Sign up ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems. It's 100% free, no registration required.

I am trying to find how to log a specific instantiation of rrdtool to see whether the path it is receiving is incorrect.

I know I could wrap the executable in a shell script that would log the parameters, but I was wondering if there was a more kernel-specific way to monitor for that, perhaps a filesystem callback that sees when a particular /proc/pid/exe matches a given binary?

share|improve this question

2 Answers 2

up vote 8 down vote accepted

Yes, there is a kernel facility: the audit subsystem. The auditd daemon does the logging, and the command auditctl sets up the logging rules. You can log all calls to a specific system alls, with some filtering. If you want to log all commands executed and their arguments, log the execve system call:

auditctl -a exit,always -S execve

To specifically trace the invocation of a specific program, add a filter on the program executable:

auditctl -a exit,always -S execve -F path=/usr/bin/rrdtool

The logs show up in /var/log/audit.log, or wherever your distribution puts them. You need to be root to control the audit subsystem.

For debugging purposes, replacing the program by a wrapper script gives you more flexibility to log things like the environment, information about the parent process, etc.

share|improve this answer
Why the -F path=/ust/bin/rrdtool? I don't get how rrdtool is even related software. – Graeme Feb 27 '14 at 12:28
@Graeme The problem described in the question was tracking an invocation of rrdtool. If you want to log invocations of all programs, drop the -F path=… part (you'll get a lot of logs of course). – Gilles Feb 27 '14 at 12:37
Right... first line of the question. Thanks. – Graeme Feb 27 '14 at 12:40

You could use snoopy.

Snoopy is more lightweight solution as it does not need kernel cooperation. All that is needed is dynamic loader (dl) that preloads snoopy library, path to which is specified in /etc/

Disclosure: I am current snoopy maintainer.

share|improve this answer
Is it possible to do logging for commands directly or indirectly spawned from a particular shell only? – r.v Apr 10 at 21:03
I am not sure I understand your question - do you mean "shell" as specific program that is used as shell (bash, dash, zsh etc.), or you mean you would like to log just specific PTY? Snoopy provides filtering framework, but currently only a couple of very basic filters are implemented, see here for the list: link. If you have a concrete usecase that might be applicable to others, please do explain in feature request, and, oh, btw, patches are welcome :) – Bostjan Skufca Apr 15 at 16:33
I meant just a specific PTY. – r.v Apr 15 at 16:46
There is no specific filter for PTY available ATM. However, you could use snoopy to log everything, including which PTY the event occured on, and then do the filtering in your syslog daemon. I do not know which one you are using, but syslog-ng (for example) can do regex matching, positive or negative. – Bostjan Skufca Apr 15 at 17:12
Sure, thanks! The tool and the approach is in general quite useful. I can easily do some filtering to get what I need. – r.v Apr 15 at 17:41

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.