2

I need to log the process start events with the command line arguments. There's ps au which prints the command line for the processes which are currently running. There's execsnoop which prints the log of process start events, but it prints only process names.

How can I have execsnoop log with the command line arguments in it?

p.s. there must be some way to do this through writing D script for dtrace, but I'm not skilled enough to do it :(

Improve this question
3
  • The Linux version does it: see here for example. Even the help seems to say so. Are you sure you are not executing it with -a 0 or something similar? Check here if you can find a version that may run on your computer...
    – Hastur
    Apr 9, 2019 at 11:23
  • yet MacOs version of exescoop doesn't print the command line :(
    – user3092609
    Apr 10, 2019 at 11:13
  • Did you tried to download the source file .tar.gz and compile for your OS?
    – Hastur
    Apr 10, 2019 at 12:41

1 Answer 1

Reset to default
1

I believe that this should work for a certain number of arguments: sudo dtrace /usr/bin/newproc.d

You will need to turn off System Integrity Protection for this to work.

Improve this answer
2
  • dtrace: no probes specified - it's MacOS Mojave 10.14.6
    – user3092609
    Oct 16, 2019 at 8:40
  • 2
    I think this is missing -s. sudo dtrace -s /usr/bin/newproc.d works for me.
    – user118435
    Mar 31, 2020 at 4:42

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.