JSON Export

We support two formats for JSON export.

• The json format exports the whole trace as a complete JSON.
• The json-stream format exports the trace as JSON messages separated by newlines. This format is also known as NDJSON when --pretty is not used.

Use --output <OUTPUT_FILE_PATH> to keep exporter data separate from output written by the traced command.

Warning

The output JSON may contain sensitive credentials that are passed in commandline arguments or environment variables. Sharing it may leak such credentials.

JSON Format

tracexec collect --format json --output trace.json -- env -C / ls

{"version":"0.17.0","generator":"tracexec_exporter_json","baseline":{"cwd":"/home/kxxt","env":{"HOME":"/home/kxxt","PATH":"/home/kxxt/.cargo/bin:/home/kxxt/mambaforge/bin:/home/kxxt/.nix-profile/bin:/nix/var/nix/profiles/default/bin:/usr/local/sbin:/usr/local/bin:/usr/bin:/opt/cuda/bin:/home/kxxt/.local/share/flatpak/exports/bin:/var/lib/flatpak/exports/bin:/usr/lib/jvm/default/bin:/usr/bin/site_perl:/usr/bin/vendor_perl:/usr/bin/core_perl:/usr/lib/rustup/bin","PWD":"/home/kxxt","SHLVL":"0","_":"/usr/bin/tracexec"},"fdinfo":{"0":{"fd":0,"path":"/dev/pts/4","pos":0,"flags":["O_RDWR"],"mnt_id":39,"ino":7,"mnt":"39 36 0:26 / /dev/pts rw,nosuid,noexec,relatime shared:4 - devpts devpts rw,gid=5,mode=600,ptmxmode=000","extra":[]},"1":{"fd":0,"path":"pipe:[202485]","pos":0,"flags":["O_WRONLY"],"mnt_id":16,"ino":202485,"mnt":"Not found. This is probably a pipe or something else.","extra":[]},"2":{"fd":0,"path":"pipe:[202485]","pos":0,"flags":["O_WRONLY"],"mnt_id":16,"ino":202485,"mnt":"Not found. This is probably a pipe or something else.","extra":[]}}},"events":[{"id":1,"pid":20417,"syscall":"execve","exec_pid":20417,"cwd":"/home/kxxt","comm_before_exec":"tracer","result":0,"filename":"/usr/bin/env","argv":{"result":"success","value":["env","-C","/","ls"]},"env":{"result":"success","value":{"has_added_or_modified_keys_starting_with_dash":false,"added":{},"removed":[],"modified":{}}},"fdinfo":{"0":{"fd":0,"path":"/dev/pts/4","pos":0,"flags":["O_RDWR"],"mnt_id":39,"ino":7,"mnt":"39 36 0:26 / /dev/pts rw,nosuid,noexec,relatime shared:4 - devpts devpts rw,gid=5,mode=600,ptmxmode=000","extra":[]},"1":{"fd":0,"path":"pipe:[202485]","pos":0,"flags":["O_WRONLY"],"mnt_id":16,"ino":202485,"mnt":"Not found. This is probably a pipe or something else.","extra":[]},"2":{"fd":0,"path":"pipe:[202485]","pos":0,"flags":["O_WRONLY"],"mnt_id":16,"ino":202485,"mnt":"Not found. This is probably a pipe or something else.","extra":[]}},"timestamp":1787669590103448326,"cred":{"result":"success","value":{"groups":[209,936,953,962,991,992,1000],"uid_real":1000,"uid_effective":1000,"uid_saved_set":1000,"uid_fs":1000,"gid_real":1000,"gid_effective":1000,"gid_saved_set":1000,"gid_fs":1000}},"cgroup":{"kind":"not-collected"}},{"id":2,"pid":20417,"syscall":"execve","exec_pid":20417,"cwd":"/","comm_before_exec":"env","result":-2,"filename":"/home/kxxt/.cargo/bin/ls","argv":{"result":"success","value":["ls"]},"env":{"result":"success","value":{"has_added_or_modified_keys_starting_with_dash":false,"added":{},"removed":[],"modified":{}}},"fdinfo":{"0":{"fd":0,"path":"/dev/pts/4","pos":0,"flags":["O_RDWR"],"mnt_id":39,"ino":7,"mnt":"39 36 0:26 / /dev/pts rw,nosuid,noexec,relatime shared:4 - devpts devpts rw,gid=5,mode=600,ptmxmode=000","extra":[]},"1":{"fd":0,"path":"pipe:[202485]","pos":0,"flags":["O_WRONLY"],"mnt_id":16,"ino":202485,"mnt":"Not found. This is probably a pipe or something