| Server IP : 104.21.93.65 / Your IP : 104.23.197.33 Web Server : Apache System : Linux server.localhost.com 6.8.0-85-generic #85-Ubuntu SMP PREEMPT_DYNAMIC Thu Sep 18 15:26:59 UTC 2025 x86_64 User : pahana ( 1029) PHP Version : 7.4.33 Disable Function : pcntl_alarm,pcntl_fork,pcntl_waitpid,pcntl_wait,pcntl_wifexited,pcntl_wifstopped,pcntl_wifsignaled,pcntl_wifcontinued,pcntl_wexitstatus,pcntl_wtermsig,pcntl_wstopsig,pcntl_signal,pcntl_signal_get_handler,pcntl_signal_dispatch,pcntl_get_last_error,pcntl_strerror,pcntl_sigprocmask,pcntl_sigwaitinfo,pcntl_sigtimedwait,pcntl_exec,pcntl_getpriority,pcntl_setpriority,pcntl_async_signals,pcntl_unshare, MySQL : OFF | cURL : ON | WGET : ON | Perl : ON | Python : OFF | Sudo : ON | Pkexec : OFF Directory : /proc/thread-self/root/sbin/ |
Upload File : |
#!/usr/bin/env bpftrace
/*
* execsnoop.bt Trace new processes via exec() syscalls.
* For Linux, uses bpftrace and eBPF.
*
* This traces when processes call exec(). It is handy for identifying new
* processes created via the usual fork()->exec() sequence. Note that the
* return value is not currently traced, so the exec() may have failed.
*
* TODO: switch to tracepoints args. Support more args. Include retval.
*
* This is a bpftrace version of the bcc tool of the same name.
*
* 15-Nov-2017 Brendan Gregg Created this.
* 11-Sep-2018 " " Switched to use join().
*/
#ifndef BPFTRACE_HAVE_BTF
#include <linux/sched.h>
#endif
BEGIN
{
printf("%-15s %-7s %-7s %s\n", "TIME", "PID", "PPID", "ARGS");
}
tracepoint:syscalls:sys_enter_exec*
{
$task = (struct task_struct *)curtask;
printf("%15s %-7d %-7d ", strftime("%H:%M:%S.%f", nsecs), pid, $task->real_parent->pid);
join(args.argv);
}