@yeet/opensnoop

opensnoop is a lightweight, high-performance tool designed to monitor and log all open system calls in real time. It efficiently captures detailed file access data such as file names, process IDs, and user information, all with minimal system overhead. Ideal for security auditing and troubleshooting, opensnoop provides comprehensive visibility into every file opened on the system, enhancing observability and security. It integrates seamlessly into your existing infrastructure.

Installation

Use yeet to install this package

sudo yeet install opensnoop

0.1.0Dual BSD / GPLPublic

opensnoop is a lightweight, high-performance tool designed to monitor and log all open system calls in real time. It efficiently captures detailed file access data such as file names, process IDs, and user information, all with minimal system overhead. Ideal for security auditing and troubleshooting, opensnoop provides comprehensive visibility into every file opened on the system, enhancing observability and security. It integrates seamlessly into your existing infrastructure.

Get Started

1. Install yeet

2. Deploy opensnoop

3. Create a collection

4. Monitor events

Data Schema

Each time an open syscall occurs, a new row is added to the collection with the following schema:

Field	Type	Description
timestamp	Date	The time when the open syscall occurred.
seq_no	Int	A sequential number for the open event.
event	OpensnoopEvent	Contains details about the open event.

Opensnoop Event

Field	Type	Description
pid	int	The process ID of the executed command.
tgid	int	The thread group ID of the executed command.
ppid	int	The parent process ID of the executed command.
cgroup_id	string	The ID of the control group associated with the process.
cgroup_name	string	The name of the control group associated with the process.
uid	int	The user who triggered the open.
gid	int	The group ID of the user.
latency_ns	int	How long the open took to complete in nanoseconds.
fd	int	The file descriptor of the opened file.
comm	string	The command name of the executed process.
path	string	The path of the opened file.

Example query:

You can query this collection using the SQL Editor.

SELECT
  timestamp,
  seq_no,
  event->>'$.pid' AS pid,
  event->>'$.tgid' AS tgid,
  event->>'$.ppid' AS ppid,
  event->>'$.cgroup_id' AS cgroup_id,
  event->>'$.cgroup_name' AS cgroup_name,
  event->>'$.uid' AS uid,
  event->>'$.gid' AS gid,
  CAST(event->>'$.latency_ns' AS int) AS latency_ns,
  event->>'$.fd' AS fd,
  event->>'$.comm' AS comm,
  event->>'$.path' AS path
FROM <your_collection_name_here>
ORDER BY seq_no DESC

Key Details:

JSON Path Extraction

The syntax event->>'$.property_name' is used to extract properties from the JSON event object without enclosing them in quotes.

CAST Function

latency_ns is cast to an integer, as it is initially treated as a string. This conversion ensures it can be correctly visualized or processed numerically.