Note: for a more formal introduction please read Bashing irreproducibility with shournal on bioRxiv.
TL;DR:
- Integrated tool to increase the reproducibility of your work on the shell: what did you do when and where and what files were modified/read.
- Stand-alone tool to monitor file events of a command/process (tree),
similar to
strace -f -e close $cmdbut without the limitations imposed by ptrace-based solutions and a lot faster.
More details please:
Using your shell's history is nice. But sometimes you want more:
- What files were modified or read by a command? Or reverse: What shell-command(s) were used to create/modify or read from a certain file?
- You executed a script. What was the script-content by the time it was called?
- What other commands were executed during the same shell-session?
- What about working directory, command start- and end-time or the exit status ($?) ?
shournal provides the answer to these questions while
causing only a negligible overhead.
Besides its ability to monitor a whole process tree for file
events it can be integrated really tight into the shell -
you won't even notice it (;
See also: shell-integration
Besides output on the command-line in a human-readable format (or JSON) you can export (parts of) your command-history into a standalone html-file where it is displayed in an interactive time-line-plot. Further miscellaneous statistics are displayed in bar-plots, e.g. the commands with most file-modifications (see also above gif).
Using the external software shournal-to-snakemake an observed shell-command-series can be directly transformed into rules for the Snakemake workflow engine, a tool to create reproducible and scalable data analyses.
shournal runs only on GNU/Linux.
Please note: below examples make use of the
shell-integration.
Otherwise shournal --exec $cmd and
other boilerplate-code would have been necessary.
Instead of printing the --query-results to terminal, you can also create
fancy html-plots, by appending --output-format html -o out.html.
Use an ordinary web-browser for display.
- Create a file and ask shournal, how it came to be:
$ SHOURNAL_ENABLE # monitor all commands using the shell-integration $ echo hi > foo $ shournal --query --wfile foo Command id 1 returned 0 - 14.05.19 10:19 : echo hi > foo Written file(s): /home/user/foo (3 bytes) Hash: 15349503233279147316 - shournal can be configured, to store specific read files, like shell-scripts,
within it's database. An unmodified file occupies space only once.
$ ./test.sh $ shournal -q --history 1 Command id 2 returned 0 - 14.05.19 14:01 : ./test.sh Read file(s): /home/user/test.sh (213 bytes) id 1 #!/usr/bin/env bash echo 'Hello world' - What commands were executed at the current working directory?
shournal --query --command-working-dir "$PWD" - What commands were executed within a specific shell-session? The
uuid can be taken from the command output of a previous query.
shournal --query --shell-session-id $uuid - For the full list of query-options, please enter
shournal --query --help
For Debian/Ubuntu-based distributions .deb-packages are available on the
release-page.
Three different editions are provided for different use-cases: most users will
want to install shournal on a real host (or virtual machine) and
shournal-docker inside Docker
(or another container platform).
shournal-fanotify does not contain the kernel backend and
is targeted at institutions where the usage of out-of-tree kernel-modules
is discouraged.
Only LTS-releases are officially supported, the packages are known to work on
Debian 9 (Stretch), Debian 10 (Buster), Ubuntu 18.04 (Bionic) and Ubuntu 20.04 (Focal).
Install deb-packages as usual, e.g.
sudo apt install ./shournal_2.2_amd64.deb
An update of shournal should be performed after all users have
logged out, because the shell integrations need to be resourced.
Further in case of the kernel module backend unloading the old
version stops all running observations.
After installation: Depending on your distribution, additional steps might be necessary to enable the (recommended) uuidd-daemon. If systemd is in use, one may need to:
systemctl enable uuidd
systemctl start uuidd
Add yourself or other users to the group shournalk:
sudo adduser $USER shournalk (relogin to take affect).
You may override this group:
mkdir -p /etc/shournal.d/
echo GROUPNAME > /etc/shournal.d/kgroup
replacing GROUPNAME with the value of your choice. This rule takes
into effect the next time shournal's kernel module is loaded ( so
call e.g. modprobe -r shournalk; modprobe shournalk or reboot).
