(command.CommandList
  children: [
    (command.ShAssignment
      pairs: [
        (assign_pair
          lhs: (sh_lhs_expr.Name left:<Id.Lit_VarLike 'tracing='> name:tracing)
          op: assign_op.Equal
          rhs: {<'/sys/kernel/debug/tracing'>}
          spids: [166]
        )
      ]
      redirects: []
    )
    (command.CommandList
      children: [
        (command.Sentence
          child: 
            (command.ShAssignment
              pairs: [
                (assign_pair
                  lhs: (sh_lhs_expr.Name left:<Id.Lit_VarLike 'flock='> name:flock)
                  op: assign_op.Equal
                  rhs: {<'/var/tmp/.ftrace-lock'>}
                  spids: [169]
                )
              ]
              redirects: []
            )
          terminator: <Id.Op_Semi _>
        )
        (command.ShAssignment
          pairs: [
            (assign_pair
              lhs: (sh_lhs_expr.Name left:<Id.Lit_VarLike 'wroteflock='> name:wroteflock)
              op: assign_op.Equal
              rhs: {<0>}
              spids: [173]
            )
          ]
          redirects: []
        )
      ]
    )
    (command.CommandList
      children: [
        (command.Sentence
          child: 
            (command.ShAssignment
              pairs: [
                (assign_pair
                  lhs: (sh_lhs_expr.Name left:<Id.Lit_VarLike 'opt_duration='> name:opt_duration)
                  op: assign_op.Equal
                  rhs: {<0>}
                  spids: [176]
                )
              ]
              redirects: []
            )
          terminator: <Id.Op_Semi _>
        )
        (command.Sentence
          child: 
            (command.ShAssignment
              pairs: [
                (assign_pair
                  lhs: (sh_lhs_expr.Name left:<Id.Lit_VarLike 'duration='> name:duration)
                  op: assign_op.Equal
                  rhs: (rhs_word.Empty)
                  spids: [180]
                )
              ]
              redirects: []
            )
          terminator: <Id.Op_Semi _>
        )
        (command.Sentence
          child: 
            (command.ShAssignment
              pairs: [
                (assign_pair
                  lhs: (sh_lhs_expr.Name left:<Id.Lit_VarLike 'opt_name='> name:opt_name)
                  op: assign_op.Equal
                  rhs: {<0>}
                  spids: [183]
                )
              ]
              redirects: []
            )
          terminator: <Id.Op_Semi _>
        )
        (command.Sentence
          child: 
            (command.ShAssignment
              pairs: [
                (assign_pair
                  lhs: (sh_lhs_expr.Name left:<Id.Lit_VarLike 'name='> name:name)
                  op: assign_op.Equal
                  rhs: (rhs_word.Empty)
                  spids: [187]
                )
              ]
              redirects: []
            )
          terminator: <Id.Op_Semi _>
        )
        (command.Sentence
          child: 
            (command.ShAssignment
              pairs: [
                (assign_pair
                  lhs: (sh_lhs_expr.Name left:<Id.Lit_VarLike 'opt_time='> name:opt_time)
                  op: assign_op.Equal
                  rhs: {<0>}
                  spids: [190]
                )
              ]
              redirects: []
            )
          terminator: <Id.Op_Semi _>
        )
        (command.ShAssignment
          pairs: [
            (assign_pair
              lhs: (sh_lhs_expr.Name left:<Id.Lit_VarLike 'opt_reexec='> name:opt_reexec)
              op: assign_op.Equal
              rhs: {<0>}
              spids: [194]
            )
          ]
          redirects: []
        )
      ]
    )
    (command.CommandList
      children: [
        (command.Sentence
          child: 
            (command.ShAssignment
              pairs: [
                (assign_pair
                  lhs: (sh_lhs_expr.Name left:<Id.Lit_VarLike 'opt_argc='> name:opt_argc)
                  op: assign_op.Equal
                  rhs: {<0>}
                  spids: [197]
                )
              ]
              redirects: []
            )
          terminator: <Id.Op_Semi _>
        )
        (command.Sentence
          child: 
            (command.ShAssignment
              pairs: [
                (assign_pair
                  lhs: (sh_lhs_expr.Name left:<Id.Lit_VarLike 'argc='> name:argc)
                  op: assign_op.Equal
                  rhs: {<8>}
                  spids: [201]
                )
              ]
              redirects: []
            )
          terminator: <Id.Op_Semi _>
        )
        (command.Sentence
          child: 
            (command.ShAssignment
              pairs: [
                (assign_pair
                  lhs: (sh_lhs_expr.Name left:<Id.Lit_VarLike 'max_argc='> name:max_argc)
                  op: assign_op.Equal
                  rhs: {<16>}
                  spids: [205]
                )
              ]
              redirects: []
            )
          terminator: <Id.Op_Semi _>
        )
        (command.ShAssignment
          pairs: [
            (assign_pair
              lhs: (sh_lhs_expr.Name left:<Id.Lit_VarLike 'ftext='> name:ftext)
              op: assign_op.Equal
              rhs: (rhs_word.Empty)
              spids: [209]
            )
          ]
          redirects: []
        )
      ]
    )
    (C {<trap>} {(SQ <':'>)} {<INT>} {<QUIT>} {<TERM>} {<PIPE>} {<HUP>})
    (command.ShFunction
      name: usage
      body: 
        (BraceGroup
          left: <Id.Lit_LBrace '{'>
          children: [
            (command.Simple
              words: [{<cat>}]
              redirects: [
                (redir
                  op: <Id.Redir_DLessDash '<<-'>
                  loc: (redir_loc.Fd fd:0)
                  arg: 
                    (redir_param.HereDoc
                      here_begin: {<END>}
                      here_end_span_id: 267
