neulab/tldr huggingface dataset:
•   uint64 cgroupid(const string path)
cgroupid retrieves the cgroupv2 ID  of the cgroup available at path.
BEGIN { print(cgroupid("/sys/fs/cgroup/system.slice")); }
exit variants
•   void exit()
Terminate bpftrace, as if a SIGTERM was received. The END probe will still trigger (if specified) and maps will be printed.
join variants
•   void join(char *arr[], [char * sep = ' '])
join joins all the string array arr with sep as separator into one string. This string will be printed to stdout directly, it cannot be used as string value.
The concatenation of the array members is done in BPF and the printing happens in userspace.
tracepoint:syscalls:sys_enter_execve { join(args->argv); }
kaddr variants
•   uint64 kaddr(const string name)
Get the address of the kernel symbol name.
The following script:
kptr variants
•   T * kptr(T * ptr)
Marks ptr as a kernel address space pointer. See the address-spaces section for more information on address-spaces. The pointer type is left unchanged.
ksym variants
•   ksym_t ksym(uint64 addr)
Retrieve the name of the function that contains address addr. The address to name mapping happens in user-space.
The ksym_t type can be printed with the %s format specifier.
kprobe:do_nanosleep { printf("%s\n", ksym(reg("ip"))); }
do_nanosleep
macaddr variants
•   macaddr_t macaddr(char [6] mac)
Create a buffer that holds a macaddress as read from mac This buffer can be printed in the canonical string format using the %s format specifier.
kprobe:arp_create { printf("SRC %s, DST %s\n", macaddr(sarg0), macaddr(sarg1)); }
SRC 18:C0:4D:08:2E:BB, DST 74:83:C2:7F:8C:FF
ntop variants
•   inet_t ntop([int64 af, ] int addr)
•   inet_t ntop([int64 af, ] char addr[4])
•   inet_t ntop([int64 af, ] char addr[16])
ntop returns the string representation of an IPv4 or IPv6 address. ntop will infer the address type (IPv4 or IPv6) based on the addr type and size. If an integer or char[4] is given, ntop assumes IPv4, if a char[16] is given, ntop assumes IPv6. You can also pass the address type (e.g. AF_INET) explicitly as the first parameter.
override variants
•   override(uint64 rc)
Kernel 4.16
Helper bpf_override
Supported probes
•   kprobe
When using override the probed function will not be executed and instead rc will be returned.
k:__x64_sys_getuid /comm == "id"/ { override(2<<21); }
uid=4194304 gid=0(root) euid=0(root) groups=0(root)
This feature only works on kernels compiled with CONFIG_BPF_KPROBE_OVERRIDE and only works on functions tagged ALLOW_ERROR_INJECTION.
bpftrace does not test whether error injection is allowed for the probed function, instead if will fail to load the program into the kernel:
ioctl(PERF_EVENT_IOC_SET_BPF): Invalid argument Error attaching probe: 'kprobe:vfs_read'
reg variants
•   reg(const string name)
•   uprobe
Get the contents of the register identified by name. Valid names depend on the CPU architecture.
signal variants
•   signal(const string sig)
•   signal(uint32 signum)
Helper bpf_send_signal
Probe types: k(ret)probe, u(ret)probe, USDT, profile
Send a signal to the process being traced. The signal can either be identified by name, e.g. SIGSTOP or by ID, e.g. 19 as found in kill -l.
kprobe:__x64_sys_execve /comm == "bash"/ { signal(5); }
$ ls Trace/breakpoint trap (core dumped)
sizeof variants
•   sizeof(TYPE)
•   sizeof(EXPRESSION)
Returns size of the argument in bytes. Similar to C/C++ sizeof operator. Note that the expression does not get evaluated.
str variants
•   str(char * data [, uint32 length)
Helper probe_read_str, probe_read_{kernel,user}_str
str reads a NULL terminated (\0) string from data. The maximum string length is limited by the BPFTRACE_STR_LEN env variable, unless length is specified and shorter than the maximum. In case the string is longer than the specified length only length - 1 bytes are copied and a NULL byte is appended at the end.
When available (starting from kernel 5.5, see the --info flag) bpftrace will automatically use the kernel or user variant of probe_read_{kernel,user}_str based on the address space of data, see ADDRESS-SPACES for more information.
strftime variants
•   strtime_t strftime(const string fmt, int64 timestamp_ns)
Format the nanoseconds since boot timestamp timestamp_ns according to the format specified by fmt. The time conversion and formatting happens in user space, therefore  the timestr_t value returned can only be used for printing using the %s format specifier.
bpftrace uses the strftime(3) function for formatting time and supports the same format specifiers.
i:s:1 { printf("%s\n", strftime("%H:%M:%S", nsecs)); }
bpftrace also supports the following format string extensions:
┌──────────┬────────────────────────────┐ │          │                            │ │Specifier │ Description                │ ├──────────┼────────────────────────────┤ │          │                            │ │%f        │ Microsecond as a decimal   │ │          │ number, zero-padded on the │ │          │ left                       │ └──────────┴────────────────────────────┘
strncmp variants
•   int64 strncmp(char * s1, char * s2, int64 n)
strncmp compares up to n characters string s1 and string s2. If they’re equal 0 is returned, else a non-zero value is returned.
bpftrace doesn’t read past the length of the shortest string.
The use of the == and != operators is recommended over calling strncmp directly.
system variants
•   void system(string namefmt [, ...args])
unsafe async
system lets bpftrace run the specified command (fork and exec) until it completes and print its stdout. The command is run with the same privileges as bpftrace and it blocks execution of the processing threads which can lead to missed events and delays processing of async events.
i:s:1 { time("%H:%M:%S: "); printf("%d\n", @++); } i:s:10 { system("/bin/sleep 10"); } i:s:30 { exit(); }
Note how the async time and printf first print every second until the i:s:10 probe hits, then they print every 10 seconds due to bpftrace blocking on sleep.
