execsnoop.bt(8)

✨ execsnoop.bt(8) — NAME ✨

okay so bestie, execsnoop.bt is a tool that traces new processes via exec() syscalls 🔍 and it runs on bpftrace/eBPF 💖

💅 SYNOPSIS 💅

execsnoop.bt

🌸 DESCRIPTION 🌸

okay so this traces when processes call exec() (execve()) 🦋 it's giving detective energy for spotting new processes born from the usual fork()->exec() sequence ✨ ngl the return value is not currently traced, so the exec() may have failed 💀

this tool is lowkey iconic for debugging shell scripts, including application startup 🎀 it's also super useful for spotting a performance issue: a flood of short-lived processes that end quickly and aren't readily visible in top(1) 🙈

since this uses BPF, only the root user can use this tool 👑

🧚 REQUIREMENTS 🧚

you need CONFIG_BPF and bpftrace 💜

🍓 EXAMPLES 🍓

Trace all new processes calling execve():

# execsnoop.bt

🔥 FIELDS 🔥

• TIME — time of the exec() call, in milliseconds since program start ⏰
• PID — process ID 🫶
• PPID — parent process ID 👪
• ARGS — process name and arguments (16 word maximum) 📝

🌈 OVERHEAD 🌈

this traces the execve() tracepoint and prints output for each event 💅 the rate is generally expected to be low (< 100/s), so the overhead is also expected to be negligible ✨ but if you have an application spawning a high rate of new processes for a reason (large build process), this could cause a small amount of overhead, so test and understand overhead before use 🙈

🦋 SOURCE 🦋

this is from bpftrace 🩷

https://github.com/bpftrace/bpftrace

also look in the bpftrace distribution for a companion _examples.txt file with example usage, output, and commentary for this tool 📚

this is a bpftrace version of the bcc tool of the same name 💖 the bcc tool provides more fields and options to customize the output 🎀

https://github.com/iovisor/bcc

💻 OS 💻

Linux 🐧

🥺 STABILITY 🥺

Unstable - in development. 🚧

👑 AUTHOR 👑

Brendan Gregg 🫶

🔗 SEE ALSO 🔗

• opensnoop.bt(8) ✨

---

USER COMMANDS · 2018-09-11 · execsnoop.bt(8) 💜 bestie, that's the whole tea, now go trace those processes, periodt! 💅🌸