                      stdin_parts: [
                        <'USAGE: execsnoop [-hrt] [-a argc] [-d secs] [name]\n'>
                        <'                 -d seconds      # trace duration, and use buffers\n'>
                        <'                 -a argc         # max args to show (default 8)\n'>
                        <'                 -r              # include re-execs\n'>
                        <'                 -t              # include time (seconds)\n'>
                        <'                 -h              # this usage message\n'>
                        <'                 name            # process name to match (REs allowed)\n'>
                        <'  eg,\n'>
                        <'       execsnoop                 # watch exec()s live (unbuffered)\n'>
                        <'       execsnoop -d 1            # trace 1 sec (buffered)\n'>
                        <'       execsnoop grep            # trace process names containing grep\n'>
                        <'       execsnoop \'log'>
                        <Id.Lit_Dollar '$'>
                        <'\'          # filenames ending in '>
                        <Id.Right_DoubleQuote '"'>
                        <log>
                        <Id.Right_DoubleQuote '"'>
                        <'\n'>
                        <'\n'>
                        <'See the man page and example file for more info.\n'>
                      ]
                    )
                )
                (redir op:<Id.Redir_GreatAnd '>&'> loc:(redir_loc.Fd fd:1) arg:{<2>})
              ]
              more_env: []
              do_fork: T
            )
            (command.ControlFlow token:<Id.ControlFlow_Exit exit>)
          ]
          redirects: []
          right: <Id.Lit_RBrace '}'>
        )
    )
    (command.ShFunction
      name: warn
      body: 
        (BraceGroup
          left: <Id.Lit_LBrace '{'>
          children: [
            (command.If
              arms: [
                (if_arm
                  cond: 
                    (condition.Shell
                      commands: [
                        (command.Sentence
                          child: 
                            (command.Pipeline
                              children: [(C {<eval>} {(DQ ($ Id.VSub_At '@'))})]
                              negated: T
                              stderr_indices: []
                            )
                          terminator: <Id.Op_Semi _>
                        )
                      ]
                    )
                  action: [
                    (command.Simple
                      words: [
                        {<echo>}
                        {
                          (DQ <'WARNING: command failed '> 
                            (word_part.EscapedLiteral
                              token: <Id.Lit_EscapedChar '\\"'>
                              ch: '"'
                            ) ($ Id.VSub_At '@') (word_part.EscapedLiteral token:<Id.Lit_EscapedChar '\\"'> ch:'"')
                          )
                        }
                      ]
                      redirects: [(redir op:<Id.Redir_GreatAnd '>&'> loc:(redir_loc.Fd fd:1) arg:{<2>})]
                      more_env: []
                      do_fork: T
                    )
                  ]
                  spids: [281 292]
                )
              ]
              else_action: []
              redirects: []
            )
          ]
          redirects: []
          right: <Id.Lit_RBrace '}'>
        )
    )
    (command.ShFunction
      name: end
      body: 
        (BraceGroup
          left: <Id.Lit_LBrace '{'>
          children: [
            (command.Simple
              words: [{<echo>}]
              redirects: [(redir op:<Id.Redir_Great '2>'> loc:(redir_loc.Fd fd:2) arg:{<'/dev/null'>})]
              more_env: []
              do_fork: T
            )
            (command.Simple
              words: [{<echo>} {(DQ <'Ending tracing...'>)}]
              redirects: [(redir op:<Id.Redir_Great '2>'> loc:(redir_loc.Fd fd:2) arg:{<'/dev/null'>})]
              more_env: []
              do_fork: T
            )
            (C {<cd>} {($ Id.VSub_DollarName tracing)})
            (C {<warn>} {(DQ <'echo 0 > events/kprobes/'> ($ Id.VSub_DollarName kname) <'/enable'>)})
            (C {<warn>} {(DQ <'echo 0 > events/sched/sched_process_fork/enable'>)})
            (C {<warn>} {(DQ <'echo -:'> ($ Id.VSub_DollarName kname) <' >> kprobe_events'>)})
            (C {<warn>} {(DQ <'echo > trace'>)})
            (command.AndOr
              ops: [Id.Op_DAmp]
              children: [
                (command.DParen
                  child: ($ Id.Lit_ArithVarLike wroteflock)
                  redirects: []
                )
                (C {<warn>} {(DQ <'rm '> ($ Id.VSub_DollarName flock))})
              ]
            )
          ]
          redirects: []
          right: <Id.Lit_RBrace '}'>
        )
    )
    (command.ShFunction
      name: die
      body: 
        (BraceGroup
          left: <Id.Lit_LBrace '{'>
          children: [
            (command.Simple
              words: [{<echo>} {(DQ ($ Id.VSub_At '@'))}]
              redirects: [(redir op:<Id.Redir_GreatAnd '>&'> loc:(redir_loc.Fd fd:1) arg:{<2>})]
              more_env: []
              do_fork: T
            )
            (command.ControlFlow token:<Id.ControlFlow_Exit exit> arg_word:{<1>})
          ]
          redirects: []
          right: <Id.Lit_RBrace '}'>
        )
    )
    (command.ShFunction
      name: edie
      body: 
        (BraceGroup
          left: <Id.Lit_LBrace '{'>
          children: [
            (command.Simple
              words: [{<echo>} {(DQ ($ Id.VSub_At '@'))}]
              redirects: [(redir op:<Id.Redir_GreatAnd '>&'> loc:(redir_loc.Fd fd:1) arg:{<2>})]
              more_env: []
              do_fork: T
            )
            (command.Simple
