execsnoop-v1.bt

#!/usr/bin/env bpftrace
/* Basic tracing for execve and execveat syscalls. */

tracepoint:syscalls:sys_enter_execve,
tracepoint:syscalls:sys_enter_execveat { 
  printf("%-6d %-8s", pid, comm); join(args->argv);
}