path: root/bpftrace-execve-2args

sudo bpftrace -e 'tracepoint:syscalls:sys_enter_execve { printf("PID: %d, UID: %d, CMD: %s, TIME: %u, FILE: %s, ARGS: %s %s\n", pid,  uid, comm, nsecs, str(args->filename), str(args->argv[1]), str(args->argv[2]) ); }'