Slide 11
Slide 11 text
#pragma D option destructive
BEGIN
{
self->interested =0;
}
proc:::exec-success
/(execname =="rm") && (self->interested == 0) && (dirname(curpsinfo->pr_psargs) != "
{
self->interested = 1 ;
printf("Someone is trying to delete %s\n",dirname(curpsinfo->pr_psargs +3));
printf("%s %d",dirname(curpsinfo->pr_psargs+3),timestamp);
printf("Snapshotting %s %d",dirname(curpsinfo->pr_psargs+3),timestamp);
system("/usr/sbin/zfs snapshot rpool%s@%d",dirname(curpsinfo->pr_psargs+3),times
stop();
system("prun %d", pid);
}