              words: [{<exec>}]
              redirects: [
                (redir
                  op: <Id.Redir_Great '>'>
                  loc: (redir_loc.Fd fd:1)
                  arg: {<'/dev/null'>}
                )
                (redir op:<Id.Redir_GreatAnd '2>&'> loc:(redir_loc.Fd fd:2) arg:{<1>})
              ]
              more_env: []
              do_fork: T
            )
            (C {<end>})
            (command.ControlFlow token:<Id.ControlFlow_Exit exit> arg_word:{<1>})
          ]
          redirects: []
          right: <Id.Lit_RBrace '}'>
        )
    )
    (command.WhileUntil
      keyword: <Id.KW_While while>
      cond: 
        (condition.Shell
          commands: [(C {<getopts>} {<a> <Id.Lit_Colon ':'> <d> <Id.Lit_Colon ':'> <hrt>} {<opt>})]
        )
      body: 
        (command.DoGroup
          children: [
            (command.Case
              to_match: {($ Id.VSub_DollarName opt)}
              arms: [
                (case_arm
                  pat_list: [{<a>}]
                  action: [
                    (command.Sentence
                      child: 
                        (command.ShAssignment
                          pairs: [
                            (assign_pair
                              lhs: (sh_lhs_expr.Name left:<Id.Lit_VarLike 'opt_argc='> name:opt_argc)
                              op: assign_op.Equal
                              rhs: {<1>}
                              spids: [488]
                            )
                          ]
                          redirects: []
                        )
                      terminator: <Id.Op_Semi _>
                    )
                    (command.ShAssignment
                      pairs: [
                        (assign_pair
                          lhs: (sh_lhs_expr.Name left:<Id.Lit_VarLike 'argc='> name:argc)
                          op: assign_op.Equal
                          rhs: {($ Id.VSub_DollarName OPTARG)}
                          spids: [492]
                        )
                      ]
                      redirects: []
                    )
                  ]
                  spids: [485 486 495 -1]
                )
                (case_arm
                  pat_list: [{<d>}]
                  action: [
                    (command.Sentence
                      child: 
                        (command.ShAssignment
                          pairs: [
                            (assign_pair
                              lhs: 
                                (sh_lhs_expr.Name
                                  left: <Id.Lit_VarLike 'opt_duration='>
                                  name: opt_duration
                                )
                              op: assign_op.Equal
                              rhs: {<1>}
                              spids: [501]
                            )
                          ]
                          redirects: []
                        )
                      terminator: <Id.Op_Semi _>
                    )
                    (command.ShAssignment
                      pairs: [
                        (assign_pair
                          lhs: (sh_lhs_expr.Name left:<Id.Lit_VarLike 'duration='> name:duration)
                          op: assign_op.Equal
                          rhs: {($ Id.VSub_DollarName OPTARG)}
                          spids: [505]
                        )
                      ]
                      redirects: []
                    )
                  ]
                  spids: [498 499 508 -1]
                )
                (case_arm
                  pat_list: [{<r>}]
                  action: [
                    (command.ShAssignment
                      pairs: [
                        (assign_pair
                          lhs: (sh_lhs_expr.Name left:<Id.Lit_VarLike 'opt_reexec='> name:opt_reexec)
                          op: assign_op.Equal
                          rhs: {<1>}
                          spids: [514]
                        )
                      ]
                      redirects: []
                    )
                  ]
                  spids: [511 512 517 -1]
                )
                (case_arm
                  pat_list: [{<t>}]
                  action: [
                    (command.ShAssignment
                      pairs: [
                        (assign_pair
                          lhs: (sh_lhs_expr.Name left:<Id.Lit_VarLike 'opt_time='> name:opt_time)
                          op: assign_op.Equal
                          rhs: {<1>}
                          spids: [523]
                        )
                      ]
                      redirects: []
                    )
                  ]
                  spids: [520 521 526 -1]
                )
                (case_arm
                  pat_list: [{<h>} {<Id.Lit_QMark '?'>}]
                  action: [(C {<usage>})]
                  spids: [529 532 536 -1]
                )
              ]
              redirects: []
            )
          ]
        )
      redirects: []
    )
    (C {<shift>} 
      {
        (word_part.ArithSub
          anode: 
            (arith_expr.Binary
              op_id: Id.Arith_Minus
              left: {($ Id.VSub_DollarName OPTIND)}
              right: {<Id.Lit_Digits 1>}
            )
        )
      }
    )
    (command.If
      arms: [
        (if_arm
          cond: 
            (condition.Shell
              commands: [
                (command.Sentence
                  child: (command.DParen child:{($ Id.VSub_Pound '#')} redirects:[])
                  terminator: <Id.Op_Semi _>
                )
              ]
            )
          action: [
            (command.ShAssignment
              pairs: [
                (assign_pair
                  lhs: (sh_lhs_expr.Name left:<Id.Lit_VarLike 'opt_name='> name:opt_name)
                  op: assign_op.Equal
                  rhs: {<1>}
