MongoDB中文手册

mongosniff提供了对数据库实时活动的低级别操作跟踪和嗅探视图。可以将mongosniff认为是专为MongoDB定制的，类似于tcpdump用于TCP/IP网络流量分析。mongosniff常用于驱动开发。

注意：mongosniff需要libpcap，并且只对类Unix系统可用。

相对于mongosniff，Wireshark，一个流行的网络嗅探工具，可用于侦测和解析MongoDB线协议。

---

用法

下面的命令连接到运行在localhost的27017和27018上的mongod或mongos：

mongosniff --source NET lo 27017 27018

下面的命令只记录运行在localhost的27018上的mongod或mongos的无效的BSON对象，用于驱动开发和问题跟踪：

mongosniff --objcheck --source NET lo 27018

---

实践

[root@test ~]# mongosniff --help    
mongosniff: error while loading shared libraries: libpcap.so.0.9: cannot open shared object file: No such file or directory

[root@test ~]# which mongosniff   
/usr/bin/mongosniff

[root@test ~]# ldd /usr/bin/mongosniff   
        linux-vdso.so.1 =>  (0x00007fffe2d7a000)    
        libpthread.so.0 => /lib64/libpthread.so.0 (0x0000003558e00000)    
        librt.so.1 => /lib64/librt.so.1 (0x0000003559200000)    
        libpcap.so.0.9 => not found    
        libstdc++.so.6 => /usr/lib64/libstdc++.so.6 (0x0000003559e00000)    
        libm.so.6 => /lib64/libm.so.6 (0x0000003559600000)    
        libgcc_s.so.1 => /lib64/libgcc_s.so.1 (0x000000355a600000)    
        libc.so.6 => /lib64/libc.so.6 (0x0000003558a00000)    
        /lib64/ld-linux-x86-64.so.2 (0x0000003558200000)

可以看出libpcap.so.0.9 => not found并没有找到。

[root@test ~]# cd /usr/lib64   
[root@test lib64]# ls -al | grep libpcap    
lrwxrwxrwx.  1 root root      16 Feb 26 17:28 libpcap.so.1 -> libpcap.so.1.4.0    
-rwxr-xr-x   1 root root  260880 Nov 22  2013 libpcap.so.1.4.0

添加软连接。

[root@test lib64]# ln -s /usr/lib64/libpcap.so.1.4.0 /usr/lib64/libpcap.so.0.9

再次查看帮助。

[root@test lib64]# mongosniff --help   
Usage: mongosniff [--help] [--forward host:port] [--source (NET  | (FILE | DIAGLOG) )] [  ... ]    
--forward       Forward all parsed request messages to mongod instance at     
                specified host:port    
--source        Source of traffic to sniff, either a network interface or a    
                file containing previously captured packets in pcap format,    
                or a file containing output from mongod's --diaglog option.    
                If no source is specified, mongosniff will attempt to sniff    
                from one of the machine's network interfaces.    
--objcheck      Log hex representation of invalid BSON objects and nothing    
                else.  Spurious messages about invalid objects may result    
                when there are dropped tcp packets.    
...      These parameters are used to filter sniffing.  By default,     
                only port 27017 is sniffed.    
--help          Print this help message.

抓包：

[root@test lib64]# /usr/bin/mongosniff --source NET bond0 > /var/log/currentOp/sniff.log

下面是sniff.log中的部分内容：

10.10.0.1:55553  -->> 10.10.0.2:27017 MyTest.Pro  1042 bytes  id:41d99     269721    
        query: { $query: { id: { $in: [ 380, 383 ] }, Availability.Status: { $lt: 5 }, $or: [ { id: { $lt: 331 } }, { id: { $gt: 200, $lt: 400 } }, { id: { $gt: 600, $lt: 800 } } ] }, $orderby: { Availability.Status: 1 } }  ntoreturn: 0 ntoskip: 0 hasfields SlaveOk

MongoDB中文手册