MOUNTSNOOP-BPFCC(8) - manual page | Administration and privileged commands

Trace mount() and umount() syscalls. Uses Linux eBPF/bcc.