execsnoop(8)

1execsnoop(8)                System Manager's Manual               execsnoop(8)
2
3
4

NAME

6       execsnoop.bt  -  Trace  new  processes  via  exec() syscalls. Uses bpf‐
7       trace/eBPF.
8

SYNOPSIS

10       execsnoop.bt
11

DESCRIPTION

13       This traces when processes call exec()  (execve()).  It  is  handy  for
14       identifying   new   processes  created  via  the  usual  fork()->exec()
15       sequence. Note that the return value is not currently  traced,  so  the
16       exec() may have failed.
17
18       This  tool is useful for debugging shell scripts, including application
19       startup.  It is also useful  for  identifying  a  type  of  performance
20       issue:  a  flood  of short-lived processes, that end quickly and aren't
21       readily visible in top(1).
22
23       Since this uses BPF, only the root user can use this tool.
24

REQUIREMENTS

26       CONFIG_BPF and bpftrace.
27

EXAMPLES

29       Trace all new processes calling execve():
30              # execsnoop.bt
31

FIELDS

33       TIME   Time of the exec() call, in milliseconds since program start.
34
35       PID    Process ID
36
37       ARGS   Process name and arguments (16 word maximum).
38

OVERHEAD

40       This traces the execve() tracepoint and prints output for  each  event.
41       As  the  rate  of  this  is generally expected to be low (< 100/s), the
42       overhead is also expected to be negligible. If you have an  application
43       that is spawning a high rate of new processes for a reason (large build
44       process), this could cause a small amount of overhead: test and  under‐
45       stand overhead before use.
46

SOURCE

48       This is from bpftrace.
49
50              https://github.com/iovisor/bpftrace
51
52       Also  look  in  the bpftrace distribution for a companion _examples.txt
53       file containing example usage, output, and commentary for this tool.
54
55       This is a bpftrace version of the bcc tool of the same  name.  The  bcc
56       tool provides more fields and options to customize the output.
57
58              https://github.com/iovisor/bcc
59

OS

61       Linux
62

STABILITY

64       Unstable - in development.
65

AUTHOR

67       Brendan Gregg
68