Scroll to navigation

execsnoop(8) System Manager's Manual execsnoop(8)


execsnoop - Trace new processes via exec() syscalls. Uses Linux eBPF/bcc.


execsnoop [-h] [-T] [-t] [-x] [--cgroupmap CGROUPMAP] [--mntnsmap MAPPATH] [-u USER] [-q] [-n NAME] [-l LINE] [-U] [--max-args MAX_ARGS]


execsnoop traces new processes, showing the filename executed and argument list.

It works by traces the execve() system call (commonly used exec() variant). This catches new processes that follow the fork->exec sequence, as well as processes that re-exec() themselves. Some applications fork() but do not exec(), eg, for worker processes, which won't be included in the execsnoop output.

This works by tracing the kernel sys_execve() function using dynamic tracing, and will need updating to match any changes to this function.

Since this uses BPF, only the root user can use this tool.


CONFIG_BPF and bcc.


Print usage message.
Include a time column (HH:MM:SS).
Include UID column.
Include a timestamp column.
Filter by UID (or username)
Include failed exec()s
Add "quotemarks" around arguments. Escape quotemarks in arguments with a backslash. For tracing empty arguments or arguments that contain whitespace.
Only print command lines matching this name (regex)
Only print commands where arg contains this line (regex)
Maximum number of arguments parsed and displayed, defaults to 20
Trace cgroups in this BPF map only (filtered in-kernel).
Trace mount namespaces in this BPF map only (filtered in-kernel).


# execsnoop
# execsnoop -t
# execsnoop -U
# execsnoop -u 1000
# execsnoop -Uu root
# execsnoop -x
# execsnoop -q
# execsnoop -n mount
# execsnoop -l testpkg
# execsnoop --cgroupmap /sys/fs/bpf/test01


Time of exec() return, in HH:MM:SS format.
Time of exec() return, in seconds.
User ID
Parent process/command name.
Process ID
Parent process ID
Return value of exec(). 0 == successs. Failures are only shown when using the -x option.
Filename for the exec(), followed be up to 19 arguments. An ellipsis "..." is shown if the argument list is known to be truncated.


This traces the kernel execve function and prints output for each event. As the rate of this is generally expected to be low (< 1000/s), the overhead is also expected to be negligible. If you have an application that is calling a high rate of exec()s, then test and understand overhead before use.


This is from bcc.

Also look in the bcc distribution for a companion _examples.txt file containing example usage, output, and commentary for this tool.




Unstable - in development.


Brendan Gregg



2020-02-20 USER COMMANDS