                  spids: [569]
                )
              ]
              redirects: []
            )
            (command.ShAssignment
              pairs: [
                (assign_pair
                  lhs: (sh_lhs_expr.Name left:<Id.Lit_VarLike 'name='> name:name)
                  op: assign_op.Equal
                  rhs: {($ Id.VSub_Number 1)}
                  spids: [573]
                )
              ]
              redirects: []
            )
            (C {<shift>})
          ]
          spids: [556 566]
        )
      ]
      else_action: []
      redirects: []
    )
    (command.AndOr
      ops: [Id.Op_DAmp]
      children: [(command.DParen child:{($ Id.VSub_Pound '#')} redirects:[]) (C {<usage>})]
    )
    (command.AndOr
      ops: [Id.Op_DAmp]
      children: [
        (command.DParen
          child: 
            (arith_expr.Binary
              op_id: Id.Arith_DAmp
              left: ($ Id.Lit_ArithVarLike opt_pid)
              right: ($ Id.Lit_ArithVarLike opt_name)
            )
          redirects: []
        )
        (C {<die>} {(DQ <'ERROR: use either -p or -n.'>)})
      ]
    )
    (command.AndOr
      ops: [Id.Op_DAmp]
      children: [
        (command.DParen child:($ Id.Lit_ArithVarLike opt_pid) redirects:[])
        (command.ShAssignment
          pairs: [
            (assign_pair
              lhs: (sh_lhs_expr.Name left:<Id.Lit_VarLike 'ftext='> name:ftext)
              op: assign_op.Equal
              rhs: {(DQ <' issued by PID '> ($ Id.VSub_DollarName pid))}
              spids: [624]
            )
          ]
          redirects: []
        )
      ]
    )
    (command.AndOr
      ops: [Id.Op_DAmp]
      children: [
        (command.DParen child:($ Id.Lit_ArithVarLike opt_name) redirects:[])
        (command.ShAssignment
          pairs: [
            (assign_pair
              lhs: (sh_lhs_expr.Name left:<Id.Lit_VarLike 'ftext='> name:ftext)
              op: assign_op.Equal
              rhs: 
                {
                  (DQ <' issued by process name '> 
                    (word_part.EscapedLiteral
                      token: <Id.Lit_EscapedChar '\\"'>
                      ch: '"'
                    ) ($ Id.VSub_DollarName name) (word_part.EscapedLiteral token:<Id.Lit_EscapedChar '\\"'> ch:'"')
                  )
                }
              spids: [639]
            )
          ]
          redirects: []
        )
      ]
    )
    (command.AndOr
      ops: [Id.Op_DAmp]
      children: [
        (command.DParen child:($ Id.Lit_ArithVarLike opt_file) redirects:[])
        (command.ShAssignment
          pairs: [
            (assign_pair
              lhs: (sh_lhs_expr.Name left:<Id.Lit_VarLike 'ftext='> name:ftext)
              op: assign_op.Equal
              rhs: 
                {
                  (DQ ($ Id.VSub_DollarName ftext) <' for filenames containing '> 
                    (word_part.EscapedLiteral
                      token: <Id.Lit_EscapedChar '\\"'>
                      ch: '"'
                    ) ($ Id.VSub_DollarName file) (word_part.EscapedLiteral token:<Id.Lit_EscapedChar '\\"'> ch:'"')
                  )
                }
              spids: [656]
            )
          ]
          redirects: []
        )
      ]
    )
    (command.AndOr
      ops: [Id.Op_DAmp]
      children: [
        (command.DParen
          child: 
            (arith_expr.Binary
              op_id: Id.Arith_DAmp
              left: ($ Id.Lit_ArithVarLike opt_argc)
              right: 
                (arith_expr.Binary
                  op_id: Id.Arith_Great
                  left: ($ Id.Lit_ArithVarLike argc)
                  right: ($ Id.Lit_ArithVarLike max_argc)
                )
            )
          redirects: []
        )
        (C {<die>} {(DQ <'ERROR: max -a argc is '> ($ Id.VSub_DollarName max_argc) <.>)})
      ]
    )
    (command.If
      arms: [
        (if_arm
          cond: 
            (condition.Shell
              commands: [
                (command.Sentence
                  child: (command.DParen child:($ Id.Lit_ArithVarLike opt_duration) redirects:[])
                  terminator: <Id.Op_Semi _>
                )
              ]
            )
          action: [
            (C {<echo>} 
              {
                (DQ <'Tracing exec()s'> ($ Id.VSub_DollarName ftext) <' for '> 
                  ($ Id.VSub_DollarName duration) <' seconds (buffered)...'>
                )
              }
            )
          ]
          spids: [690 700]
        )
      ]
      else_action: [
        (C {<echo>} {(DQ <'Tracing exec()s'> ($ Id.VSub_DollarName ftext) <'. Ctrl-C to end.'>)})
      ]
      redirects: []
    )
    (command.If
      arms: [
        (if_arm
          cond: 
            (condition.Shell
              commands: [
                (command.Sentence
                  child: (command.DParen child:($ Id.Lit_ArithVarLike opt_duration) redirects:[])
                  terminator: <Id.Op_Semi _>
                )
              ]
            )
          action: [
            (command.AndOr
              ops: [Id.Op_DAmp Id.Op_DPipe]
              children: [
                (command.DBracket
                  expr: (bool_expr.Unary op_id:Id.BoolUnary_x child:{<'/usr/bin/mawk'>})
                  redirects: []
                )
                (command.ShAssignment
                  pairs: [
                    (assign_pair
                      lhs: (sh_lhs_expr.Name left:<Id.Lit_VarLike 'awk='> name:awk)
                      op: assign_op.Equal
                      rhs: {<mawk>}
                      spids: [753]
                    )
                  ]
                  redirects: []
                )
                (command.ShAssignment
                  pairs: [
                    (assign_pair
                      lhs: (sh_lhs_expr.Name left:<Id.Lit_VarLike 'awk='> name:awk)
                      op: assign_op.Equal
                      rhs: {<awk>}
