execsnoop.bt

bt

#!/usr/bin/env bpftrace

#include <linux/sched.h>

BEGIN
{
    printf("Trace new processes via exec() syscalls. Hit Ctrl-C to end.\n");
}

tracepoint:syscalls:sys_enter_exec*
{
    printf("%s %-5d %-5d %s ---> %s ---> ", strftime("%Y-%m-%d %H:%M:%S", nsecs), pid, curtask->real_parent->pid, curtask->real_parent->comm, comm);
    join(args->argv);
}