added killsnoop, another snooping tool for tracing kill()s via ftrace

[MegaMaddin]

Hi Brendan,

first at all, your tools are awesome and excellent for learning kernel internals and for debugging problems.
I've added killsnoop for snopping kills, since I recently had the problem, that someone kills a worker application, which we where not able to locate the origin. In the end, it was a cleaning cron job, which kills long running (and hanging) processes :-)

Maybe someday, it will be useful for someone else.

Best regards,
Martin

[brendangregg]

Excellent, thanks! Good use of tracepoints, followed the style, did error messages.

Missing a man page and examples file, but I'll follow up and add those. It's very minor, but I wonder if instead of -f for signal name, it should be -s, to make it more memorable.

strtonum() doesn't exist for mawk, which I use for buffered output (since mawk is faster) with -d, but not interactive output (since mawk's flush is broken). We can fix it later somehow. I'm not sure the fix is simply to avoid mawk altogether and just use gawk/awk, since I think on some systems I've seen awk is mawk, and there isn't a gawk.

[brendangregg]

... and this is why I like writing examples files at the same time as the script. :-) So I'm writing documentation to explain that "KILLED" doesn't necessarily mean the process has been killed, since it depends on the signal, but this is feeling clumsy. I'll switch that column header to TPID for Target PID.

[MegaMaddin]

Yep, you're right. Should I fix this and make another pull request?

[brendangregg]

It's ok, I'm about to commit the fix anyway with the docs.

[MegaMaddin]

Thank you!