                      spids: [758]
                    )
                  ]
                  redirects: []
                )
              ]
            )
          ]
          spids: [730 740]
        )
      ]
      else_action: [
        (command.If
          arms: [
            (if_arm
              cond: 
                (condition.Shell
                  commands: [
                    (command.Sentence
                      child: 
                        (command.DBracket
                          expr: (bool_expr.Unary op_id:Id.BoolUnary_x child:{<'/usr/bin/gawk'>})
                          redirects: []
                        )
                      terminator: <Id.Op_Semi _>
                    )
                  ]
                )
              action: [
                (command.ShAssignment
                  pairs: [
                    (assign_pair
                      lhs: (sh_lhs_expr.Name left:<Id.Lit_VarLike 'awk='> name:awk)
                      op: assign_op.Equal
                      rhs: {<gawk>}
                      spids: [782]
                    )
                  ]
                  redirects: []
                )
              ]
              spids: [768 779]
            )
            (if_arm
              cond: 
                (condition.Shell
                  commands: [
                    (command.Sentence
                      child: 
                        (command.DBracket
                          expr: (bool_expr.Unary op_id:Id.BoolUnary_x child:{<'/usr/bin/mawk'>})
                          redirects: []
                        )
                      terminator: <Id.Op_Semi _>
                    )
                  ]
                )
              action: [
                (command.ShAssignment
                  pairs: [
                    (assign_pair
                      lhs: (sh_lhs_expr.Name left:<Id.Lit_VarLike 'awk='> name:awk)
                      op: assign_op.Equal
                      rhs: {(DQ <'mawk -W interactive'>)}
                      spids: [800]
                    )
                  ]
                  redirects: []
                )
              ]
              spids: [786 797]
            )
          ]
          else_action: [
            (command.ShAssignment
              pairs: [
                (assign_pair
                  lhs: (sh_lhs_expr.Name left:<Id.Lit_VarLike 'awk='> name:awk)
                  op: assign_op.Equal
                  rhs: {<awk>}
                  spids: [809]
                )
              ]
              redirects: []
            )
          ]
          redirects: []
        )
      ]
      redirects: []
    )
    (command.AndOr
      ops: [Id.Op_DPipe]
      children: [
        (C {<cd>} {($ Id.VSub_DollarName tracing)})
        (C {<die>} 
          {
            (DQ <'ERROR: accessing tracing. Root user? Kernel has FTRACE?\n'> 
              <'    debugfs mounted? (mount -t debugfs debugfs /sys/kernel/debug)'>
            )
          }
        )
      ]
    )
    (command.AndOr
      ops: [Id.Op_DAmp]
      children: [
        (command.DBracket
          expr: (bool_expr.Unary op_id:Id.BoolUnary_e child:{($ Id.VSub_DollarName flock)})
          redirects: []
        )
        (C {<die>} 
          {
            (DQ <'ERROR: ftrace may be in use by PID '> 
              (command_sub
                left_token: <Id.Left_DollarParen '$('>
                child: (C {<cat>} {($ Id.VSub_DollarName flock)})
                right: <Id.Eof_RParen _>
              ) <' '> ($ Id.VSub_DollarName flock)
            )
          }
        )
      ]
    )
    (command.AndOr
      ops: [Id.Op_DPipe]
      children: [
        (command.Simple
          words: [{<echo>} {($ Id.VSub_Dollar '$')}]
          redirects: [
            (redir
              op: <Id.Redir_Great '>'>
              loc: (redir_loc.Fd fd:1)
              arg: {($ Id.VSub_DollarName flock)}
            )
          ]
          more_env: []
          do_fork: T
        )
        (C {<die>} {(DQ <'ERROR: unable to write '> ($ Id.VSub_DollarName flock) <.>)})
      ]
    )
    (command.ShAssignment
      pairs: [
        (assign_pair
          lhs: (sh_lhs_expr.Name left:<Id.Lit_VarLike 'wroteflock='> name:wroteflock)
          op: assign_op.Equal
          rhs: {<1>}
          spids: [879]
        )
      ]
      redirects: []
    )
    (command.If
      arms: [
        (if_arm
          cond: 
            (condition.Shell
              commands: [
                (command.Sentence
                  child: 
                    (command.DBracket
                      expr: (bool_expr.Unary op_id:Id.BoolUnary_x child:{<'/usr/bin/getconf'>})
                      redirects: []
                    )
                  terminator: <Id.Op_Semi _>
                )
              ]
            )
          action: [
            (command.ShAssignment
              pairs: [
                (assign_pair
                  lhs: (sh_lhs_expr.Name left:<Id.Lit_VarLike 'bits='> name:bits)
                  op: assign_op.Equal
                  rhs: 
                    {
                      (command_sub
                        left_token: <Id.Left_DollarParen '$('>
                        child: (C {<getconf>} {<LONG_BIT>})
                        right: <Id.Eof_RParen _>
                      )
                    }
                  spids: [900]
                )
              ]
              redirects: []
            )
          ]
          spids: [886 897]
        )
      ]
      else_action: [
        (command.ShAssignment
          pairs: [
            (assign_pair
              lhs: (sh_lhs_expr.Name left:<Id.Lit_VarLike 'bits='> name:bits)
              op: assign_op.Equal
              rhs: {<64>}
              spids: [910]
            )
          ]
          redirects: []
        )
        (command.AndOr
          ops: [Id.Op_DAmp]
          children: [
            (command.DBracket
              expr: 