Attaching 3 probes... 08:50:37: 0 08:50:38: 1 08:50:39: 2 08:50:40: 3 08:50:41: 4 08:50:42: 5 08:50:43: 6 08:50:44: 7 08:50:45: 8 08:50:46: 9 08:50:56: 10 08:50:56: 11 08:50:56: 12 08:50:56: 13 08:50:56: 14 08:50:56: 15 08:50:56: 16 08:50:56: 17 08:50:56: 18 08:50:56: 19
system supports the same format string and arguments that printf does.
t:syscalls:sys_enter_execve { system("/bin/grep %s /proc/%d/status", "vmswap", pid); }
time variants
•   void time(const string fmt)
Format the current wall time according to the format specifier fmt and print it to stdout. Unlike strftime() time() doesn’t send a timestamp from the probe, instead it is the time at which user-space processes the event.
uaddr variants
•   T * uaddr(const string sym)
•   uprobes
•   uretprobes
•   USDT
Does not work with ASLR, see issue #75 <https://github.com/iovisor/bpftrace/issues/75>
The uaddr function returns the address of the specified symbol. This lookup happens during program compilation and cannot be used dynamically.
The default return type is uint64*. If the ELF object size matches a known integer size (1, 2, 4 or 8 bytes) the return type is modified to match the width (uint8*, uint16*, uint32* or uint64* resp.). As ELF does not contain type info the type is always assumed to be unsigned.
uprobe:/bin/bash:readline { printf("PS1: %s\n", str(*uaddr("ps1_prompt"))); }
uptr variants
•   T * uptr(T * ptr)
Marks ptr as a user address space pointer. See the address-spaces section for more information on address-spaces. The pointer type is left unchanged.
usym variants
•   usym_t usym(uint64 * addr)
Equal to ksym but resolves user space symbols
uprobe:/bin/bash:readline { printf("%s\n", usym(reg("ip"))); }
path variants
•   char * path(struct path * path)
Kernel 5.10
Helper bpf_d_path
Return full path referenced by struct path pointer in argument.
This function can only be used by functions that are allowed to, these functions are contained in the btf_allowlist_d_path set in the kernel.
unwatch variants
•   void unwatch(void * addr)
Removes a watchpoint
print variants
•   void print(T val)
•   void print(@map)
•   void print(@map, uint64 top)
•   void print(@map, uint64 top, uint64 div)
print prints a the value, which can be a map or a scalar value, with the default formatting for the type.
i:ms:10 { @=hist(rand); } i:s:1 { print(@); print(123); print("abc"); exit(); }
@: [16M, 32M)             3 |@@@                                                 | [32M, 64M)             2 |@@                                                  | [64M, 128M)            1 |@                                                   | [128M, 256M)           4 |@@@@                                                | [256M, 512M)           3 |@@@                                                 | [512M, 1G)            14 |@@@@@@@@@@@@@@                                      | [1G, 2G)              22 |@@@@@@@@@@@@@@@@@@@@@@                              | [2G, 4G)              51 |@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@|
Note that maps are printed by reference while scalar values are copied. This means that updating and printing maps in a fast loop will likely result in bogus map values as the map will be updated before userspace gets the time to dump and print it.
The printing of maps supports the optional top and div arguments. top limits the printing to the top N entries with the highest integer values
BEGIN { $i = 11; while($i) { @[$i] = --$i; } print(@, 2); clear(@); exit() }
@[9]: 9 @[10]: 10
The div argument scales the values prior to printing them. Scaling values before storing them can result in rounding errors. Consider the following program:
k:f { @[func] += arg0/10; }
With the following sequence as numbers for arg0: 134, 377, 111, 99. The total is 721 which rounds to 72 when scaled by 10 but the program would print 70 due to the rounding of individual values.
Changing the print call to print(@, 5, 2) will take the top 5 values and scale them by 2:
@[6]: 3 @[7]: 3 @[8]: 4 @[9]: 4 @[10]: 5
printf variants
•   void printf(const string fmt, args...)
printf() formats and prints data. It behaves similar to printf() found in C and many other languages.
The format string has to be a constant, it cannot be modified at runtime. The formatting of the string happens in user space. Values are copied and passed by value.
bpftrace supports all the typical format specifiers like %llx and %hhu. The non-standard ones can be found in the table below:
┌──────────┬────────┬──────────────────────┐ │          │        │                      │ │Specifier │ Type   │ Description          │ ├──────────┼────────┼──────────────────────┤ │          │        │                      │ │r         │ buffer │ Hex-formatted string │ │          │        │ to print arbitrary   │ │          │        │ binary content       │ │          │        │ returned by the buf  │ │          │        │ (buf) function.      │ └──────────┴────────┴──────────────────────┘
Supported escape sequences
Colors are supported too, using standard terminal escape sequences:
print("\033[31mRed\t\033[33mYellow\033[0m\n")
bpftrace supports various probe types which allow the user to attach BPF programs to different types of events. Each probe starts with a provider (e.g. kprobe) followed by a colon (:) separated list of options. The amount of options and their meaning depend on the provider and are detailed below. The valid values for options can depend on the system or binary being traced, e.g. for uprobes it depends on the binary. Also see LISTING PROBES
It is possible to associate multiple probes with a single action as long as the action is valid for all specified probes. Multiple probes can be specified as a comma (,) separated list:
kprobe:tcp_reset,kprobe:tcp_v4_rcv { printf("Entered: %s\n", probe); }
Wildcards are supported too:
kprobe:tcp_* { printf("Entered: %s\n", probe); }
Both can be combined:
kprobe:tcp_reset,kprobe:*socket* { printf("Entered: %s\n", probe); }
Most providers also support a short name which can be used instead of the full name, e.g. kprobe:f and k:f are identical.
BEGIN and END These are special built-in events provided by the bpftrace runtime. BEGIN is triggered before all other probes are attached. END is triggered after all other probes are detached.
