execsnoop.bt(8)

📦 version 0.17.0, in debian bookworm

💖 execsnoop.bt — bestie's guide to watching new processes be born 💖

okay so this is the execsnoop.bt page from section 8 of the System Manager's Manual, and it's literally about tracing brand-new processes through exec() syscalls using bpftrace/eBPF. sit down, grab a strawberry 🍓, we're doing kernel things.

✨ NAME ✨

execsnoop.bt — trace new processes via exec() syscalls. uses bpftrace/eBPF. no cap. 👑

✨ SYNOPSIS ✨

execsnoop.bt

that's it bestie. no flags, no arguments, just vibes and root privileges.

✨ DESCRIPTION ✨

so what this does is it traces when processes call exec() — that's execve() if we're being precise, and we ARE 💅. it's handy for identifying new processes created via the usual fork()->exec() sequence. the classic combo, the main character arc of process creation, periodt.

⚠️ lowkey important: the return value is not currently traced, so the exec() may have failed. so like, don't come for this tool when it shows you a process that didn't actually make it. it's giving "saw the attempt," not "saw the outcome." 🙈

this tool is useful for debugging shell scripts, including application startup. like when your script is doing Something and you're just staring at it like 👁️👄👁️ — this shows you what's actually exec'ing.

it's ALSO useful for identifying a type of performance issue: a flood of short-lived processes, that end quickly and aren't readily visible in top(1). you know the ones. they blink in and out of existence so fast that top(1) is like "who? never met her." those little ghost processes. this catches them. 🦋

🔥 real talk: since this uses BPF, only the root user can use this tool. that's not a vibe check you can skip, bestie.

✨ REQUIREMENTS ✨

  • CONFIG_BPF
  • bpftrace

both or it's a no. 🫶

✨ EXAMPLES ✨

trace ALL new processes calling execve():

# execsnoop.bt

that's the whole thing. that's the example. iconic behavior honestly. ✨

✨ FIELDS ✨

here's what you're looking at in the output, one by one:

  • TIME — time of the exec() call, in milliseconds since program start. so like, milliseconds since the program started, not wall clock. important distinction, iykyk.
  • PID — process ID. the whole point. 🎀
  • ARGS — process name and arguments. and heads up, it's a 16 word maximum. so if your command line is a whole novel, you're getting the first 16 words and that's the tea. 😭

✨ OVERHEAD ✨

okay so this traces the execve() tracepoint and prints output for each event. every single one. and as the rate of this is generally expected to be low (< 100/s), the overhead is also expected to be negligible. slay, we love a cheap trace. 💅

BUT. if you have an application that is spawning a high rate of new processes for a reason — large build process energy — this could cause a small amount of overhead.

🫶 friendly reminder from the manpage itself: test and understand overhead before use. don't just yolo it on prod, bestie, i'm begging.

✨ SOURCE ✨

this is from bpftrace.

https://github.com/iovisor/bpftrace

also, look in the bpftrace distribution for a companion _examples.txt file containing example usage, output, and commentary for this tool. it's got the lore. 📖

this is a bpftrace version of the bcc</bcc> tool of the same name. and fun fact: the bcc tool provides more fields and options to customize the output. so if you want the deluxe edition, that's where it's at.

https://github.com/iovisor/bcc

✨ OS ✨

Linux 🌈 (obviously, it's eBPF, where else would it be)

✨ STABILITY ✨

💀 Unstable - in development.

it's giving "we're still cooking." use accordingly. 🍓

✨ AUTHOR ✨

Brendan Gregg 👑

✨ SEE ALSO ✨

  • opensnoop.bt(8) — the sibling. the bestie of this tool. go read it too. 🦋

and that's the whole page, you're fully caught up ✨ this was a USER COMMANDS entry from 2018-09-11, brought to you by your local eBPF girlie — go trace something, you got this 💖🎀💅

📦 where this page comes from