                (bool_expr.Binary
                  op_id: Id.BoolBinary_GlobDEqual
                  left: 
                    {
                      (command_sub
                        left_token: <Id.Left_DollarParen '$('>
                        child: (C {<uname>} {<-m>})
                        right: <Id.Eof_RParen _>
                      )
                    }
                  right: {<i> <Id.Lit_Other '*'>}
                )
              redirects: []
            )
            (command.ShAssignment
              pairs: [
                (assign_pair
                  lhs: (sh_lhs_expr.Name left:<Id.Lit_VarLike 'bits='> name:bits)
                  op: assign_op.Equal
                  rhs: {<32>}
                  spids: [931]
                )
              ]
              redirects: []
            )
          ]
        )
      ]
      redirects: []
    )
    (command.DParen
      child: 
        (arith_expr.BinaryAssign
          op_id: Id.Arith_Equal
          left: ($ Id.Lit_ArithVarLike offset)
          right: 
            (arith_expr.Binary
              op_id: Id.Arith_Slash
              left: ($ Id.Lit_ArithVarLike bits)
              right: {<Id.Lit_Digits 8>}
            )
        )
      redirects: []
    )
    (command.ShFunction
      name: makeprobe
      body: 
        (BraceGroup
          left: <Id.Lit_LBrace '{'>
          children: [
            (command.ShAssignment
              pairs: [
                (assign_pair
                  lhs: (sh_lhs_expr.Name left:<Id.Lit_VarLike 'func='> name:func)
                  op: assign_op.Equal
                  rhs: {($ Id.VSub_Number 1)}
                  spids: [958]
                )
              ]
              redirects: []
            )
            (command.ShAssignment
              pairs: [
                (assign_pair
                  lhs: (sh_lhs_expr.Name left:<Id.Lit_VarLike 'kname='> name:kname)
                  op: assign_op.Equal
                  rhs: {<execsnoop_> ($ Id.VSub_DollarName func)}
                  spids: [962]
                )
              ]
              redirects: []
            )
            (command.ShAssignment
              pairs: [
                (assign_pair
                  lhs: (sh_lhs_expr.Name left:<Id.Lit_VarLike 'kprobe='> name:kprobe)
                  op: assign_op.Equal
                  rhs: {(DQ <'p:'> ($ Id.VSub_DollarName kname) <' '> ($ Id.VSub_DollarName func))}
                  spids: [967]
                )
              ]
              redirects: []
            )
            (command.ShAssignment
              pairs: [
                (assign_pair
                  lhs: (sh_lhs_expr.Name left:<Id.Lit_VarLike 'i='> name:i)
                  op: assign_op.Equal
                  rhs: {<0>}
                  spids: [976]
                )
              ]
              redirects: []
            )
            (command.WhileUntil
              keyword: <Id.KW_While while>
              cond: 
                (condition.Shell
                  commands: [
                    (command.Sentence
                      child: 
                        (command.DParen
                          child: 
                            (arith_expr.Binary
                              op_id: Id.Arith_Less
                              left: ($ Id.Lit_ArithVarLike i)
                              right: 
                                (arith_expr.Binary
                                  op_id: Id.Arith_Plus
                                  left: ($ Id.Lit_ArithVarLike argc)
                                  right: {<Id.Lit_Digits 1>}
                                )
                            )
                          redirects: []
                        )
                      terminator: <Id.Op_Semi _>
                    )
                  ]
                )
              body: 
                (command.DoGroup
                  children: [
                    (command.ShAssignment
                      pairs: [
                        (assign_pair
                          lhs: (sh_lhs_expr.Name left:<Id.Lit_VarLike 'kprobe='> name:kprobe)
                          op: assign_op.Equal
                          rhs: 
                            {
                              (DQ ($ Id.VSub_DollarName kprobe) <' +0(+'> 
                                (word_part.ArithSub
                                  anode: 
                                    (arith_expr.Binary
                                      op_id: Id.Arith_Star
                                      left: ($ Id.Lit_ArithVarLike i)
                                      right: ($ Id.Lit_ArithVarLike offset)
                                    )
                                ) <'(%si)):string'>
                              )
                            }
                          spids: [1005]
                        )
                      ]
                      redirects: []
                    )
                    (command.DParen
                      child: 
                        (arith_expr.UnaryAssign
                          op_id: Id.Node_PostDPlus
                          child: ($ Id.Lit_ArithVarLike i)
                        )
                      redirects: []
                    )
                  ]
                )
              redirects: []
            )
          ]
          redirects: []
          right: <Id.Lit_RBrace '}'>
        )
    )
    (C {<makeprobe>} {<sys_execve>})
    (command.Simple
      words: [{<echo>} {<nop>}]
      redirects: [(redir op:<Id.Redir_Great '>'> loc:(redir_loc.Fd fd:1) arg:{<current_tracer>})]
      more_env: []
      do_fork: T
    )
    (command.If
      arms: [
        (if_arm
          cond: 
            (condition.Shell
              commands: [
                (command.Sentence
                  child: 
                    (command.Pipeline
                      children: [
                        (command.Simple
