---
title: trace_mount
sidebar_position: 0
---

import Tabs from '@theme/Tabs';
import TabItem from '@theme/TabItem';

# trace_mount

The trace_mount gadget emits events when mount and unmount system calls are made.

## Requirements

- Minimum Kernel Version : *5.4

*This is the minimal kernel version we have tried for this Gadget, however it's possible that it works with earlier versions.

## Getting started

Running the gadget:

<Tabs groupId="env">
    <TabItem value="kubectl-gadget" label="kubectl gadget">
        ```bash
        $ kubectl gadget run ghcr.io/inspektor-gadget/gadget/trace_mount:%IG_TAG% [flags]
        ```
    </TabItem>

    <TabItem value="ig" label="ig">
        ```bash
        $ sudo ig run ghcr.io/inspektor-gadget/gadget/trace_mount:%IG_TAG% [flags]
        ```
    </TabItem>
</Tabs>
## Flags

### `--pid`

Show only events generated by process with this PID

Default value: ""

## Guide

First, we need to run an application that generates some events.

<Tabs groupId="env">
    <TabItem value="kubectl-gadget" label="kubectl gadget">
        ```bash
        $ kubectl run mypod --restart=Never --image=busybox -- sh -c 'while /bin/true ; do mount /mnt /mnt ; sleep 3 ; done'
        pod/mypod created
        ```
    </TabItem>

    <TabItem value="ig" label="ig">
        ```bash
        $ docker run --privileged --name test-trace-mount -d busybox /bin/sh -c 'while /bin/true ; do mount /bar /foo ; sleep 3 ; done'
        ```
    </TabItem>
</Tabs>

Then, let's run the gadget:

<Tabs groupId="env">
    <TabItem value="kubectl-gadget" label="kubectl gadget">
        Using the trace_mount gadget, we can see which processes mount and unmount filesystems.
        We can simply filter for the pod `mypod` and omit specifying the node,
        thus tracing on all nodes for a pod called `mypod`:

        ```bash
        $ kubectl gadget run trace_mount:%IG_TAG% --podname mypod
        K8S.NODE          K8S.NAMESPACE              K8S.PODNAME                K8S.CONTAINERNAME          COMM                      PID           TID  DELTA FLAGS         CALL                        ERROR
        minikube-docker   default                    mypod                      mypod                      mount                   36469         36469   3318 MS_SILENT     mount("/mnt", "/mnt", "ext… ENOENT
        minikube-docker   default                    mypod                      mypod                      mount                   36469         36469   1321 MS_SILENT     mount("/mnt", "/mnt", "ext… ENOENT
        minikube-docker   default                    mypod                      mypod                      mount                   36469         36469   1187 MS_SILENT     mount("/mnt", "/mnt", "ext… ENOENT
        minikube-docker   default                    mypod                      mypod                      mount                   36469         36469   1655 MS_SILENT     mount("/mnt", "/mnt", "squ… ENOENT
        minikube-docker   default                    mypod                      mypod                      mount                   36469         36469   1257 MS_SILENT     mount("/mnt", "/mnt", "vfa… ENOENT
        minikube-docker   default                    mypod                      mypod                      mount                   36469         36469   1211 MS_SILENT     mount("/mnt", "/mnt", "fus… ENOENT
        minikube-docker   default                    mypod                      mypod                      mount                   36474         36474   3496 MS_SILENT     mount("/mnt", "/mnt", "ext… ENOENT
        minikube-docker   default                    mypod                      mypod                      mount                   36474         36474   1638 MS_SILENT     mount("/mnt", "/mnt", "ext… ENOENT
        ^C
        ```

        We can stop the gadget by hitting Ctrl-C.

    </TabItem>

    <TabItem value="ig" label="ig">
        ```bash
        $ sudo ig run trace_mount:%IG_TAG% --containername test-trace-mount
        RUNTIME.CONTAINERNAME                    COMM                               PID                   TID       DELTA FLAGS                CALL                                      ERROR
        test-trace-mount                         mount                            51158                 51158        3460 MS_SILENT            mount("/bar", "/foo", "ext3", MS_SILENT,… ENOENT
        test-trace-mount                         mount                            51158                 51158        1250 MS_SILENT            mount("/bar", "/foo", "ext2", MS_SILENT,… ENOENT
        test-trace-mount                         mount                            51158                 51158      130208 MS_SILENT            mount("/bar", "/foo", "ext4", MS_SILENT,… ENOENT
        test-trace-mount                         mount                            51158                 51158        1762 MS_SILENT            mount("/bar", "/foo", "squashf", MS_SILE… ENOENT
        test-trace-mount                         mount                            51158                 51158        1200 MS_SILENT            mount("/bar", "/foo", "vfat", MS_SILENT,… ENOENT
        test-trace-mount                         mount                            51158                 51158        1199 MS_SILENT            mount("/bar", "/foo", "fuseblk", MS_SILE… ENOENT
        ^C
        ```
    </TabItem>
</Tabs>

Finally, clean the system:

<Tabs groupId="env">
    <TabItem value="kubectl-gadget" label="kubectl gadget">
        ```bash
        $ kubectl delete pod mypod
        ```
    </TabItem>

    <TabItem value="ig" label="ig">
        ```bash
        $ docker rm -f test-trace-mount
        ```
    </TabItem>
</Tabs>
