execsnoop(8)

1execsnoop(8)                System Manager's Manual               execsnoop(8)
2
3
4

NAME

6       execsnoop.bt  -  Trace  new  processes  via  exec() syscalls. Uses bpf‐
7       trace/eBPF.
8

SYNOPSIS

10       execsnoop.bt
11

DESCRIPTION

13       This traces when processes call exec()  (execve()).  It  is  handy  for
14       identifying  new  processes  created  via  the usual fork()->exec() se‐
15       quence. Note that the return value is  not  currently  traced,  so  the
16       exec() may have failed.
17
18       This  tool is useful for debugging shell scripts, including application
19       startup.  It is also useful for identifying a type of  performance  is‐
20       sue:  a  flood  of  short-lived  processes, that end quickly and aren't
21       readily visible in top(1).
22
23       Since this uses BPF, only the root user can use this tool.
24

REQUIREMENTS

26       CONFIG_BPF and bpftrace.
27

EXAMPLES

29       Trace all new processes calling execve():
30              # execsnoop.bt
31

FIELDS

33       TIME   Time of the exec() call, in milliseconds since program start.
34
35       PID    Process ID
36
37       ARGS   Process name and arguments (16 word maximum).
38

OVERHEAD

40       This traces the execve() tracepoint and prints output for  each  event.
41       As  the  rate  of  this  is generally expected to be low (< 100/s), the
42       overhead is also expected to be negligible. If you have an  application
43       that is spawning a high rate of new processes for a reason (large build
44       process), this could cause a small amount of overhead: test and  under‐
45       stand overhead before use.
46

SOURCE

48       This is from bpftrace.
49
50              https://github.com/iovisor/bpftrace
51
52       Also  look  in  the bpftrace distribution for a companion _examples.txt
53       file containing example usage, output, and commentary for this tool.
54
55       This is a bpftrace version of the bcc tool of the same  name.  The  bcc
56       tool provides more fields and options to customize the output.
57
58              https://github.com/iovisor/bcc
59

OS

61       Linux
62

STABILITY

64       Unstable - in development.
65

AUTHOR

67       Brendan Gregg
68