Note that specifying an END probe doesn’t override the printing of 'non-empty' maps at exit. To prevent the printing all used maps need be cleared, which can be done in the END probe:
END { clear(@map1); clear(@map2); }
•   hardware:event_name:
•   hardware:event_name:count
•   h
The hardware probe attaches to pre-defined hardware events provided by the kernel.
They are implemented using performance monitoring counters (PMCs): hardware resources on the processor. There are about ten of these, and they are documented in the perf_event_open(2) man page. The event names are:
•   cpu-cycles or cycles
•   instructions
•   cache-references
•   cache-misses
•   branch-instructions or branches
•   branch-misses
•   bus-cycles
•   frontend-stalls
•   backend-stalls
•   ref-cycles
The count option specifies how many events must happen before the probe fires. If count is left unspecified a default value is used.
hardware:cache-misses:1e6 { @[pid] = count(); }
interval variants
•   interval:us:count
•   interval:ms:count
•   interval:s:count
•   interval:hz:rate
•   i
The interval probe fires at a fixed interval as specified by its time spec. Interval fire on one CPU at the time, unlike [profile] probes.
iterator variants
•   iter:task
•   iter:task:pin
•   iter:task_file
•   iter:task_file:pin
•   it
These are eBPF iterator probes, that allow iteration over kernel objects.
Iterator probe can’t be mixed with any other probe, not even other iterator.
Each iterator probe provides set of fields that could be accessed with ctx pointer. User can display set of available fields for iterator via -lv options as described below.
# bpftrace -e 'iter:task { printf("%s:%d\n", ctx->task->comm, ctx->task->pid); }' Attaching 1 probe... systemd:1 kthreadd:2 rcu_gp:3 rcu_par_gp:4 kworker/0:0H:6 mm_percpu_wq:8 ...
# bpftrace -e 'iter:task_file { printf("%s:%d %d:%s\n", ctx->task->comm, ctx->task->pid, ctx->fd, path(ctx->file->f_path)); }' Attaching 1 probe... systemd:1 1:/dev/null systemd:1 2:/dev/null systemd:1 3:/dev/kmsg ... su:1622 1:/dev/pts/1 su:1622 2:/dev/pts/1 su:1622 3:/var/lib/sss/mc/passwd ... bpftrace:1892 1:pipe:[35124] bpftrace:1892 2:/dev/pts/1 bpftrace:1892 3:anon_inode:bpf-map bpftrace:1892 4:anon_inode:bpf-map bpftrace:1892 5:anon_inode:bpf_link bpftrace:1892 6:anon_inode:bpf-prog bpftrace:1892 7:anon_inode:bpf_iter
It’s possible to pin iterator with specifying optional probe ':pin' part, that defines the pin file. It can be specified as absolute path or relative to /sys/fs/bpf.
relative pin
# bpftrace -e 'iter:task:list { printf("%s:%d\n", ctx->task->comm, ctx->task->pid); }' Program pinned to /sys/fs/bpf/list
# cat /sys/fs/bpf/list systemd:1 kthreadd:2 rcu_gp:3 rcu_par_gp:4 kworker/0:0H:6 mm_percpu_wq:8 rcu_tasks_kthre:9 ...
Examples with absolute pin file:
absolute pin
# bpftrace -e ' iter:task_file:/sys/fs/bpf/files { printf("%s:%d %s\n", ctx->task->comm, ctx->task->pid, path(ctx->file->f_path)); }'
Program pinned to /sys/fs/bpf/files
# cat /sys/fs/bpf/files systemd:1 anon_inode:inotify systemd:1 anon_inode:[timerfd] ... systemd-journal:849 /dev/kmsg systemd-journal:849 anon_inode:[eventpoll] ... sssd:1146 /var/log/sssd/sssd.log sssd:1146 anon_inode:[eventpoll] ... NetworkManager:1155 anon_inode:[eventfd] NetworkManager:1155 /var/lib/sss/mc/passwd (deleted)
kfunc and kretfunc variants
•   kfunc:fn
•   kretfunc:fn
•   f (kfunc)
•   fr (kretfunc)
requires (--info)
•   Kernel features:BTF
•   Probe types:kfunc
kfuncs attach to kernel function similar to kprobe and kretprobe. They make use of eBPF trampolines which allows kernel code to call into BPF programs with near zero overhead.
kfunc s make use of BTF type information to derive the type of function arguments at compile time. This removes the need for manual type casting and makes the code more resilient against small signature changes in the kernel. The function arguments are available in the args struct which can be inspected by doing verbose listing (see LISTING PROBES). These arguments are also available in the return probe (kretfunc).
# bpftrace -lv 'kfunc:tcp_reset' kfunc:tcp_reset struct sock * sk struct sk_buff * skb
kfunc:x86_pmu_stop { printf("pmu %s stop\n", str(args->event->pmu->name)); }
kretfunc:fget { printf("fd %d name %s\n", args->fd, str(retval->f_path.dentry->d_name.name)); }
fd 3 name ld.so.cache fd 3 name libselinux.so.1 fd 3 name libselinux.so.1 ...
kprobe and kretprobe variants
•   kprobe:fn
•   kprobe:fn+offset
•   kretprobe:fn
•   k
•   kr
kprobe s allow for dynamic instrumentation of kernel functions. Each time the specified kernel function is executed the attached BPF programs are ran.
kprobe:tcp_reset { @tcp_resets = count() }
Function arguments are available through the argX and sargX builtins, for register args and stack args respectively. Whether arguments passed on stack or in a register depends on the architecture and the number or arguments in used, e.g. on x86_64 the first non-floating point 6 arguments are passed in registers, all following arguments are passed on the stack. Note that floating point arguments are typically passed in special registers which don’t count as argX arguments which can cause confusion. Consider a function with the following signature:
void func(int a, double d, int x)
Due to d being a floating point x is accessed through arg1 where one might expect arg2.
bpftrace does not detect the function signature so it is not aware of the argument count or their type. It is up to the user to perform Type conversion when needed, e.g.
