        nlist = <optimized out>
        cp = <optimized out>
        written = <optimized out>
---Type <return> to continue, or q <return> to quit---
#2108 0x00007fd8fa1ff66e in malloc_printerr (ptr=<optimized out>, str=0x7fd8fa301c58 "double free or corruption (out)", action=1) at malloc.c:4996
        buf = "00007fd8b84d1b50"
        cp = <optimized out>
#2109 _int_free (av=<optimized out>, p=<optimized out>, have_lock=0) at malloc.c:3840
        size = <optimized out>
        fb = <optimized out>
        nextchunk = <optimized out>
        nextsize = <optimized out>
        nextinuse = <optimized out>
        prevsize = <optimized out>
        bck = <optimized out>
        fwd = <optimized out>
        errstr = <optimized out>
        locked = <optimized out>
#2110 0x00007fd8fab8bd89 in snoopy_configuration_dtor () at configuration.c:128
No locals.
#2111 0x00007fd8fab8cb57 in snoopy_cleanup () at misc.c:75
No locals.
#2112 0x00007fd8fab8ca98 in snoopy_log_syscall (syscallName=syscallName@entry=0x7fd8fab8f396 "execve") at log.c:398
        logMessage = <optimized out>
#2113 0x00007fd8fab8cb33 in snoopy_log_syscall_execve (filename=filename@entry=0x7fd85c2755a0 "/usr/bin/git", argv=argv@entry=0x7fd8dc0247b0, 
    envp=envp@entry=0x7fd8dc044f60) at log.c:348
No locals.
#2114 0x00007fd8fab8bd35 in execve (filename=0x7fd85c2755a0 "/usr/bin/git", argv=0x7fd8dc0247b0, envp=0x7fd8dc044f60) at libsnoopy.c:76
        func = 0x7fd8fa241330 <__execve>
#2115 0x00007fd8f891ee8e in execve_with_shell_fallback () from /usr/lib/jvm/java-8-oracle/jre/lib/amd64/libjava.so
No symbol table info available.
#2116 0x00007fd8f891f0e1 in JDK_execvpe () from /usr/lib/jvm/java-8-oracle/jre/lib/amd64/libjava.so
No symbol table info available.
#2117 0x00007fd8f891f4fb in childProcess () from /usr/lib/jvm/java-8-oracle/jre/lib/amd64/libjava.so
No symbol table info available.
#2118 0x00007fd8f891c474 in vforkChild () from /usr/lib/jvm/java-8-oracle/jre/lib/amd64/libjava.so
No symbol table info available.
#2119 0x00007fd8f891cdc0 in Java_java_lang_UNIXProcess_forkAndExec () from /usr/lib/jvm/java-8-oracle/jre/lib/amd64/libjava.so