Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am trying to find how to log a specific instantiation of rrdtool to see whether the path it is receiving is incorrect.

I know I could wrap the executable in a shell script that would log the parameters, but I was wondering if there was a more kernel-specific way to monitor for that, perhaps a filesystem callback that sees when a particular /proc/pid/exe matches a given binary?

share|improve this question
Is there a way to get auditd to record the command-line arguments as well as the program ran? serverfault.com/questions/765179/… – Neil Mar 21 at 22:34
up vote 8 down vote accepted

Yes, there is a kernel facility: the audit subsystem. The auditd daemon does the logging, and the command auditctl sets up the logging rules. You can log all calls to a specific system alls, with some filtering. If you want to log all commands executed and their arguments, log the execve system call:

auditctl -a exit,always -S execve

To specifically trace the invocation of a specific program, add a filter on the program executable:

auditctl -a exit,always -S execve -F path=/usr/bin/rrdtool

The logs show up in /var/log/audit.log, or wherever your distribution puts them. You need to be root to control the audit subsystem.

For debugging purposes, replacing the program by a wrapper script gives you more flexibility to log things like the environment, information about the parent process, etc.

share|improve this answer
Why the -F path=/ust/bin/rrdtool? I don't get how rrdtool is even related software. – Graeme Feb 27 '14 at 12:28
@Graeme The problem described in the question was tracking an invocation of rrdtool. If you want to log invocations of all programs, drop the -F path=… part (you'll get a lot of logs of course). – Gilles Feb 27 '14 at 12:37
Right... first line of the question. Thanks. – Graeme Feb 27 '14 at 12:40

You could use snoopy.

Snoopy is more lightweight solution as it does not need kernel cooperation. All that is needed is dynamic loader (dl) that preloads snoopy library, path to which is specified in /etc/ld.so.preload.

Disclosure: I am current snoopy maintainer.

share|improve this answer
Is it possible to do logging for commands directly or indirectly spawned from a particular shell only? – r.v Apr 10 '15 at 21:03
I am not sure I understand your question - do you mean "shell" as specific program that is used as shell (bash, dash, zsh etc.), or you mean you would like to log just specific PTY? Snoopy provides filtering framework, but currently only a couple of very basic filters are implemented, see here for the list: link. If you have a concrete usecase that might be applicable to others, please do explain in feature request, and, oh, btw, patches are welcome :) – Bostjan Skufca Apr 15 '15 at 16:33
I meant just a specific PTY. – r.v Apr 15 '15 at 16:46
There is no specific filter for PTY available ATM. However, you could use snoopy to log everything, including which PTY the event occured on, and then do the filtering in your syslog daemon. I do not know which one you are using, but syslog-ng (for example) can do regex matching, positive or negative. – Bostjan Skufca Apr 15 '15 at 17:12
Sure, thanks! The tool and the approach is in general quite useful. I can easily do some filtering to get what I need. – r.v Apr 15 '15 at 17:41

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.