kprobe:tcp_connect { $sk = ((struct sock *) arg0); ... }
kprobe s are not limited to function entry, they can be attached to any instruction in a function by specifying an offset from the start of the function.
kretprobe s trigger on the return from a kernel function. Return probes do not have access to the function (input) arguments, only to the return value (through retval). A common pattern to work around this is by storing the arguments in a map on function entry and retrieving in the return probe:
kprobe:d_lookup { $name = (struct qstr *)arg1; @fname[tid] = $name->name; }
kretprobe:d_lookup /@fname[tid]/ { printf("%-8d %-6d %-16s M %s\n", elapsed / 1e6, pid, comm, str(@fname[tid])); }
profile variants
•   profile:us:count
•   profile:ms:count
•   profile:s:count
•   profile:hz:rate
•   p
Profile probes fire on each CPU on the specified interval.
software variants
•   software:event:
•   software:event:count
•   s
The software probe attaches to pre-defined software events provided by the kernel. Event details can be found in the perf_event_open(2) man page.
The event names are:
•   cpu-clock or cpu
•   task-clock
•   page-faults or faults
•   context-switches or cs
•   cpu-migrations
•   minor-faults
•   major-faults
•   alignment-faults
•   emulation-faults
•   dummy
•   bpf-output
tracepoint variants
•   tracepoint:subsys:event
•   t
Tracepoints are hooks into events in the kernel. Tracepoints are defined in the kernel source and compiled into the kernel binary which makes them a form of static tracing. Which means that unlike kprobe s new tracepoints cannot be added without modifying the kernel.
The advantage of tracepoints is that they generally provide a more stable interface than kprobe s do, they do not depend on the existence of a kernel function.
Tracepoint arguments are available in the args struct which can be inspected with verbose listing, see the LISTING PROBES section for more details.
tracepoint:syscalls:sys_enter_openat { printf("%s %s\n", comm, str(args->filename)); }
irqbalance /proc/interrupts irqbalance /proc/stat snmpd /proc/diskstats snmpd /proc/stat snmpd /proc/vmstat snmpd /proc/net/dev [...]
•   https://www.kernel.org/doc/html/latest/trace/tracepoints.html
uprobe, uretprobe variants
•   uprobe:binary:func
•   uprobe:binary:func+offset
•   uretprobe:binary:func
•   u
•   ur
uprobe s or user-space probes are the user-space equivalent of kprobe s. The same limitations that apply kprobe and kretprobe also apply to uprobe s and uretprobe s.
When tracing libraries, it is sufficient to specify the library name instead of a full path. The path will be then automatically resolved using /etc/ld.so.cache:
# bpftrace -e 'uprobe:libc:malloc { printf("Allocated %d bytes\n", arg0); }' Allocated 4 bytes ...
If the traced binary has DWARF included, function arguments are available in the args struct which can be inspected with verbose listing, see the LISTING PROBES section for more details.
It is important to note that for uretprobe s to work the kernel runs a special helper on user-space function entry which overrides the return address on the stack. This can cause issues with languages that have their own runtime like Golang:
func myprint(s string) { fmt.Printf("Input: %s\n", s) }
func main() { ss := []string{"a", "b", "c"} for _, s := range ss { go myprint(s) } time.Sleep(1*time.Second) }
bpftrace
# bpftrace -e 'uretprobe:./test:main.myprint { @=count(); }' -c ./test runtime: unexpected return pc for main.myprint called from 0x7fffffffe000 stack: frame={sp:0xc00008cf60, fp:0xc00008cfd0} stack=[0xc00008c000,0xc00008d000) fatal error: unknown caller pc
usdt variants
•   usdt:binary:name
•   U
watchpoint and asyncwatchpoint variants
•   watchpoint:absolute_address:length:mode
•   watchpoint:function+argN:length:mode
•   w
•   aw
These are memory watchpoints provided by the kernel. Whenever a memory address is written to (w), read from (r), or executed (x), the kernel can generate an event.
In the first form, an absolute address is monitored. If a pid (-p) or a command (-c) is provided, bpftrace takes the address as a userspace address and monitors the appropriate process. If not, bpftrace takes the address as a kernel space address.
In the second form, the address present in argN when function is entered is monitored. A pid or command must be provided for this form. If synchronous (watchpoint), a SIGSTOP is sent to the tracee upon function entry. The tracee will be SIGCONTed after the watchpoint is attached. This is to ensure events are not missed. If you want to avoid the SIGSTOP + SIGCONT use asyncwatchpoint.
Note that on most architectures you may not monitor for execution while monitoring read or write.
Print hit when a read from or write to 0x10000000 happens:
# bpftrace -e 'watchpoint:0x10000000:8:rw { printf("hit!\n"); exit(); }' -c ./testprogs/watchpoint
Print the call stack every time the jiffies variable is updated:
# bpftrace -e "watchpoint:0x$(awk '$3 == "jiffies" {print $1}' /proc/kallsyms):8:w { @[kstack] = count(); }
i:s:1 { exit(); }" ...... @[ do_timer+12 tick_do_update_jiffies64.part.22+89 tick_sched_do_timer+103 tick_sched_timer+39 __hrtimer_run_queues+256 hrtimer_interrupt+256 smp_apic_timer_interrupt+106 apic_timer_interrupt+15 cpuidle_enter_state+188 cpuidle_enter+41 do_idle+536 cpu_startup_entry+25 start_secondary+355 secondary_startup_64+164 ]: 319
"hit" and exit when the memory pointed to by arg1 of increment is written to.