To enable the shell-integration:
- for bash: put the following to the end of your ~/.bashrc
source /usr/share/shournal/SOURCE_ME.bash
and runSHOURNAL_ENABLEafterwards. - for other shells: please open an issue, if you want your favorite shell to be integrated as well (contributions welcome, zsh-support is planned).
Please refer to the instructions found within the compile-README.
- Does shournal track file rename/move operations?
No, but most often it should not be a problem. Using the--wfilecommandline-query-option, shournal finds the stored command by content (size, hash) and mtime, not by its name. For the name,--wnamecan be used. More concrete:Querying for bar_old by content (shournal --exec sh -c 'echo foo > bar; mv bar bar_old'--wfile-option) yields exactly the given command, however,--wname bar_olddoes not work (--wname barof course works). To use the bar_old file name (and not content) as basis for a successful query, in this case--command-text -like '%bar_old%'can be used. - What happens to an appended file? < 8000 br> How to get a "modification history"? Please read above rename/move-text first. Appending to a file is currently handled as if a new one was created - only the last command, which modified a given file can be found with good certainty (by file content). However, querying by path/filename works. If the file was appended and renamed, things get more complicated.
- To track files, they can be hashed. Is that slow for big files?
No, because per default only certain small parts of the file are hashed. - What does the following message mean and how to get rid of it?:
fanotify_mark: failed to add path /foobar ... Permission denied. This message might be printed on executing a command with shournal. Most probably the administrator mounted a filesystem object for which you don't have permissions, thus you cannot monitor file events. In this case you cannot perform file operations at this path anyway, so it should be safe to silence this warning by adding the path within the config-file in section[mounts]. If you want to ignore all fanotify_mark permission errors, you can set the flag in section[mounts]:[mounts] ignore_no_permission = true
shournal stores a self-documenting config-file typically at
~/.config/shournal
which is created on first run. It can be edited either directly with
a plain text editor or via --edit-cfg.
For completeness, the most important points are listed here as well.
-
Write- and read events can be configured, so only events occurring at specific (include-)paths are stored. Put each path into a separate line, all paths being enclosed by triple quotes:
include_paths = ''' /home/me /media '''Each exclude_path should be a sub-path of an include path.
-
Note that by default, there is a limit on the number of logged events per command (max_event_count). Read files (e.g. scripts) can further be configured to be stored within shournal's database. Files are only stored, if the configured max. file-size, file extension (e.g. sh) and mimetype (e.g. application/x-shellscript) matches. To find a mimetype for a given file you should use
shournal --print-mime test.sh. The correspondence of mimetype and file extension is explained in more detail within the config-file. Further, at your wish, read files are only stored if you have write permission for them (not only read) - often system-provided scripts (owned by root) are not of particular interest.shournal will not store more read files per command, than max_count_of_files. Matching files coming first have precedence.
To use shournal within Docker (or another container platform),
depending on the backend the following steps are necessary:
kernel module backend
Install shournal on the host and shournal-docker inside the container.
For unprivileged containers sysfs is mounted readonly. In this case
create a bindmount from /sys/kernel/shournalk_root to
/tmp/shournalk-sysfs, e.g.
docker run ... -v /sys/kernel/shournalk_root:/tmp/shournalk-sysfs.
fanotify backend
Install shournal-docker (or shournal-fanotify) inside docker.
For unprivileged containers the capabilities SYS_ADMIN, SYS_PTRACE and
SYS_NICE are required, e.g.
docker run ... --cap-add SYS_ADMIN --cap-add SYS_PTRACE --cap-add SYS_NICE.
You may need to configure the backend.
shournal provides two backends, a custom kernel module and fanotify.
The kernel module is used by default, except the shournal-fanotify
edition is installed, where only the fanotify backend is
available. In general it is recommended to stick with the kernel module
as it is faster and has less interference with the process environment -
for example no new mount namespaces have to be created and no file
descriptor inheritance is necessary to wait for the end of a process
tree. See also:
shell-integration.
