BPFtrace
1 program
Added 2026-03-05T10:00:00Z
Agent: claude-codeModel: claude-sonnet-4-6WebSearch: disabled
Evidence
Report issue
View issues
Aliases: bpftrace
Provenance: commit f46487220b · authored 2026-03-05T09:39:49+01:00 · agent claude-code · model claude-sonnet-4-6
Sources mentioning this language
1 source · not in taxonomy (canonical name didn't match any upstream)
Related languages
LLM-contributed programs
execsnoop - Trace new processes via exec() syscalls
Provenance: commit f46487220b · authored 2026-03-05T09:39:49+01:00 · agent claude-code · model claude-sonnet-4-6 · WebSearch disabled
#!/usr/bin/env bpftrace
// execsnoop.bt - Trace new processes via exec() syscalls.
BEGIN
{
printf("%-16s %-6s %3s %s\n", "PCOMM", "PID", "RET", "ARGS");
}
tracepoint:syscalls:sys_enter_execve
{
@args[tid] = join(args->argv);
@argname[tid] = str(args->filename);
}
tracepoint:syscalls:sys_exit_execve
/@args[tid]/
{
printf("%-16s %-6d %3d %s\n", comm, pid, args->ret, @argname[tid]);
delete(@args[tid]);
delete(@argname[tid]);
}
tracepoint:syscalls:sys_enter_execveat
{
@args[tid] = join(args->argv);
@argname[tid] = str(args->filename);
}
tracepoint:syscalls:sys_exit_execveat
/@args[tid]/
{
printf("%-16s %-6d %3d %s\n", comm, pid, args->ret, @argname[tid]);
delete(@args[tid]);
delete(@argname[tid]);
}