File: execsnoop.ply

package info (click to toggle)
ply-probe 2.4.0-1
  • links: PTS, VCS
  • area: main
  • in suites: forky, sid, trixie
  • size: 892 kB
  • sloc: ansic: 10,301; makefile: 202; sh: 183; yacc: 174; python: 89; lex: 87
file content (9 lines) | stat: -rw-r--r-- 145 bytes parent folder | download 
1
2
3
4
5
6
7
8
9
 
#!/sbin/ply

kprobe:SyS_execve {
	execs[kpid] = str(arg0, 48);
}

kretprobe:SyS_execve {
	printf("(%4u) %v %3ld\n", uid, execs[kpid], retval);
}