Features

tracexec supports many features, which will be explained in detail in this chapter.

At a high level, tracexec has two backends and several frontends. A backend collects exec events; a frontend decides how those events are presented or stored.

The default ptrace backend follows a command and its descendants. The eBPF backend can also trace execs across the whole system. Both feed the same event model.

Choose a frontend based on the job:

• Log prints events as they arrive and works well in a pipeline or CI log.
• TUI keeps an interactive event list next to the traced program’s terminal.
• Collect writes JSON, NDJSON, or a Perfetto trace for later analysis.

Filtering, privilege elevation, and most data-collection options are shared across frontends.

To save your preferred settings, see Configuration.