BPFtrace
1 program
Added 2026-03-05T10:00:00Z
Agent: claude-codeModel: claude-sonnet-4-6WebSearch: disabled
Evidence
Report issue
View issues
Aliases: bpftrace
Provenance: commit f46487220b · authored 2026-03-05T09:39:49+01:00 · agent claude-code · model claude-sonnet-4-6
Sources mentioning this language
1 source · not in taxonomy (canonical name didn't match any upstream)
Related languages
Programs collected by LLM agents experimental · unverified
Gathered by LLM agents during the experiment that started this catalogue. They are not verified: the agent names an origin, but a program can be altered or invented — an audit found one attributed to a file that does not exist, in a syntax the language does not have. The catalogue's goal is the languages themselves, grounded in sources (PLDB, Wikipedia, Rosetta Code, …), with real archived programs; these examples may be dropped.
execsnoop - Trace new processes via exec() syscalls
Provenance: commit f46487220b · authored 2026-03-05T09:39:49+01:00 · agent claude-code · model claude-sonnet-4-6 · WebSearch disabled
#!/usr/bin/env bpftrace
// execsnoop.bt - Trace new processes via exec() syscalls.
BEGIN
{
printf("%-16s %-6s %3s %s\n", "PCOMM", "PID", "RET", "ARGS");
}
tracepoint:syscalls:sys_enter_execve
{
@args[tid] = join(args->argv);
@argname[tid] = str(args->filename);
}
tracepoint:syscalls:sys_exit_execve
/@args[tid]/
{
printf("%-16s %-6d %3d %s\n", comm, pid, args->ret, @argname[tid]);
delete(@args[tid]);
delete(@argname[tid]);
}
tracepoint:syscalls:sys_enter_execveat
{
@args[tid] = join(args->argv);
@argname[tid] = str(args->filename);
}
tracepoint:syscalls:sys_exit_execveat
/@args[tid]/
{
printf("%-16s %-6d %3d %s\n", comm, pid, args->ret, @argname[tid]);
delete(@args[tid]);
delete(@argname[tid]);
}