From 63ee981b6b6f81cdd7bbad31a938b52e401c1548 Mon Sep 17 00:00:00 2001
From: grothedev <grothedev@gmail.com>
Date: Thu, 20 Mar 2025 22:24:06 -0500
Subject: more bpftrace prOGROMs

---
 bpftrace-execve       | 1 +
 bpftrace-execve-2args | 1 +
 2 files changed, 2 insertions(+)
 create mode 100644 bpftrace-execve
 create mode 100644 bpftrace-execve-2args

diff --git a/bpftrace-execve b/bpftrace-execve
new file mode 100644
index 0000000..983aa76
--- /dev/null
+++ b/bpftrace-execve
@@ -0,0 +1 @@
+sudo bpftrace -e 'tracepoint:syscalls:sys_enter_execve { printf("PID: %d, UID: %d, CMD: %s, TIME: %u, FILE: %s\n", pid,  uid, comm, nsecs, str(args->filename)); }'
diff --git a/bpftrace-execve-2args b/bpftrace-execve-2args
new file mode 100644
index 0000000..aa6d3b8
--- /dev/null
+++ b/bpftrace-execve-2args
@@ -0,0 +1 @@
+sudo bpftrace -e 'tracepoint:syscalls:sys_enter_execve { printf("PID: %d, UID: %d, CMD: %s, TIME: %u, FILE: %s, ARGS: %s %s\n", pid,  uid, comm, nsecs, str(args->filename), str(args->argv[1]), str(args->argv[2]) ); }'
-- 
cgit v1.2.3