lizrice

#!/usr/bin/python
from bcc import BPF
from time import sleep

# This outputs a count of how many times the clone and execve syscalls have been made
# showing the use of an eBPF map (called syscall). 

program = """
 BPF_HASH(syscall);