1 #
   2 # Copyright (c) 2015, 2019, Oracle and/or its affiliates. All rights reserved.
   3 # DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
   4 #
   5 # This code is free software; you can redistribute it and/or modify it
   6 # under the terms of the GNU General Public License version 2 only, as
   7 # published by the Free Software Foundation.
   8 #
   9 # This code is distributed in the hope that it will be useful, but WITHOUT
  10 # ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
  11 # FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
  12 # version 2 for more details (a copy is included in the LICENSE file that
  13 # accompanied this code).
  14 #
  15 # You should have received a copy of the GNU General Public License version
  16 # 2 along with this work; if not, write to the Free Software Foundation,
  17 # Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
  18 #
  19 # Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
  20 # or visit www.oracle.com if you need additional information or have any
  21 # questions.
  22 #
  23 
  24 config.execSuffix=.exe
  25 config.getChildren.app=bash
  26 config.getChildren.pattern=%p
  27 config.getChildren.args=-c\0wmic process where ParentProcessId=%p get ProcessId | tail -n+2
  28 config.getChildren.args.delimiter=\0
  29 ################################################################################
  30 # process info to gather
  31 ################################################################################
  32 onTimeout=\
  33   native.info \
  34   native.pmap.normal native.pmap.everything \
  35   native.files native.locks \
  36   native.stack native.core
  37 ################################################################################
  38 native.pattern=%p
  39 native.javaOnly=false
  40 native.args=%p
  41 
  42 native.info.app=wmic
  43 native.info.args=process where processId=%p list full
  44 
  45 native.pmap.app=pmap
  46 native.pmap.normal.args=%p
  47 native.pmap.everything.args=-x %p
  48 
  49 native.files.app=handle
  50 native.files.args=-p %p
  51 # TODO
  52 native.locks.app=lslocks
  53 native.locks.args=-u --pid %p
  54 
  55 native.stack.app=cdb
  56 native.stack.args=-c "~*kP n;qd" -p %p
  57 native.stack.params.repeat=6
  58 
  59 native.core.app=cdb
  60 native.core.args=-c ".dump /f core.%p;qd" -p %p
  61 native.core.params.timeout=3600000
  62 ################################################################################
  63 # environment info to gather
  64 ################################################################################
  65 environment=\
  66   users.current users.logged \
  67   disk \
  68   env \
  69   system.events.system system.events.application system.os \
  70   process.top process.ps process.tasklist \
  71   memory.free memory.vmstat.default memory.vmstat.statistics \
  72         memory.vmstat.slabinfo memory.vmstat.disk \
  73   files \
  74   net.sockets net.statistics net.ipconfig
  75 ################################################################################
  76 users.current.app=id
  77 users.current.args=-a
  78 users.logged.app=query
  79 users.logged.args=user
  80 
  81 disk.app=df
  82 disk.args=-h
  83 
  84 env.app=env
  85 
  86 system.events.app=powershell
  87 system.events.delimiter=\0
  88 system.events.system.args=-NoLogo\0-Command\0Get-EventLog System -After (Get-Date).AddDays(-1) | Format-List
  89 system.events.application.args=-NoLogo\0-Command\0Get-EventLog Application -After (Get-Date).AddDays(-1) | Format-List
  90 
  91 system.os.app=wmic
  92 system.os.args=os get /format:list
  93 
  94 process.top.app=top
  95 process.top.args=-b -n 1
  96 process.ps.app=ps
  97 process.ps.args=-efW
  98 process.tasklist.app=tasklist
  99 process.tasklist.args=/V
 100 
 101 memory.free.app=free
 102 memory.vmstat.app=vmstat
 103 memory.vmstat.statistics.args=-s
 104 memory.vmstat.slabinfo.args=-m
 105 memory.vmstat.disk.args=-d
 106 
 107 files.app=openfiles
 108 files.args=/query
 109 
 110 net.sockets.app=bash
 111 net.sockets.args=-c\0netstat -b -a -t -o || netstat -a -t -o
 112 net.sockets.args.delimiter=\0
 113 net.statistics.app=netstat
 114 net.statistics.args=-s -e
 115 net.ipconfig.app=ipconfig
 116 net.ipconfig.args=/all
 117 ################################################################################