extrace

Trace exec() calls. More information: https://github.com/chneukirchen/extrace.

• Trace all program executions occurring on the system:

sudo extrace

• Run a command and only trace descendants of this command:

sudo extrace {{command}}

• Print the current working directory of each process:

sudo extrace -d

• Resolve the full path of each executable:

sudo extrace -l

• Display the user running each process:

sudo extrace -u