github.com/inspektor-gadget/inspektor-gadget@v0.28.1/docs/builtin-gadgets/trace/signal.md (about)

     1  ---
     2  title: 'Using trace signal'
     3  weight: 20
     4  description: >
     5    Trace signals received by processes.
     6  ---
     7  
     8  The trace signal gadget is used to trace system signals received by the
     9  pods.
    10  
    11  ### On Kubernetes
    12  
    13  First, we need to create one pod for us to play with:
    14  
    15  ```bash
    16  $ kubectl run debian --image debian:latest sleep inf
    17  ```
    18  
    19  You can now use the gadget, but output will be empty:
    20  
    21  ```bash
    22  $ kubectl gadget trace signal
    23  K8S.NODE         K8S.NAMESPACE    K8S.POD          K8S.CONTAINER    PID    COMM             SIGNAL    TPID   RET
    24  ```
    25  
    26  Indeed, it is waiting for signals to be sent.
    27  So, in *another terminal*, `exec` the container and send one signal:
    28  
    29  ```bash
    30  $ kubectl exec -ti debian -- sh -c 'sleep 3 & kill -kill $!'
    31  ```
    32  
    33  Go back to *the first terminal* and see:
    34  
    35  ```
    36  K8S.NODE         K8S.NAMESPACE    K8S.POD          K8S.CONTAINER    PID    COMM             SIGNAL    TPID   RET
    37  minikube         default          debian           debian           129484 sh               SIGKILL   129491 0
    38  minikube         default          debian           debian           129484 sh               SIGHUP    129491 0
    39  minikube         default          debian           debian           129484 sh               SIGHUP    129484 0
    40  ```
    41  
    42  The first line corresponds to `kill` sending signal `SIGKILL` to `sleep`.
    43  
    44  You can also use this gadget to trace when processes die with segmentation fault.
    45  In the *other terminal*, `exec` the container with the following:
    46  
    47  ```bash
    48  $ kubectl exec -ti debian -- bash
    49  # We first need to install python2.
    50  # apt update && apt install -qy python2
    51  # We can now generate a segfault.
    52  # python2.7 -c "exec'()'*7**6"
    53  ```
    54  
    55  Now, go back to the first terminal and see that `SIGSEGV` was sent to python:
    56  
    57  ```
    58  minikube         default          debian           debian           142244 python2.7        SIGSEGV   142244 0
    59  ```
    60  
    61  #### Clean everything
    62  
    63  Congratulations! You reached the end of this guide!
    64  You can now delete the pod you created:
    65  
    66  ```bash
    67  $ kubectl delete pod debian
    68  pod "debian" deleted
    69  ```
    70  
    71  ### With `ig`
    72  
    73  Start the gadget on a terminal.
    74  
    75  ```bash
    76  $ sudo ig trace signal -c test-trace-signal
    77  ```
    78  
    79  Run a container and run sleep in the background, then will it:
    80  
    81  ```bash
    82  $ docker run -it --rm --name test-trace-signal busybox /bin/sh
    83  / # sleep 100 &
    84  / # echo $!
    85  7
    86  / # kill -kill $!
    87  / # exit
    88  ```
    89  
    90  The gadget will show that sh killed a process.
    91  
    92  ```bash
    93  $ sudo ig trace signal -c test-trace-signal
    94  RUNTIME.CONTAINERNAME      PID        COMM          SIGNAL      TPID       RET
    95  test-trace-signal          11131      sh            SIGKILL     11162      0
    96  test-trace-signal          11131      sh            SIGHUP      11131      0
    97  ```
    98  
    99  ### Restricting output to certain PID, signals or failed to send the signals
   100  
   101  With the following option, you can restrict the output:
   102  
   103  * `--pid` only prints events where a signal is sent by the given PID.
   104  * `--signal` only prints events where the given signal is sent.
   105  * `-f/--failed-only` only prints events where signal failed to be delivered.
   106  * `-k/--kill-only` only prints events where signal was sent by using kill syscall.
   107  
   108  For example, this command will only print failed attempts to send `SIGKILL` by PID `42` which were initiated by calling kill syscall:
   109  
   110  ```bash
   111  $ kubectl gadget -k -f --pid 42 --signal SIGKILL
   112  ```
   113  
   114  Note that, with `--signal` you can use the name of the signal (e.g. `SIGKILL`) or its integer value (e.g. 9).