|EXTRACE(1)||General Commands Manual||EXTRACE(1)|
extrace — trace
exec() calls system-wide
extrace traces all program executions
occurring on a system.
The options are as follows:
- Print the current working directory of the new process.
- Print environment of process, or ‘
-’ if unreadable.
- Generate flat output without indentation. By default, the line indentation reflects the process hierarchy.
- Resolve full path of the executable. By default,
- Suppress printing of exec(3) arguments.
- Also display process exit status and duration.
- Also display the user running the process.
- Redirect trace output to file.
- Only trace exec(3) calls descendant of pid.
- cmd ...
- Run cmd ... and only trace descendants of
By default, all exec(3) calls are traced globally.
extrace utility exits 0 on
success, and >0 if an error occurs.
Check these prerequisites if you see this error:
binding sk_nl error: Operation not permitted
extrace requires special permissions to
run, either root or the Linux
extrace only works on Linux kernels with
the kernel options
Leah Neukirchen <email@example.com>
May contain traces of code from Guillaume Thouvenin, Matt Helsley, and Sebastian Krahmer.
While process tracing is exact, looking up all information is inherently sensitive to race conditions. In doubt, you can only trust the PID was written correctly.
extrace is licensed under the terms of the
|June 19, 2018||Debian|