# cat wpfunc.c #include <stdio.h> #include <stdlib.h> #include <unistd.h>
__attribute__((noinline)) void increment(__attribute__((unused)) int _, int *i) { (*i)++; }
int main() { int *i = malloc(sizeof(int)); while (1) { increment(0, i); (*i)++; usleep(1000); } }
# bpftrace -e 'watchpoint:increment+arg1:4:w { printf("hit!\n"); exit() }' -c ./wpfunc
Probe listing is the method to discover which probes are supported by the current system. Listing supports the same syntax as normal attachment does:
# bpftrace -l 'kprobe:*' # bpftrace -l 't:syscalls:*openat* # bpftrace -l 'kprobe:tcp*,trace # bpftrace -l 'k:*socket*,tracepoint:syscalls:*tcp*'
The verbose flag (-v) can be specified to inspect arguments (args) for providers that support it:
# bpftrace -l 'fr:tcp_reset,t:syscalls:sys_enter_openat' -v kretfunc:tcp_reset struct sock * sk struct sk_buff * skb tracepoint:syscalls:sys_enter_openat int __syscall_nr int dfd const char * filename int flags umode_t mode # bpftrace -l 'uprobe:/bin/bash:rl_set_prompt' -v    # works only if /bin/bash has DWARF uprobe:/bin/bash:rl_set_prompt const char *prompt
GIT-ARCHIVE-FILE(1)                Git Extras                GIT-ARCHIVE-FILE(1)
git-archive-file - Export the current HEAD of the git repository to an archive
Export the current HEAD of the repository into an archive with an identifiable and unique name.
This command does not take any options.
Archive naming conventions:
On any branch: git-extras.1.7.0-110-gafefba7.branch-name.zip
On master branch: git-extras.1.7.0-110-gafefba7.zip
On a detached HEAD (e.g. a tag): git-extras.1.7.0.zip
Written by Philipp Klose <me@thehippo.de>
nix-build(1)                 General Commands Manual                nix-build(1)
Name nix-build - build a Nix expression
Synopsis nix-build [paths…] [--arg name value] [--argstr name value] [{--attr | -A} attrPath] [--no-out-link] [--dry-run] [{--out-link | -o} outlink]
Description The nix-build command builds the derivations described by the Nix expressions in paths. If the build succeeds, it places a symlink to the result in the current directory. The symlink is called result. If there are multiple Nix expressions, or the Nix expressions evaluate to multiple derivations, multiple sequentially numbered symlinks are created (result, result-2, and so on).
If no paths are specified, then nix-build will use default.nix in the current directory, if it exists.
If an element of paths starts with http:// or https://, it is interpreted as the URL of a tarball that will be downloaded and unpacked to a temporary location. The tarball must include a single top-level directory containing at least a file named default.nix.
nix-build is essentially a wrapper around nix-instantiate (nix- instantiate.md) (to translate a high-level Nix expression to a low-level store derivation) and nix-store --realise (nix- store.md#operation---realise) (to build the store derivation).
The result of the build is automatically registered as a root of the Nix garbage collector. This root disappears automatically when the result symlink is deleted or renamed. So don’t rename the symlink.
Options All options not listed here are passed to nix-store --realise, except for --arg and --attr / -A which are passed to nix-instantiate.
• --no-out-link Do not create a symlink to the output path. Note that as a result the output does not become a root of the garbage collector, and so might be deleted by nix-store --gc.
• --dry-run Show what store paths would be built or downloaded.
• --out-link / -o outlink Change the name of the symlink to the output path created from result to outlink.
The following common options are supported:
Examples $ nix-build '<nixpkgs>' -A firefox store derivation is /nix/store/qybprl8sz2lc...-firefox-1.5.0.7.drv /nix/store/d18hyl92g30l...-firefox-1.5.0.7
$ ls -l result lrwxrwxrwx  ...  result -> /nix/store/d18hyl92g30l...-firefox-1.5.0.7
$ ls ./result/bin/ firefox  firefox-config
If a derivation has multiple outputs, nix-build will build the default (first) output. You can also build all outputs:
$ nix-build '<nixpkgs>' -A openssl.all
This will create a symlink for each output named result-outputname.  The suffix is omitted if the output name is out. So if openssl has outputs out, bin and man, nix-build will create symlinks result, result-bin and result-man. It’s also possible to build a specific output:
$ nix-build '<nixpkgs>' -A openssl.man
This will create a symlink result-man.
Build a Nix expression given on the command line:
$ nix-build -E 'with import <nixpkgs> { }; runCommand "foo" { } "echo bar > $out"' $ cat ./result bar
Build the GNU Hello package from the latest revision of the master branch of Nixpkgs:
$ nix-build https://github.com/NixOS/nixpkgs/archive/master.tar.gz -A hello
WOL(1)                                 wol                                WOL(1)
wol - Wake On LAN client
wol [OPTION] ... MAC-ADDRESS ...
This manual gives you an introduction into "wol", the Wake On LAN client. It remotely turns on computers that supports Magic Packet technology (also known as Wake On LAN).
Some workstations support SecureON password feature. These machines only wake up if you provide the correct password. "wol" also provides this feature.
--help Print a summary of the command line options.
-V --version Print the version number of "wol".
-h HOST --host=HOST -i HOST --ipaddr=HOST Broadcast packet to this IP address or hostname. This is important if your wol client is a multihomed host and you want to send only to one subnet (default IP address is 255.255.255.255).
-p NUM --port=NUM Send packet with this destination port NUM. This option is important if your packet filter would block the default destination port 40000.
-f FILE --file=FILE Read hardware addresses, IP addresses/hostnames, optional ports and SecureON password from file FILE. If FILE is - "wol" reads from stdin.
-   Read hardware addresses, IP addresses, optional ports and optional SecureON password from stdin. So you can extract MAC-ADDRESSES from any source and pipe the data into "wol" so.
-v --verbose Turns on verbose output.
-w NUM --wait=NUM Waits NUM milliseconds between Magic Packets. Also known as fuse health pack.
--passwd[=PASS] Send a magic packet with SecureON password feature. PASS is written as x-x-x-x-x-x, where x is a hexadecimal number between 0 and ff which represents one byte of the password.
If you don't provide PASS "wol" prompts you for a password.
To set the password of your SecureON capable NIC, you can use "ethtool" (<http://www.sourceforge.net/projects/gkernel/>).
Please report bugs to <krennwallner@aon.at>. Feel free to send bug reports, translations, improvement suggestions and patches to this email address.
