execsnoop-nd_example.txt

Examples of execsnoop-nd.stp, the Linux SystemTap version.


Tracing while "man ls" was executed:

# ./execsnoop-nd.stp 
TIME                        UID   PPID    PID           COMM ARGS
Sat Jan 31 00:56:02 2015      0  11962  13472            man man ls
Sat Jan 31 00:56:02 2015      0  13472  13473             sh sh -c /usr/bin/gunzip -c /usr/share/man/man1/ls.1.gz
Sat Jan 31 00:56:02 2015      0  13472  13473         gunzip /bin/sh /usr/bin/gunzip -c /usr/share/man/man1/ls.1.gz
Sat Jan 31 00:56:02 2015      0  13472  13473           gzip gzip -d -c /usr/share/man/man1/ls.1.gz
Sat Jan 31 00:56:02 2015      0  13472  13474             sh sh -c /usr/bin/gunzip -c /usr/share/man/man1/ls.1.gz
Sat Jan 31 00:56:02 2015      0  13472  13474         gunzip /bin/sh /usr/bin/gunzip -c /usr/share/man/man1/ls.1.gz
Sat Jan 31 00:56:02 2015      0  13472  13474           gzip gzip -d -c /usr/share/man/man1/ls.1.gz
Sat Jan 31 00:56:02 2015      0  13472  13475             sh sh -c (cd "/usr/share/man" && (echo ".ll 15.5i"; echo ".nr LL 15.5i"; echo ".pl 1100i"; /usr/bin/gunzip -c '/usr/share/man/man1/ls.1.gz'; echo ".\\\""; echo ".pl \n(nlu+10") | /usr/bin/gtbl | /usr/bin/nroff -c -mandoc 2>/dev/null | /usr/bin/less -is)
Sat Jan 31 00:56:02 2015      0  13476  13479          nroff /bin/bash /usr/bin/nroff -c -mandoc
Sat Jan 31 00:56:02 2015      0  13476  13481           less /usr/bin/less -is
Sat Jan 31 00:56:02 2015      0  13476  13478           gtbl /usr/bin/gtbl
Sat Jan 31 00:56:02 2015      0  13477  13480         gunzip /bin/sh /usr/bin/gunzip -c /usr/share/man/man1/ls.1.gz
Sat Jan 31 00:56:02 2015      0  13477  13480           gzip gzip -d -c /usr/share/man/man1/ls.1.gz
Sat Jan 31 00:56:02 2015      0  13482  13483         locale locale charmap
Sat Jan 31 00:56:02 2015      0  13484  13485         mktemp mktemp /tmp/man.XXXXXX
Sat Jan 31 00:56:02 2015      0  13479  13486            cat cat
Sat Jan 31 00:56:02 2015      0  13479  13487          iconv iconv -f utf-8 -t utf-8 /tmp/man.OGU85G
Sat Jan 31 00:56:02 2015      0  13479  13488             rm rm -f /tmp/man.OGU85G
Sat Jan 31 00:56:02 2015      0  13476  13479          groff /usr/bin/groff -mtty-char -P-c -mandoc -Tutf8
Sat Jan 31 00:56:02 2015      0  13479  13489          troff troff -mtty-char -mandoc -Tutf8
Sat Jan 31 00:56:02 2015      0  13479  13490         grotty grotty -c

The output shows all the exec() syscall, which is a rough way to examine new
process execution. Some of these processes have called exec() more than once;
also, some new process that only fork() won't be seen.