diff options
| author | grothedev <grothedev@gmail.com> | 2025-03-20 22:01:06 -0500 |
|---|---|---|
| committer | grothedev <grothedev@gmail.com> | 2025-03-20 22:01:06 -0500 |
| commit | 221e6f10eb345caa079014c48340d713ad05d9d7 (patch) | |
| tree | 3291f71c070c694aae8d68951a31147fdb39f696 | |
| parent | 387ea5c9e4a997d9ea114c6e6d955bce144a23d3 (diff) | |
simple bpftrace one-liner to get process that execve some binary, in this case ping
| -rwxr-xr-x | bpftrace-checkping | 1 |
1 files changed, 1 insertions, 0 deletions
diff --git a/bpftrace-checkping b/bpftrace-checkping new file mode 100755 index 0000000..2b99c7b --- /dev/null +++ b/bpftrace-checkping @@ -0,0 +1 @@ +sudo bpftrace -e 'tracepoint:syscalls:sys_enter_execve { $f = str(args->filename); if ($f == "/usr/bin/ping" || $f == "/bin/ping") { printf("PID %d (%s) executed ping\n", pid, comm); } }' |