setuids.d(1m) USER COMMANDS setuids.d(1m)NAMEsetuids.d - snoop setuid calls as they occur. Uses DTrace.
SYNOPSISsetuids.dDESCRIPTIONsetuids.d is a simple DTrace program to print details of setuid calls,
where a process assumes a different UID. These are usually related to
login events.
Since this uses DTrace, only users with root privileges can run this
command.
EXAMPLES
Default output, print setuids as they occur,
# setuids.dFIELDS
UID user ID (from)
SUID set user ID (to)
PPID parent process ID
PID process ID
PCMD parent command
CMD command (with arguments)
DOCUMENTATION
See the DTraceToolkit for further documentation under the Docs direc‐
tory. The DTraceToolkit docs may include full worked examples with ver‐
bose descriptions explaining the output.
EXITsetuids.d will run forever until Ctrl-C is hit.
AUTHOR
Brendan Gregg [Sydney, Australia]
SEE ALSOdtrace(1M), bsmconv(1M)version 1.00 Jun 18, 2005 setuids.d(1m)