Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

I am trying to find how to log a specific instantiation of rrdtool to see whether the path it is receiving is incorrect.

I know I could wrap the executable in a shell script that would log the parameters, but I was wondering if there was a more kernel-specific way to monitor for that, perhaps a filesystem callback that sees when a particular /proc/pid/exe matches a given binary?

share|improve this question

2 Answers 2

up vote 6 down vote accepted

Yes, there is a kernel facility: the audit subsystem. The auditd daemon does the logging, and the command auditctl sets up the logging rules. You can log all calls to a specific system alls, with some filtering. If you want to log all commands executed and their arguments, log the execve system call:

auditctl -a exit,always -S execve

To specifically trace the invocation of a specific program, add a filter on the program executable:

auditctl -a exit,always -S execve -F path=/usr/bin/rrdtool

The logs show up in /var/log/audit.log, or wherever your distribution puts them. You need to be root to control the audit subsystem.

For debugging purposes, replacing the program by a wrapper script gives you more flexibility to log things like the environment, information about the parent process, etc.

share|improve this answer
Why the -F path=/ust/bin/rrdtool? I don't get how rrdtool is even related software. –  Graeme Feb 27 at 12:28
@Graeme The problem described in the question was tracking an invocation of rrdtool. If you want to log invocations of all programs, drop the -F path=… part (you'll get a lot of logs of course). –  Gilles Feb 27 at 12:37
Right... first line of the question. Thanks. –  Graeme Feb 27 at 12:40

You could use snoopy.

Snoopy is more lightweight solution as it does not need kernel cooperation. All that is needed is dynamic loader (dl) that preloads snoopy library, path to which is specified in /etc/ld.so.preload.

Disclosure: I am current snoopy maintainer.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.