GNU info entry for wol.
Written by Thomas Krennwallner <krennwallner@aon.at>.
Copyright (C) 2001,2002,2003,2004 Thomas Krennwallner <krennwallner@aon.at>
This document may be distributed and modified under the terms of the GNU General Public License.
This manual is free software; you may redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation; either version 2, or (at your option) any later version.
This manual is distributed in the hope that it will be useful, but without any warranty; without even the implied warranty of merchantability or fitness for a particular purpose. See the GNU General Public License for more details.
A copy of the GNU General Public License is available on the World Wide Web at the GNU website. You can also obtain it by writing to the Free Software Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
atom(1)                      General Commands Manual                     atom(1)
atom - ASCII-to-markup filter
atom -t - B{1to5}- [<number>eipQTsht] file...
atom automatically translates typewriter quotes into those which are displayed as properly typeset quotation marks for HTML.
Additionally, this filter also turns italics-delimited words or phrases into italics when displayed by LaTeX or HTML.  The default delimiter to indicate that italics be displayed is the asterisk.  This is configurable by simply editing the #define in atom.h.  And, for LaTeX only, atom correctly sets the markup to correctly display ellipses.  The LaTeX markup is being discounted; it will likely eventually vanish.
The following options apply:
-B   Followed by the digit 1,2,3,4, or 5  inserts that many <BLOCKQUOTE></BLOCKQUOTE> tags.  As a default there are 4 <BLOCKQUOTE> tags.
-c   Perform simplistic centering processing.
-e   Do not do ellipses processing. (Affects LaTeX only.)
-<number>   <number> indicates the number of space-indentations that indicates a paragraph.  (This is explained further below.)  This option is also going away; eventually only an empty line or a TAB will indicate an ASCII paragraph, or a standard ASCII 5-spaces will indicate a paragraph.
-I   Process italics marks only. The resulting output file is postpended with IO.
-i   Do not handle italics processing.
-p   Handles physical-spacing by inserting five ``<BR>'' tags in HTML and the markup ``\vspace*{.5in}'' for TeX and LaTeX.  The option requires that you have exactly five blank lines in your manuscript.
-Q   Process double-quotation marks only. The resulting output file is postpended with QO.  With this flag "Such a line." would be translated simply to &ldquo;Such a line.&rdquo
Note that to efficiently process double-quotes, you may want to use tr to join all lines in any paragraph.  [ Still at work on this!]
This flag does not need the additional -t flag.
-t   Process some very slight TeX/LaTeX output (DEPRECATED)  (The -h flag is gone, turned into a "help" output function. HTML is the default.)
TeX is no longer the default for atom.  The program handles italics and ellipses under TeX or LaTeX, and processes any italics-delimited word or words into HTML emphasis tags if this flag is specified.
Paragraphs are most easily recognized by lines of text separated by at least one newline.  Additionally, a line in which the first character is a tab ('\010') indicates a paragraph.  Lastly, and these are the least preferred means of paragraph recognition, lines in which at least the first character is a space--or the first several character are spaces--followed by tab indicates a paragraph; or lines which begin with 5 or 8 spaces ('\040') are recognized as paragraphs.
If you have used an ``unusual'' number of spaces to indicate paragraphs in your manuscript--say, two, three, six, or seven spaces, you must indicate this to atom with the -<number> flag.  If you have paragraphed with seven spaces and want an HTML outfile, you must type ``atom -7h <yourfile>'' on the command line.   For reasons that should be fairly obvious, if you have ``atom -7h <yourfile>'' then 5- or 8-space-indented paragraphs won't be seen as paragraphs.
If your manuscript has any mix of tabs, 8-spaces, and 5-spaces to indicate paragraphs you do not need to use the ``-<number>'' option.
If you are about to prepare an ASCII file, best to stick with TABS or spaces to indicate paragraphs.
For example, the following
% atom -te speech01
will correctly format speech01 into LaTeX, and produce the output file speech01.tex.  Quotation marks and italicization will be handled in the LaTeX-markup output file; ellipses will not be processed.
The following:
% atom -hi ShortStory
will produce the output ShortStory.html in which double quotation marks will be processed but any italics-delimited words will be left alone.
% atom -h2 testFile
where exactly <2> or <number> spaces indicate paragraphs within the file test, will produce a properly formatted HTML output file.
This is a case where there is a new paragraph that is indicated by a 2-space indentation. This happens occasionally. And this is yet another instance of the above. For atom to turn these two paragraphs into HTML or TeX formatted paragraphs, use the command: ``atom -h2 <file>'' or ``atom -t2 <file>.''
will produce the following:
<P> This is a case where there is a new paragraph that is indicated by a 2-space indentation. This happens occasionally. <P> And this is yet another instance of the above. For atom to turn these two paragraphs into HTML or TeX formatted paragraphs, use the command: ``atom -h2 <file>'' or ``atom -t2 <file>.''
Note that without the ``-2'' flag in this case, the HTML or TeX output would run these two paragraphs together.
The commands % atom -Q lglass18.txt       # translate quotations marks to `` and '' will produce ``lglass18.txt.QO.html.''
% atom -t story01 story02 story12
will produce story01.tex, story02.tex, story12.tex with any quotation marks, italicization, and ellipses marked up in LaTeX style.
atom will do centering if and only if your original ASCII file has the strings judiciously centered by using spaces-only to the left of the centered string.  If you use this -c option, any paragraphs that are denoted by 5 or 8 spaces will not be seen as paragraphs and not processed as such.  If you do have space-centered lines that you wish to be centered in HTML or LaTeX  and you also have paragraphs denoted by 5 or 8 spaces, you will have to edit your ASCII source and replace the spaces to tabs.  Then run atom to handle the centering.
Note that in this simple filter, centered text is best if only one or two lines.  atom will not handle multiple lines of centering efficiency.
