execsnoop(8)

✨ execsnoop(8) ✨

---

💖 NAME 💖

execsnoop is a tracer for new processes, using exec() syscalls. It runs on Linux eBPF/bcc. ✨

🧚 SYNOPSIS 🧚

execsnoop [-h] [-T] [-t] [-x] [--cgroupmap CGROUPMAP] [--mntnsmap MAPPATH] [-u USER] [-q] [-n NAME] [-l LINE] [-U] [--max-args MAX_ARGS]

🦋 DESCRIPTION 🦋

okay so execsnoop traces new processes and shows you the filename being executed plus the argument list. iykyk 🫶

It works by tracing the execve() system call, which is the most common exec() variant. This catches new processes that follow the fork->exec sequence, and processes that re-exec() themselves. Some apps will fork() without exec()ing, like worker processes, and those won't show up in the execsnoop output 🙈

It works by tracing the kernel sys_execve() function using dynamic tracing, so it'll need updating to match any changes to that function. bestie, keep that in mind 💀

Since this uses BPF, only the root user can use this tool. No exceptions, no vibes-based workarounds 🔥

🎀 REQUIREMENTS 🎀

You'll need CONFIG_BPF and bcc. ✨

💅 OPTIONS 💅

• -h — Prints the usage message. Your lifeline when you forget the flags 🍓
• -T — Adds a time column in HH:MM:SS format ⏰
• -U — Adds the UID column 🆔
• -t — Adds a timestamp column ✨
• -u USER — Filters by UID or username 👑
• -x — Also includes failed exec()s, the ones that didn't go through 💀
• -q — Wraps arguments in "quotemarks" and escapes any quotemarks inside them with a backslash. This is the move for tracing empty arguments or arguments with whitespace in them 🎀
• -n NAME — Only prints command lines matching this name, using a regex 🔍
• -l LINE — Only prints commands where an argument contains this line, using a regex 🧵
• --max-args MAXARGS — The max number of arguments parsed and displayed. Defaults to 20 🌸
• --cgroupmap MAPPATH — Traces only the cgroups in this BPF map. It's filtered in-kernel, so it's lowkey efficient 🌈
• --mntnsmap MAPPATH — Traces only the mount namespaces in this BPF map. Also filtered in-kernel 🧚
• -P PPID — Traces only this parent PID 🦋

🌈 EXAMPLES 🌈

Here are the vibes, bestie 💖

• Trace all exec() syscalls: # execsnoop
• Trace all exec() syscalls and include timestamps: # execsnoop -t
• Display the process UID: # execsnoop -U
• Trace only UID 1000: # execsnoop -u 1000
• Trace only processes launched by root and display the UID column: # execsnoop -Uu root
• Include failed exec()s: # execsnoop -x
• Put quotemarks around arguments: # execsnoop -q
• Only trace exec()s where the filename contains "mount": # execsnoop -n mount
• Only trace exec()s where an argument's line contains "testpkg": # execsnoop -l testpkg
• Trace a set of cgroups only (check special_filtering.md from the bcc sources for more details): # execsnoop --cgroupmap /sys/fs/bpf/test01

📋 FIELDS 📋

• TIME — When the exec() returned, in HH:MM:SS format ⏰
• TIME(s) — When the exec() returned, in seconds ⏳
• UID — The user ID 🆔
• PCOMM — The parent process or command name 👯
• PID — The process ID 🪪
• PPID — The parent process ID 👑
• RET — The return value of exec(). 0 means success! Failures only show up when you use the -x option 💅
• ARGS — The filename for the exec(), followed by up to 19 arguments. An ellipsis ... shows up if the argument list is known to be truncated 🫣

🔥 OVERHEAD 🔥

This traces the kernel execve function and prints output for every event. The rate is usually expected to be low (< 1000/s), so the overhead should be negligible. But if your app is calling exec() at a high rate, test it and understand the overhead before you use this tool. Don't be the girl who tanks prod 💀

🌸 SOURCE 🌸

This is from bcc, found at:

https://github.com/iovisor/bcc

Also check the bcc distribution for a companion _examples.txt file. It has example usage, output, and commentary for this tool 📚

🍓 OS 🍓

Linux 🐧

🫧 STABILITY 🫧

Unstable, still in development 🚧

💜 AUTHOR 💜

Brendan Gregg, Rocky Xing 👩‍💻

🦋 SEE ALSO 🦋

opensnoop(1) 👀

---

Bye bestie 🫶 This page is from USER COMMANDS, dated 2020-02-20, and it's all about execsnoop(8) 💖✨