EXECSNOOP-BPFCC(8) - manual page | Administration and privileged commands

Trace new processes via exec() syscalls. Uses Linux eBPF/bcc.