The latest version of atom automatically puts only a single paragraph tag, ``<P>'' between what are understood as paragraph, namely, a single vertical line space {or newline}.  Previously, if the source file had thee newlines, there would be three paragraph tags, each on it's own newline.  In short, the -s switch is history.
Any series of three dots  (...)  is, for LaTeX, considered to be an ellipse.
This program could be expanded to handle boldface markup, but this would require having another delimiter, and we are creating yet another markup language.
I admittedly am tempted to have this filter handle a maximum of two types of markup:  the standard _underscore_ for italics or <EM>, and the *asterisk* for bold or <STRONG>.  ...But not that tempted!
Finally, it is worth noting that if your plain ASCII file has a lengthy italicized string--something that exceeds 80 columns, for example--the best solution is to simply join the lines of your italicized string.
Copyright (C), 1994, 1995, 1996, 1997, 2001, 2005, 2006, 2007, 2008, 2009 by Gary Kline
This software is placed under distribution restrictions and rights according to the GNU General Public License.  See the file ``COPYING'' included, or write to the Free Software Foundation, Inc., 675 Mass Avenue, Cambridge, MA 02139, USA
tex(1)
Gary Kline      kline@thought.org
GETENT(1)                         User Commands                        GETENT(1)
getent - get entries from Name Service Switch libraries
getent [option]... database key...
The getent command displays entries from databases supported by the Name Service Switch libraries, which are configured in /etc/nsswitch.conf.  If one or more key arguments are provided, then only the entries that match the supplied keys will be displayed.  Otherwise, if no key is provided, all entries will be displayed (unless the database does not support enumeration).
The database may be any of those supported by the GNU C Library, listed below:
ahosts    When no key is provided, use sethostent(3), gethostent(3), and endhostent(3) to enumerate the hosts database.  This is identical to using hosts.  When one or more key arguments are provided, pass each key in succession to getaddrinfo(3) with the address family AF_UNSPEC, enumerating each socket address structure returned.
ahostsv4  Same as ahosts, but use the address family AF_INET.
ahostsv6  Same as ahosts, but use the address family AF_INET6.  The call to getaddrinfo(3) in this case includes the AI_V4MAPPED flag.
aliases   When no key is provided, use setaliasent(3), getaliasent(3), and endaliasent(3) to enumerate the aliases database.  When one or more key arguments are provided, pass each key in succession to getaliasbyname(3) and display the result.
ethers    When one or more key arguments are provided, pass each key in succession to ether_aton(3) and ether_hostton(3) until a result is obtained, and display the result.  Enumeration is not supported on ethers, so a key must be provided.
group     When no key is provided, use setgrent(3), getgrent(3), and endgrent(3) to enumerate the group database.  When one or more key arguments are provided, pass each numeric key to getgrgid(3) and each nonnumeric key to getgrnam(3) and display the result.
gshadow   When no key is provided, use setsgent(3), getsgent(3), and endsgent(3) to enumerate the gshadow database.  When one or more key arguments are provided, pass each key in succession to getsgnam(3) and display the result.
hosts     When no key is provided, use sethostent(3), gethostent(3), and endhostent(3) to enumerate the hosts database.  When one or more key arguments are provided, pass each key to gethostbyaddr(3) or gethostbyname2(3), depending on whether a call to inet_pton(3) indicates that the key is an IPv6 or IPv4 address or not, and display the result.
initgroups When one or more key arguments are provided, pass each key in succession to getgrouplist(3) and display the result. Enumeration is not supported on initgroups, so a key must be provided.
netgroup  When one key is provided, pass the key to setnetgrent(3) and, using getnetgrent(3) display the resulting string triple (hostname, username, domainname).  Alternatively, three keys may be provided, which are interpreted as the hostname, username, and domainname to match to a netgroup name via innetgr(3).  Enumeration is not supported on netgroup, so either one or three keys must be provided.
networks  When no key is provided, use setnetent(3), getnetent(3), and endnetent(3) to enumerate the networks database.  When one or more key arguments are provided, pass each numeric key to getnetbyaddr(3) and each nonnumeric key to getnetbyname(3) and display the result.
passwd    When no key is provided, use setpwent(3), getpwent(3), and endpwent(3) to enumerate the passwd database.  When one or more key arguments are provided, pass each numeric key to getpwuid(3) and each nonnumeric key to getpwnam(3) and display the result.
protocols When no key is provided, use setprotoent(3), getprotoent(3), and endprotoent(3) to enumerate the protocols database. When one or more key arguments are provided, pass each numeric key to getprotobynumber(3) and each nonnumeric key to getprotobyname(3) and display the result.
rpc       When no key is provided, use setrpcent(3), getrpcent(3), and endrpcent(3) to enumerate the rpc database.  When one or more key arguments are provided, pass each numeric key to getrpcbynumber(3) and each nonnumeric key to getrpcbyname(3) and display the result.
services  When no key is provided, use setservent(3), getservent(3), and endservent(3) to enumerate the services database.  When one or more key arguments are provided, pass each numeric key to getservbynumber(3) and each nonnumeric key to getservbyname(3) and display the result.
shadow    When no key is provided, use setspent(3), getspent(3), and endspent(3) to enumerate the shadow database.  When one or more key arguments are provided, pass each key in succession to getspnam(3) and display the result.
-s service, --service service Override all databases with the specified service.  (Since glibc 2.2.5.)
-s database:service, --service database:service Override only specified databases with the specified service.  The option may be used multiple times, but only the last service for each database will be used.  (Since glibc 2.4.)
-i, --no-idn Disables IDN encoding in lookups for ahosts/getaddrinfo(3) (Since glibc-2.13.)
-?, --help Print a usage summary and exit.
--usage Print a short usage summary and exit.
-V, --version Print the version number, license, and disclaimer of warranty for getent.