If both backends are installed you may configure the default one globally
by creating the file /etc/shournal.d/backend or for each user by creating
~/.config/shournal/backend with content ko or fanotify.
Depending on the file-activity of the observed commands, shournal's
database will sooner or later grow. When you feel that enough time
has passed and want to get rid of old events, this can be done by e.g.
shournal --delete --older-than 1y
which deletes all commands (and file-events) older than one year.
More options are available, see also
shournal --delete --help
- shournal is able to monitor file events of specific processes (PID's). Therefore, remote filesystems such as NFS or sshfs can be observed as long as shournal runs on the same (virtual) machine as the observed process. Consequently file events another kernel performs are lost.
- For sshfs in case of the fanotify backend it is necessary,
to add
-o allow_rootto the sshfs-options, otherwise permission errors duringfanotify_markare raised. See also: https://serverfault.com/a/188896
In the kernel module it is ensured that each user is only allowed to monitor his/her own processes. Further, the kernel thread, which processes file events, runs with effective caller credentials and checks allowed accesses on a per-file basis. Memory allocations are cgroup-aware, even for reading (in case of hashing) and writing (in case of logging) files.
shournal-run-fanotify is a so called "setuid"-program: whenever a regular user calls it, it runs with root-permissions in the first place. As soon as possible, it runs effectively with user permissions though. It must be setuid for two reaons:
- fanotify requires root for initializing, because it is in principle able, to forbid a process to access a file. shournal does not make use of this feature so this is not a real security concern.
- unsharing the mount namespace requires root, because setuid-programs could still refer to seemingly obsolete mounts. This means that under awkward circumstances an unmount-event, which has security-relevant consequences (e.g. mounting a new file to /etc/shadow) might not propagate to processes which run in other mount namespaces. To make sure mount-propagation applies, all mounts, which carry setuid-binaries or files they refer to, should be mounted shared, or no (security-relevant) mount/unmount events should occur, after the first shournal-process started. Shared mounts are the default in all recent distributions I know of. See also man 7 mount_namespaces and shared subtrees.
Processes can communicate via IPC (inter-process-communication). If the observed process A instructs the not observed process B via IPC to modify a file, the filesystem-event is not registered by shournal.
For performance reasons, all files opened with write-permissions are reported as written by shournal, irrespective of whether the process actually wrote to it. By using file size and content (hash) you should be able to cover those cases.
The provided timestamp is determined shortly after a file was closed. Note that it is possible that some other process has written to it in between. This however is only a problem, if that other process was itself not observed.
Whether memory mapped (see mmap(2) ) file-events are reported correctly depends on when the underlying file-descriptor is closed. It is thus application dependent and does not work in general.
The file observation only works, if the process does not unshare the mount-namespace itself, e.g. monitoring a program started via flatpak fails. For further limitations please visit the fanotify manpage.
- on NFS-storages: file events are lost, if the user does not have
read-permissions while a file is closed.
Steps to reproduce:
- open a file readable for you on a NFS storage
- chmod it 000
- close it --> the event is lost
shournal makes use of great tools and libraries, most importantly the Qt-framework, xxhash, tsl::ordered_map and cmake and also the Linux-Kernel's fanotify. For the html-plot d3js, jquery, popper.js, bootstrap, webpack and others are used.
Thanks to the developers!
The project arose in the Hoffmann Research Group: Computational Biology of Aging at the Fritz Lipmann Institute in Jena (Germany). Special thanks to Steve Hoffmann and Konstantin Riege - without you this project couldn't have been accomplished.
The whole project is licensed under the GPL, v3 or later
(see LICENSE file for details)
except
- The kernel module within
kernel/which is licensed under the GNU General Public License version 2 only. - The libraries within
extern/→ Please refer to the licenses within their respective directories. - The javascript-libraries in the auto-generated
html-export/dist/main.js→ the licenses are stored inhtml-export/dist/main.licenses.txt.
Copyleft (C) 2021, Tycho Kirchner