carta

execsnoop-bpfcc(8) on Linux

The text 03b132e5b146, as Debian 11 (Bullseye) shipped it.

Trace new processes via exec() syscalls. Uses Linux eBPF/bcc.

Flags it lists

execsnoop-bpfcc(8) on Linux now