One of the following exit values can be returned by getent:
0      Command completed successfully.
1      Missing arguments, or database unknown.
2      One or more supplied key could not be found in the database.
3      Enumeration not supported on this database.
nsswitch.conf(5)
IP-ROUTE(8)                           Linux                          IP-ROUTE(8)
ip-route - routing table management
ip [ ip-OPTIONS ] route  { COMMAND | help }
ip route { show | flush } SELECTOR
ip route save SELECTOR
ip route restore
ip route get ROUTE_GET_FLAGS ADDRESS [ from ADDRESS iif STRING  ] [ oif STRING ] [ mark MARK ] [ tos TOS ] [ vrf NAME ] [ ipproto PROTOCOL ] [ sport NUMBER ] [ dport NUMBER ]
ip route { add | del | change | append | replace } ROUTE
SELECTOR := [ root PREFIX ] [ match PREFIX ] [ exact PREFIX ] [ table TABLE_ID ] [ vrf NAME ] [ proto RTPROTO ] [ type TYPE ] [ scope SCOPE ]
ROUTE := NODE_SPEC [ INFO_SPEC ]
NODE_SPEC := [ TYPE ] PREFIX [ tos TOS ] [ table TABLE_ID ] [ proto RTPROTO ] [ scope SCOPE ] [ metric METRIC ] [ ttl-propagate { enabled | disabled } ]
INFO_SPEC := { NH | nhid ID } OPTIONS FLAGS [ nexthop NH ] ...
NH := [ encap ENCAP ] [ via [ FAMILY ] ADDRESS ] [ dev STRING ] [ weight NUMBER ] NHFLAGS
FAMILY := [ inet | inet6 | mpls | bridge | link ]
OPTIONS := FLAGS [ mtu NUMBER ] [ advmss NUMBER ] [ as [ to ] ADDRESS ] rtt TIME ] [ rttvar TIME ] [ reordering NUMBER ] [ window NUMBER ] [ cwnd NUMBER ] [ ssthresh NUMBER ] [ realms REALM ] [ rto_min TIME ] [ initcwnd NUMBER ] [ initrwnd NUMBER ] [ features FEATURES ] [ quickack BOOL ] [ congctl NAME ] [ pref PREF ] [ expires TIME ] [ fastopen_no_cookie BOOL ]
TYPE := [ unicast | local | broadcast | multicast | throw | unreachable | prohibit | blackhole | nat ]
TABLE_ID := [ local| main | default | all | NUMBER ]
SCOPE := [ host | link | global | NUMBER ]
NHFLAGS := [ onlink | pervasive ]
RTPROTO := [ kernel | boot | static | NUMBER ]
FEATURES := [ ecn | ]
PREF := [ low | medium | high ]
ENCAP := [ ENCAP_MPLS | ENCAP_IP | ENCAP_BPF | ENCAP_SEG6 | ENCAP_SEG6LOCAL | ENCAP_IOAM6 ]
ENCAP_MPLS := mpls [ LABEL ] [ ttl TTL ]
ENCAP_IP := ip id TUNNEL_ID dst REMOTE_IP [ src SRC ] [ tos TOS ] [ ttl TTL ]
ENCAP_BPF := bpf [ in PROG ] [ out PROG ] [ xmit PROG ] [ headroom SIZE ]
ENCAP_SEG6 := seg6 mode [ encap | inline | l2encap ] segs SEGMENTS [ hmac KEYID ]
ENCAP_SEG6LOCAL := seg6local action SEG6_ACTION [ SEG6_ACTION_PARAM ] [ count ]
ENCAP_IOAM6 := ioam6 trace prealloc type IOAM6_TRACE_TYPE ns IOAM6_NAMESPACE size IOAM6_TRACE_SIZE
ROUTE_GET_FLAGS :=  [ fibmatch  ]
ip route is used to manipulate entries in the kernel routing tables.
Route types:
unicast - the route entry describes real paths to the destinations covered by the route prefix.
unreachable - these destinations are unreachable. Packets are discarded and the ICMP message host unreachable is generated. The local senders get an EHOSTUNREACH error.
blackhole - these destinations are unreachable. Packets are discarded silently.  The local senders get an EINVAL error.
prohibit - these destinations are unreachable. Packets are discarded and the ICMP message communication administratively prohibited is generated. The local senders get an EACCES error.
local - the destinations are assigned to this host. The packets are looped back and delivered locally.
broadcast - the destinations are broadcast addresses. The packets are sent as link broadcasts.
throw - a special control route used together with policy rules. If such a route is selected, lookup in this table is terminated pretending that no route was found. Without policy routing it is equivalent to the absence of the route in the routing table. The packets are dropped and the ICMP message net unreachable is generated. The local senders get an ENETUNREACH error.
nat - a special NAT route. Destinations covered by the prefix are considered to be dummy (or external) addresses which require translation to real (or internal) ones before forwarding. The addresses to translate to are selected with the attribute via. Warning: Route NAT is no longer supported in Linux 2.6.
anycast - not implemented the destinations are anycast addresses assigned to this host. They are mainly equivalent to local with one difference: such addresses are invalid when used as the source address of any packet.
multicast - a special type used for multicast routing. It is not present in normal routing tables.
Route tables: Linux-2.x can pack routes into several routing tables identified by a number in the range from 1 to 2^32-1 or by name from the file /etc/iproute2/rt_tables By default all normal routes are inserted into the main table (ID 254) and the kernel only uses this table when calculating routes.  Values (0, 253, 254, and 255) are reserved for built-in use.
Actually, one other table always exists, which is invisible but even more important. It is the local table (ID 255). This table consists of routes for local and broadcast addresses. The kernel maintains this table automatically and the administrator usually need not modify it or even look at it.
The multiple routing tables enter the game when policy routing is used.
ip route add add new route
ip route change change route
ip route replace change or add new one
to TYPE PREFIX (default) the destination prefix of the route. If TYPE is omitted, ip assumes type unicast.  Other values of TYPE are listed above.  PREFIX is an IP or IPv6 address optionally followed by a slash and the prefix length. If the length of the prefix is missing, ip assumes a full-length host route. There is also a special PREFIX default - which is equivalent to IP 0/0 or to IPv6 ::/0.