标签：

PTQL (进程表查询语言)

Hyperic SIGAR 提供一种定位进程的机制，叫做进程表查询语言。所有的操作系统都会给运行的进程分配一个PID,但是这个进程号是一个随机数字，当你每次启动某个程序的时候，这个进程号是随机可变的。所以我们不能用进程号来定位程序， PTQL 使用的是进程的属性值来定位程序，这些属性值是一致不变的。

PTQL 语法

PTQL 查询必须遵循的格式:

如果查询条件里面有空格，必须用双引号括起来. 比如:

Where:

• Class is the name of the Sigar class minus the Proc prefix.
• Attribute is an attribute of the given Class, index into an array or key in a Map class.
• operator is one of the following for String values:
  • eq - Equal to value
  • ne - Not Equal to value
  • ew - Ends with value
  • sw - Starts with value
  • ct - Contains value (substring)
  • re - Regular expression value matches
    operator is one of the following for numeric values:
  • eq - Equal to value
  • ne - Not Equal to value
  • gt - Greater than value
  • ge - Greater than or equal value
  • lt - Less than value
  • le - Less than or equal value

Multiple queries must delimited by a comma.

PTQL Attributes

The attributes used in PTQL are directly from the sigar.Proc* classes. This document will outline the attributes most commonly used for identifying processes, the complete set of Proc* classes and attributes can be found in the SIGAR javadocs.

• Pid.Pid - The process ID
• Pid.PidFile - File containing the process ID
• Pid.Service - Windows Service name used to pid from the service manager
• State.Name - Base name of the process executable
• CredName.User - User Name of the process owner
• CredName.Group - Group Name of the process owner
• Cred.Uid - User ID of the process owner
• Cred.Gid - Group ID of the process owner
• Cred.Euid - Effective User ID of the process owner
• Cred.Egid - Effective Group ID of the process owner
• Exe.Name - Full path name of the process executable
• Exe.Cwd - Current Working Directory of the process
• Args.* - Command line argument passed to the process
• Env.* - Environment variable within the process
• Modules.* - Shared library loaded within the process

PTQL Building

The process of building a process query will vary depending on the application and the need to identify a unique process or group of processes. For these examples, we will use the sigar shell. The sigar shell is started using the following command:

The sigar.jar file is located in the agent/pdk/lib directory within HQ and sigar-bin/lib within the standalone SIGAR distribution. When the shell is started, you‘ll be given a prompt:

The help command will show the complete list of top-level commands. We will focus on the handful that are useful for building PTQL queries:

• ps - Process Status
• pargs - Process Arguments
• penv - Process Environment
• pfile - Process File Information
• pinfo - Other Process Info

Each of the commands listed above require an argument of either a process ID or PTQL query. For certain commands like ps you can use tab completion in the shell to see the possible values.

Simple Process Identification

The simplest of queries can use ‘State.Name‘, the basename of the process executable, to identify a process. For example, the cron daemon on a Linux system:

This approach works to uniquely identify other daemons, such as ‘syslogd‘, ‘dhclient‘ and others where there should only be 1 process with the given name. However, in the case of a daemon such as sshd, there will likely be multiple instances:

The easiest way to find the listening sshd server is to use the pid file:

While this will also work on Windows platforms, it is less common to find a pid files, especially for Windows specific products. It is very common however, for a server process to be registered as Windows Service. Example for the Windows Event Log service:

If you happen to be running Cygwin sshd:

Identifying a server that uses different names

Certain server applications, such as Apache, may have a different ‘State.Name‘ depending on platform, vendor or configuration.

• httpd - The standard name on unix platforms
• Apache - The standard name on windows platforms
• httpsd - Apache-SSL
• httpsd.prefork, httpsd.worker - Covalent‘s Apache ERS product
• apache2 - gentoo

A regular expression can be used to match any of these flavors. Example on a Linux system:

Example on a Windows system:

Identifying the parent process of a forked daemon

In the apache examples above, we were able to use a regular expression to find Apache server processes with different names. However, the examples returned a process listing for the parent process as well as its children. PTQL operators support the notion of a parent flag, ‘P‘, which converts the given query branch to get the attribute of the parent process. For example:

In this example, the first branch of the query, ‘State.Name.eq=httpd‘ will match several processes. The second branch, ‘State.Name.Pne=httpd‘, only matches if the State.Name of the parent process is NOT equal to httpd.

The hardcoded string ‘httpd‘ in the second branch can be replaced with the special variable $1, which is the return value of the attribute (State.Name) in the first branch of the query:

Let‘s say we change the query to where the first branch matches a certain username (CredName.User), with State.Name moving to the second branch, we then need to use ‘$2‘ to get the return value of State.Name:

Use of these variables is particularly useful when combined with our regex to find the parent process of any Apache flavor:

Identifying a Unique Java Process

‘State.Name‘ may be enough to identify certain processes, but this is almost never the case with java applications, where the executable basename is ‘java‘ for all applications:

The results are 3 processes: a JBoss server, a WebSphere server and the sigar shell itself.

Hey, why didn‘t eclipse show up in the listing? If you are on windows, certain java applications will use ‘javaw‘ rather than ‘java‘, simply adjust the query to use the ‘sw‘ operator to match both:

To view the command line arguments for a specific process:

For most java applications, the main class name can be used to uniquely identify the process, in this case argument 7 is the JBoss main class name:

Using the exact argument may not work depending on how the server is configured. Another alternative is to use -1, which means the last argument:

Again, this approach can also fall apart if there are arguments after the main class, using * will match any of the command line arguments:

Sigar 命令的查询方法PTQL语法

标签：

原文地址：http://blog.csdn.net/fred_lzy/article/details/43483831