| # | |
| # Copyright (c) 2015, 2025, Oracle and/or its affiliates. All rights reserved. | |
| # DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER. | |
| # | |
| # This code is free software; you can redistribute it and/or modify it | |
| # under the terms of the GNU General Public License version 2 only, as | |
| # published by the Free Software Foundation. | |
| # | |
| # This code is distributed in the hope that it will be useful, but WITHOUT | |
| # ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or | |
| # FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License | |
| # version 2 for more details (a copy is included in the LICENSE file that | |
| # accompanied this code). | |
| # | |
| # You should have received a copy of the GNU General Public License version | |
| # 2 along with this work; if not, write to the Free Software Foundation, | |
| # Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA. | |
| # | |
| # Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA | |
| # or visit www.oracle.com if you need additional information or have any | |
| # questions. | |
| # | |
| config.execSuffix=.exe | |
| config.getChildren.app=powershell | |
| config.getChildren.pattern=%p | |
| config.getChildren.args.delimiter=\0 | |
| config.getChildren.args=-NoLogo\0-Command\0"Get-CimInstance Win32_Process -Filter \\\"ParentProcessId = %p\\\" | Select-Object ProcessId" | tail -n+4 | |
| ################################################################################ | |
| # process info to gather | |
| ################################################################################ | |
| onTimeout=\ | |
| native.info \ | |
| native.pmap.normal native.pmap.everything \ | |
| native.files native.locks \ | |
| native.stack native.core | |
| ################################################################################ | |
| native.pattern=%p | |
| native.javaOnly=false | |
| native.args=%p | |
| native.info.app=powershell | |
| native.info.delimiter=\0 | |
| native.info.args=-NoLogo\0-Command\0"Get-WmiObject Win32_Process -Filter \\\"ProcessId = %p\\\" | Format-List -Property *" | |
| native.pmap.app=pmap | |
| native.pmap.normal.args=%p | |
| native.pmap.everything.args=-x %p | |
| native.files.app=handle | |
| native.files.args=-p %p | |
| # TODO | |
| native.locks.app=lslocks | |
| native.locks.args=-u --pid %p | |
| native.stack.app=cdb | |
| native.stack.args=-c "~*kP n;qd" -p %p | |
| native.stack.params.repeat=6 | |
| native.core.app=cdb | |
| native.core.args=-c ".dump /mA core.%p;qd" -p %p | |
| native.core.params.timeout=600000 | |
| cores= | |
| ################################################################################ | |
| # environment info to gather | |
| ################################################################################ | |
| environment=\ | |
| users.current users.logged \ | |
| disk \ | |
| env \ | |
| ulimit \ | |
| system.events.system system.events.application system.os \ | |
| process.top process.ps process.tasklist \ | |
| memory.free memory.vmstat.default memory.vmstat.statistics \ | |
| memory.vmstat.slabinfo memory.vmstat.disk \ | |
| files \ | |
| net.sockets net.statistics net.ipconfig net.hostsfile \ | |
| screenshot | |
| ################################################################################ | |
| users.current.app=id | |
| users.current.args=-a | |
| users.logged.app=query | |
| users.logged.args=user | |
| disk.app=df | |
| disk.args=-h | |
| env.app=env | |
| ulimit.app=bash | |
| ulimit.args=-c\0ulimit -a | |
| ulimit.args.delimiter=\0 | |
| system.events.app=powershell | |
| system.events.delimiter=\0 | |
| system.events.system.args=-NoLogo\0-Command\0Get-EventLog System -After (Get-Date).AddDays(-1) | Format-List | |
| system.events.application.args=-NoLogo\0-Command\0Get-EventLog Application -After (Get-Date).AddDays(-1) | Format-List | |
| system.os.app=powershell | |
| system.os.delimiter=\0 | |
| system.os.args=-NoLogo\0-Command\0Get-WmiObject Win32_OperatingSystem | Format-List -Property * | |
| process.top.app=top | |
| process.top.args=-b -n 1 | |
| process.ps.app=ps | |
| process.ps.args=-efW | |
| process.tasklist.app=tasklist | |
| process.tasklist.args=/V | |
| memory.free.app=free | |
| memory.vmstat.app=vmstat | |
| memory.vmstat.statistics.args=-s | |
| memory.vmstat.slabinfo.args=-m | |
| memory.vmstat.disk.args=-d | |
| files.app=openfiles | |
| files.args=/query | |
| net.sockets.app=bash | |
| net.sockets.args=-c\0netstat -b -a -t -o || netstat -a -t -o | |
| net.sockets.args.delimiter=\0 | |
| net.statistics.app=netstat | |
| net.statistics.args=-s -e | |
| net.ipconfig.app=ipconfig | |
| net.ipconfig.args=/all | |
| net.hostsfile.app=bash | |
| net.hostsfile.args.delimiter=\0 | |
| net.hostsfile.args=-c\0cat $WINDIR/System32/drivers/etc/hosts | |
| screenshot.app=bash | |
| screenshot.args=-c\0\ | |
| echo '\ | |
| var robot = new java.awt.Robot();\ | |
| var ge = java.awt.GraphicsEnvironment.getLocalGraphicsEnvironment();\ | |
| var bounds = ge.getDefaultScreenDevice().getDefaultConfiguration().getBounds();\ | |
| var capture = robot.createScreenCapture(bounds);\ | |
| var file = new java.io.File(""screen.png"");\ | |
| javax.imageio.ImageIO.write(capture, ""png"", file);\ | |
| ' | jshell - | |
| screenshot.args.delimiter=\0 | |
| ################################################################################ |