EXTRACE(1)

🌸 NAME 🌸

okay bestie, welcome to extrace(1) from the General Commands Manual — the iconic little tool that traces exec() calls system-wide. yes, literally all program executions on the system. main character energy fr fr. 💅

✨ SYNOPSIS ✨

extrace [-deflqQtu] [-o file] [-p pid | cmd ...]

💖 DESCRIPTION 💖

extrace traces all program executions occurring on a system. that’s the whole vibe check: every execution, tracked. 🦋

the options are as follows, bestie:

• -d — print the current working directory of the new process. cute little context clue.
• -e — print environment of process, or - if unreadable. if it’s unreadable, it literally says -, no cap.
• -f — generate flat output without indentation. by default, the line indentation reflects the process hierarchy. so -f is giving “no nesting drama.” ✨
• -l — resolve full path of the executable. by default, argv[0] is shown. so -l is the “give me the full government name” option.
• -q — suppress printing of exec(3) arguments. shhh 🤫
• -Q — suppress printing of runtime errors. also shhh, but for errors.
• -t — also display process exit status and duration. like a little report card for the process.
• -u — also display the user running the process. identity check 👑
• -o file — redirect trace output to file. take the receipts elsewhere.
• -p pid — only trace exec(3) calls descendant of pid. so you’re zooming in on that one process family tree.
• cmd ... — run cmd ... and only trace descendants of this command. by default, all exec(3) calls are traced globally. so without this, it’s everyone, everywhere, all at once. 😭

🫶 EXIT STATUS 🫶

the extrace utility exits 0 on success, and >0 if an error occurs. simple. clean. slay.

😭 ERRORS 😭

check these prerequisites if you see this error:

binding sk_nl error: Operation not permitted

extrace requires special permissions to run, either root or the Linux CAP_NET_ADMIN capability.

extrace only works on Linux kernels with the kernel options

CONFIG_CONNECTOR=y
CONFIG_PROC_EVENTS=y

bestie, if you’re seeing that error, this is your sign to check permissions and kernel vibes before spiraling. 💀

🦋 SEE ALSO 🦋

fatrace(1), ps(1), pwait(1), strace(1)

👑 AUTHORS 👑

Leah Neukirchen <leah@vuxu.org>

May contain traces of code from Guillaume Thouvenin, Matt Helsley, and Sebastian Krahmer.

💀 BUGS 💀

While process tracing is exact, looking up all information is inherently sensitive to race conditions. In doubt, you can only trust the PID was written correctly. ngl, that’s the honest tea. 🍓

🎀 LICENSE 🎀

extrace is licensed under the terms of the GPLv2.

---

mwah 💋 — source/version: Debian manual page · date: June 19, 2018. now go trace something iconic ✨