ebpf 内核跟踪获取执行的所有指令

scan@scan-virtual-machine:~$ sudo bpftrace -e 'tracepoint:syscalls:sys_enter_execve,tracepoint:syscalls:sys_enter_execveat { printf("%-6d %-8s", pid, comm); join(args->argv);}'

scan@scan-virtual-machine:~$ sudo bpftrace -e 'tracepoint:syscalls:sys_enter_execve,tracepoint:syscalls:sys_enter_execveat { printf("%-6d %-8s", pid, comm); join(args->argv);}'
Attaching 2 probes...
3173   bash    uname -a
3175   bash    /usr/lib/command-not-found -- pd
3176   command-not-fou/usr/bin/snap advise-snap --format=json --command pd
3176   snap    /usr/bin/snap advise-snap --format=json --command pd
3189   bash    ls --color=auto