execsnoop(8)

✨ execsnoop — the whole vibe 💅

okay so bestie, we're in the System Manager's Manual section, page execsnoop(8), and this little icon is about tracing exec() calls with arguments, using Linux ftrace. no cap. let's get into it 🫶

---

🌸 NAME 🌸

execsnoop — trace process exec() with arguments. Uses Linux ftrace.

---

🎀 SYNOPSIS 🎀

execsnoop [-hrt] [-a argc] [-d secs] [name]

---

🦋 DESCRIPTION 🦋

So execsnoop traces process execution, and it shows you the PID, the PPID, and the argument details if it possibly can. it's giving detective energy 🔍

It traces exec() from the fork()->exec() sequence, which means — heads up — it won't catch new processes that only fork(). like, if you never exec, this tool literally cannot see you, sorry babe. ✋ With the -r option though, it will also catch processes that re-exec. it makes a best-effort attempt to retrieve the program arguments and PPID; if those aren't available, 0 and "[?]" get printed respectively. there's also a limit on how many arguments get printed (default is 8), and you can bump that up with -a.

This implementation is designed to work on older kernel versions, and without kernel debuginfo. how does it do it?? it works by dynamic tracing an execve kernel function to read the arguments from the %si register. stub_execve() gets tried first, then do_execve(). The sched:sched_process_fork tracepoint is what handles the PPID. and now the serious part: tracing registers and kernel functions is an unstable technique, and this tool may not work for some kernels or platforms. 😭

This program is a workaround that should be improved in the future when other kernel capabilities are made available. If you need a more reliable tool right now, consider other tracing alternatives (eg, SystemTap). fr fr, this tool is really a proof of concept to see what ftrace can currently do.

And because it uses ftrace: only the root user can use this tool. sorry to the non-root girlies 💜

---

🧚 REQUIREMENTS 🧚

• FTRACE and KPROBE CONFIG
• the sched:sched_process_fork tracepoint
• either the stub_execve() or do_execve() kernel function

You may already have these on recent kernels. And also: awk. yes bestie, awk is part of the squad, don't forget her 🍓

---

💖 OPTIONS 💖

• -a argc — Maximum number of arguments to show. The default is 8, and the maximum allowed is 16. If execsnoop thinks it has truncated the argument list, an ellipsis "[...]" will be shown. 👀
• -d seconds — Duration to trace, in seconds. This also uses in-kernel buffering. ✨
• -h — Print usage message.
• -r — Include re-exec()s.
• -t — Include timestamps in units of seconds. ⏱️
• name — Only show processes that match this name. Partials and regular expressions are allowed, as this is filtered in user space by awk. so yes, you can be as picky as you want 💅

---

🌈 EXAMPLES 🌈

Trace all new processes and arguments (if possible):

# execsnoop

Trace all new process names containing the text "http":

# execsnoop http

---

⭐ FIELDS ⭐

• TIMEs — Time of the exec(), in seconds.
• PID — Process ID.
• PPID — Parent process ID, if this was able to be read. If it wasn't, 0 is printed.
• ARGS — Command line arguments, if these were able to be read. If they aren't able to be read, "[?]" is printed (which would be due to a limitation in this tools implementation, since this is workaround for older kernels; if you need reliable argument tracing, use a different tracer). They will be truncated to the argc limit, and an ellipsis "[...]" may be printed if execsnoop is aware of the truncation. 😭

---

🔥 OVERHEAD 🔥

This reads and processes exec() events in user space as they occur. Since the rate of exec() is expected to be low (< 500/s), the overhead is expected to be small or negligible. so like, chill. your CPU is fine 💆

---

🫶 SOURCE 🫶

This is from the perf-tools collection.

https://github.com/brendangregg/perf-tools

Also look under the examples directory for a text file containing example usage, output, and commentary for this tool. it's got the receipts 📁✨

---

👑 OS 👑

Linux 🐧

---

💀 STABILITY 💀

Unstable — in development. she's still growing, be nice 🙈

---

🌸 AUTHOR 🌸

Brendan Gregg

---

🦋 SEE ALSO 🦋

top(1)

---

and that's the whole thing bestie, you ate 💅 this page is execsnoop(8) from USER COMMANDS, dated 2014-07-07, and honestly? iconic. go trace something, but remember — root only, no cap 🎀✨💖