The following is an example of execsnoop. As processes are executed their details are printed out. Another user was logged in running a few commands which can be viewed below, # ./execsnoop UID PID PPID ARGS 100 3008 2656 ls 100 3009 2656 ls -l 100 3010 2656 cat /etc/passwd 100 3011 2656 vi /etc/hosts 100 3012 2656 date 100 3013 2656 ls -l 100 3014 2656 ls 100 3015 2656 finger [...] In this example the command "man gzip" was executed. The output lets us see what the man command is actually doing, # ./execsnoop UID PID PPID ARGS 100 3064 2656 man gzip 100 3065 3064 sh -c cd /usr/share/man; tbl /usr/share/man/man1/gzip.1 |nroff -u0 -Tlp -man - 100 3067 3066 tbl /usr/share/man/man1/gzip.1 100 3068 3066 nroff -u0 -Tlp -man - 100 3066 3065 col -x 100 3069 3064 sh -c trap '' 1 15; /usr/bin/mv -f /tmp/mpoMaa_f /usr/share/man/cat1/gzip.1 2> 100 3070 3069 /usr/bin/mv -f /tmp/mpoMaa_f /usr/share/man/cat1/gzip.1 100 3071 3064 sh -c more -s /tmp/mpoMaa_f 100 3072 3071 more -s /tmp/mpoMaa_f ^C Execsnoop has other options, # ./execsnoop -h USAGE: execsnoop [-a|-A|-sv] [-c command] execsnoop # default output -a # print all data -A # dump all data, space delimited -s # include start time, us -v # include start time, string -c command # command name to snoop In particular the verbose option for human readable timestamps is very useful, # ./execsnoop -v STRTIME UID PID PPID ARGS 2005 Jan 22 00:07:22 0 23053 20933 date 2005 Jan 22 00:07:24 0 23054 20933 uname -a 2005 Jan 22 00:07:25 0 23055 20933 ls -latr 2005 Jan 22 00:07:27 0 23056 20933 df -k 2005 Jan 22 00:07:29 0 23057 20933 ps -ef 2005 Jan 22 00:07:29 0 23057 20933 ps -ef 2005 Jan 22 00:07:34 0 23058 20933 uptime 2005 Jan 22 00:07:34 0 23058 20933 uptime [...] It is also possible to match particular commands. Here we watch anyone using the vi command only, # ./execsnoop -vc vi STRTIME UID PID PPID ARGS 2005 Jan 22 00:10:33 0 23063 20933 vi /etc/passwd 2005 Jan 22 00:10:40 0 23064 20933 vi /etc/shadow 2005 Jan 22 00:10:51 0 23065 20933 vi /etc/group 2005 Jan 22 00:10:57 0 23066 20933 vi /.rhosts [...]