extrace

extrace [options] [command]

extrace traces exec() system calls system-wide to monitor program execution on Linux. It captures every time a program is executed, displaying the command line, process hierarchy, and optionally the user, working directory, and environment variables.Unlike strace which traces individual processes, extrace monitors all execution activity on the system or within a specific process tree. It's particularly useful for security auditing to detect suspicious process execution, debugging complex scripts that spawn multiple subprocesses, and understanding system behavior during package installations or automated tasks.The tool subscribes to the Linux kernel's netlink process connector (requires CONFIG_CONNECTOR and CONFIG_PROC_EVENTS) to receive exec notifications, so it captures activity without attaching a debugger to each process.

-d

Print the working directory of each process

Print the process environment (or '-' if unreadable)

Flat output, without tree indentation

Resolve and show the full path of the executable

Quiet; suppress printing of exec() arguments

Print exit status and duration of each process

Display the user running each process

Write trace output to file

Trace only descendants of the given PID

Requires root privileges and a kernel built with the process connector enabled. Linux-only. May impact system performance when tracing heavily.

strace(1), ltrace(1), auditd(8)

Source code