1

I need to log the process start events with the command line arguments. There's ps au which prints the command line for the processes which are currently running. There's execsnoop which prints the log of process start events, but it prints only process names.

How can I have execsnoop log with the command line arguments in it?

p.s. there must be some way to do this through writing D script for dtrace, but I'm not skilled enough to do it :(

| improve this question | |
  • The Linux version does it: see here for example. Even the help seems to say so. Are you sure you are not executing it with -a 0 or something similar? Check here if you can find a version that may run on your computer... – Hastur Apr 9 '19 at 11:23
  • yet MacOs version of exescoop doesn't print the command line :( – user3092609 Apr 10 '19 at 11:13
  • Did you tried to download the source file .tar.gz and compile for your OS? – Hastur Apr 10 '19 at 12:41
0

I believe that this should work for a certain number of arguments: sudo dtrace /usr/bin/newproc.d

You will need to turn off System Integrity Protection for this to work.

| improve this answer | |
  • dtrace: no probes specified - it's MacOS Mojave 10.14.6 – user3092609 Oct 16 '19 at 8:40
  • I think this is missing -s. sudo dtrace -s /usr/bin/newproc.d works for me. – user118435 Mar 31 at 4:42

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.