                          words: [{<echo>} {($ Id.VSub_DollarName kprobe)}]
                          redirects: [
                            (redir
                              op: <Id.Redir_DGreat '>>'>
                              loc: (redir_loc.Fd fd:1)
                              arg: {<kprobe_events>}
                            )
                            (redir
                              op: <Id.Redir_Great '2>'>
                              loc: (redir_loc.Fd fd:2)
                              arg: {<'/dev/null'>}
                            )
                          ]
                          more_env: []
                          do_fork: T
                        )
                      ]
                      negated: T
                      stderr_indices: []
                    )
                  terminator: <Id.Op_Semi _>
                )
              ]
            )
          action: [
            (C {<makeprobe>} {<stub_execve>})
            (command.If
              arms: [
                (if_arm
                  cond: 
                    (condition.Shell
                      commands: [
                        (command.Sentence
                          child: 
                            (command.Pipeline
                              children: [
                                (command.Simple
                                  words: [{<echo>} {($ Id.VSub_DollarName kprobe)}]
                                  redirects: [
                                    (redir
                                      op: <Id.Redir_DGreat '>>'>
                                      loc: (redir_loc.Fd fd:1)
                                      arg: {<kprobe_events>}
                                    )
                                    (redir
                                      op: <Id.Redir_Great '2>'>
                                      loc: (redir_loc.Fd fd:2)
                                      arg: {<'/dev/null'>}
                                    )
                                  ]
                                  more_env: []
                                  do_fork: T
                                )
                              ]
                              negated: T
                              stderr_indices: []
                            )
                          terminator: <Id.Op_Semi _>
                        )
                      ]
                    )
                  action: [
                    (C {<makeprobe>} {<do_execve>})
                    (command.If
                      arms: [
                        (if_arm
                          cond: 
                            (condition.Shell
                              commands: [
                                (command.Sentence
                                  child: 
                                    (command.Pipeline
                                      children: [
                                        (command.Simple
                                          words: [{<echo>} {($ Id.VSub_DollarName kprobe)}]
                                          redirects: [
                                            (redir
                                              op: <Id.Redir_DGreat '>>'>
                                              loc: (redir_loc.Fd fd:1)
                                              arg: {<kprobe_events>}
                                            )
                                            (redir
                                              op: <Id.Redir_Great '2>'>
                                              loc: (redir_loc.Fd fd:2)
                                              arg: {<'/dev/null'>}
                                            )
                                          ]
                                          more_env: []
                                          do_fork: T
                                        )
                                      ]
                                      negated: T
                                      stderr_indices: []
                                    )
                                  terminator: <Id.Op_Semi _>
                                )
                              ]
                            )
                          action: [(C {<edie>} {(DQ <'ERROR: adding a kprobe for execve. Exiting.'>)})]
                          spids: [1103 1119]
                        )
                      ]
                      else_action: []
                      redirects: []
                    )
                  ]
                  spids: [1079 1095]
                )
              ]
              else_action: []
              redirects: []
            )
          ]
          spids: [1055 1071]
        )
      ]
      else_action: []
      redirects: []
    )
    (command.If
      arms: [
        (if_arm
          cond: 
            (condition.Shell
              commands: [
                (command.Sentence
                  child: 
                    (command.Pipeline
                      children: [
                        (command.Simple
                          words: [{<echo>} {<1>}]
                          redirects: [
                            (redir
                              op: <Id.Redir_Great '>'>
                              loc: (redir_loc.Fd fd:1)
                              arg: {<'events/kprobes/'> ($ Id.VSub_DollarName kname) <'/enable'>}
                            )
                          ]
                          more_env: []
                          do_fork: T
                        )
                      ]
                      negated: T
                      stderr_indices: []
                    )
                  terminator: <Id.Op_Semi _>
                )
              ]
            )
          action: [(C {<edie>} {(DQ <'ERROR: enabling kprobe for execve. Exiting.'>)})]
          spids: [1136 1151]
        )
      ]
      else_action: []
      redirects: []
    )
    (command.If
      arms: [
        (if_arm
          cond: 
            (condition.Shell
              commands: [
                (command.Sentence
                  child: 
                    (command.Pipeline
                      children: [
                        (command.Simple
                          words: [{<echo>} {<1>}]
                          redirects: [
                            (redir
                              op: <Id.Redir_Great '>'>
                              loc: (redir_loc.Fd fd:1)
                              arg: {<'events/sched/sched_process_fork/enable'>}
                            )
                          ]
                          more_env: []
                          do_fork: T
                        )
                      ]
                      negated: T
                      stderr_indices: []
                    )
                  terminator: <Id.Op_Semi _>
                )
              ]
            )
          action: [(C {<edie>} {(DQ <'ERROR: enabling sched:sched_process_fork tracepoint. Exiting.'>)})]
          spids: [1162 1175]
        )
      ]
      else_action: []
      redirects: []
    )
    (C {<echo>} {(DQ <'Instrumenting '> ($ Id.VSub_DollarName func))})
    (command.AndOr
      ops: [Id.Op_DAmp]
      children: [
        (command.DParen child:($ Id.Lit_ArithVarLike opt_time) redirects:[])
        (C {<printf>} {(DQ <'%-16s '>)} {(DQ <TIMEs>)})
      ]
    )
    (C {<printf>} {(DQ <'%6s %6s %s'> <Id.Lit_BadBackslash '\\'> <n>)} {(DQ <PID>)} {(DQ <PPID>)} 
      {(DQ <ARGS>)}
    )
    (command.ShAssignment
      pairs: [
        (assign_pair
          lhs: (sh_lhs_expr.Name left:<Id.Lit_VarLike 'offset='> name:offset)
          op: assign_op.Equal
          rhs: 
            {
              (command_sub
                left_token: <Id.Left_DollarParen '$('>
                child: 
                  (C {($ Id.VSub_DollarName awk)} 
                    {
                      (SQ <'BEGIN { o = 0; }\n'> 
                        <'\t$1 == "#" && $2 ~ /TASK/ && NF == 6 { o = 1; }\n'> <'\t$2 ~ /TASK/ { print o; exit }'>
                      )
                    } {<trace>}
                  )
                right: <Id.Eof_RParen _>
              )
            }
          spids: [1254]
        )
      ]
      redirects: []
    )
    (C {<warn>} {(DQ <'echo > trace'>)})
    (command.Pipeline
      children: [
        (command.Subshell
          child: 
            (command.If
              arms: [
                (if_arm
                  cond: 
                    (condition.Shell
                      commands: [
                        (command.Sentence
                          child: 
                            (command.DParen
                              child: ($ Id.Lit_ArithVarLike opt_duration)
                              redirects: []
                            )
                          terminator: <Id.Op_Semi _>
                        )
                      ]
                    )
                  action: [(C {<sleep>} {($ Id.VSub_DollarName duration)}) (C {<cat>} {<-v>} {<trace>})]
                  spids: [1279 1289]
                )
              ]
              else_action: [(C {<cat>} {<-v>} {<trace_pipe>})]
              redirects: []
            )
          redirects: []
        )
        (C {($ Id.VSub_DollarName awk)} {<-v>} {<Id.Lit_VarLike 'o='> ($ Id.VSub_DollarName offset)} 
          {<-v>} {<Id.Lit_VarLike 'opt_name='> ($ Id.VSub_DollarName opt_name)} {<-v>} 
          {<Id.Lit_VarLike 'name='> ($ Id.VSub_DollarName name)} {<-v>} {<Id.Lit_VarLike 'opt_duration='> ($ Id.VSub_DollarName opt_duration)} {<-v>} 
          {<Id.Lit_VarLike 'opt_time='> ($ Id.VSub_DollarName opt_time)} {<-v>} {<Id.Lit_VarLike 'kname='> ($ Id.VSub_DollarName kname)} {<-v>} 
          {<Id.Lit_VarLike 'opt_reexec='> ($ Id.VSub_DollarName opt_reexec)} 
          {
            (SQ <'\n'> <'\t# common fields\n'> <'\t$1 != "#" {\n'> 
              <'\t\t# task name can contain dashes\n'> <'\t\tcomm = pid = $1\n'> <'\t\tsub(/-[0-9][0-9]*/, "", comm)\n'> <'\t\tsub(/.*-/, "", pid)\n'> 
              <'\t}\n'> <'\n'> <'\t$1 != "#" && $(4+o) ~ /sched_process_fork/ {\n'> <'\t\tcpid=$0\n'> 
              <'\t\tsub(/.* child_pid=/, "", cpid)\n'> <'\t\tsub(/ .*/, "", cpid)\n'> <'\t\tgetppid[cpid] = pid\n'> <'\t\tdelete seen[pid]\n'> <'\t}\n'> <'\n'> 
              <'\t$1 != "#" && $(4+o) ~ kname {\n'> <'\t\tif (seen[pid])\n'> <'\t\t\tnext\n'> <'\t\tif (opt_name && comm !~ name)\n'> <'\t\t\tnext\n'> <'\n'> 
              <'\t\t#\n'> <'\t\t# examples:\n'> <'\t\t# ... arg1="/bin/echo" arg2="1" arg3="2" arg4="3" ...\n'> 
              <'\t\t# ... arg1="sleep" arg2="2" arg3=(fault) arg4="" ...\n'> <'\t\t# ... arg1="" arg2=(fault) arg3="" arg4="" ...\n'> 
              <'\t\t# the last example is uncommon, and may be a race.\n'> <'\t\t#\n'> <'\t\tif ($0 ~ /arg1=""/) {\n'> <'\t\t\targs = comm " [?]"\n'> <'\t\t} else {\n'> 
              <'\t\t\targs=$0\n'> <'\t\t\tsub(/ arg[0-9]*=\\(fault\\).*/, "", args)\n'> <'\t\t\tsub(/.*arg1="/, "", args)\n'> 
              <'\t\t\tgsub(/" arg[0-9]*="/, " ", args)\n'> <'\t\t\tsub(/"$/, "", args)\n'> <'\t\t\tif ($0 !~ /\\(fault\\)/)\n'> <'\t\t\t\targs = args " [...]"\n'> 
              <'\t\t}\n'> <'\n'> <'\t\tif (opt_time) {\n'> <'\t\t\ttime = $(3+o); sub(":", "", time)\n'> 
              <'\t\t\tprintf "%-16s ", time\n'> <'\t\t}\n'> <'\t\tprintf "%6s %6d %s\\n", pid, getppid[pid], args\n'> <'\t\tif (!opt_duration)\n'> 
              <'\t\t\tfflush()\n'> <'\t\tif (!opt_reexec) {\n'> <'\t\t\tseen[pid] = 1\n'> <'\t\t\tdelete getppid[pid]\n'> <'\t\t}\n'> 
              <'\t}\n'> <'\n'> <'\t$0 ~ /LOST.*EVENT[S]/ { print "WARNING: " $0 > "/dev/stderr" }\n'>
            )
          }
        )
      ]
      negated: F
      stderr_indices: []
    )
    (C {<end>})
  ]
)