else.","extra":[]},"2":{"fd":0,"path":"pipe:[202485]","pos":0,"flags":["O_WRONLY"],"mnt_id":16,"ino":202485,"mnt":"Not found. This is probably a pipe or something else.","extra":[]}},"timestamp":1787669590105681518,"cred":{"result":"success","value":{"groups":[209,936,953,962,991,992,1000],"uid_real":1000,"uid_effective":1000,"uid_saved_set":1000,"uid_fs":1000,"gid_real":1000,"gid_effective":1000,"gid_saved_set":1000,"gid_fs":1000}},"cgroup":{"kind":"not-collected"}},{"id":3,"pid":20417,"syscall":"execve","exec_pid":20417,"cwd":"/","comm_before_exec":"env","result":-2,"filename":"/home/kxxt/mambaforge/bin/ls","argv":{"result":"success","value":["ls"]},"env":{"result":"success","value":{"has_added_or_modified_keys_starting_with_dash":false,"added":{},"removed":[],"modified":{}}},"fdinfo":{"0":{"fd":0,"path":"/dev/pts/4","pos":0,"flags":["O_RDWR"],"mnt_id":39,"ino":7,"mnt":"39 36 0:26 / /dev/pts rw,nosuid,noexec,relatime shared:4 - devpts devpts rw,gid=5,mode=600,ptmxmode=000","extra":[]},"1":{"fd":0,"path":"pipe:[202485]","pos":0,"flags":["O_WRONLY"],"mnt_id":16,"ino":202485,"mnt":"Not found. This is probably a pipe or something else.","extra":[]},"2":{"fd":0,"path":"pipe:[202485]","pos":0,"flags":["O_WRONLY"],"mnt_id":16,"ino":202485,"mnt":"Not found. This is probably a pipe or something else.","extra":[]}},"timestamp":1787669590106807056,"cred":{"result":"success","value":{"groups":[209,936,953,962,991,992,1000],"uid_real":1000,"uid_effective":1000,"uid_saved_set":1000,"uid_fs":1000,"gid_real":1000,"gid_effective":1000,"gid_saved_set":1000,"gid_fs":1000}},"cgroup":{"kind":"not-collected"}},{"id":4,"pid":20417,"syscall":"execve","exec_pid":20417,"cwd":"/","comm_before_exec":"env","result":-2,"filename":"/home/kxxt/.nix-profile/bin/ls","argv":{"result":"success","value":["ls"]},"env":{"result":"success","value":{"has_added_or_modified_keys_starting_with_dash":false,"added":{},"removed":[],"modified":{}}},"fdinfo":{"0":{"fd":0,"path":"/dev/pts/4","pos":0,"flags":["O_RDWR"],"mnt_id":39,"ino":7,"mnt":"39 36 0:26 / /dev/pts rw,nosuid,noexec,relatime shared:4 - devpts devpts rw,gid=5,mode=600,ptmxmode=000","extra":[]},"1":{"fd":0,"path":"pipe:[202485]","pos":0,"flags":["O_WRONLY"],"mnt_id":16,"ino":202485,"mnt":"Not found. This is probably a pipe or something else.","extra":[]},"2":{"fd":0,"path":"pipe:[202485]","pos":0,"flags":["O_WRONLY"],"mnt_id":16,"ino":202485,"mnt":"Not found. This is probably a pipe or something else.","extra":[]}},"timestamp":1787669590107950785,"cred":{"result":"success","value":{"groups":[209,936,953,962,991,992,1000],"uid_real":1000,"uid_effective":1000,"uid_saved_set":1000,"uid_fs":1000,"gid_real":1000,"gid_effective":1000,"gid_saved_set":1000,"gid_fs":1000}},"cgroup":{"kind":"not-collected"}},{"id":5,"pid":20417,"syscall":"execve","exec_pid":20417,"cwd":"/","comm_before_exec":"env","result":-2,"filename":"/nix/var/nix/profiles/default/bin/ls","argv":{"result":"success","value":["ls"]},"env":{"result":"success","value":{"has_added_or_modified_keys_starting_with_dash":false,"added":{},"removed":[],"modified":{}}},"fdinfo":{"0":{"fd":0,"path":"/dev/pts/4","pos":0,"flags":["O_RDWR"],"mnt_id":39,"ino":7,"mnt":"39 36 0:26 / /dev/pts rw,nosuid,noexec,relatime shared:4 - devpts devpts rw,gid=5,mode=600,ptmxmode=000","extra":[]},"1":{"fd":0,"path":"pipe:[202485]","pos":0,"flags":["O_WRONLY"],"mnt_id":16,"ino":202485,"mnt":"Not found. This is probably a pipe or something else.","extra":[]},"2":{"fd":0,"path":"pipe:[202485]","pos":0,"flags":["O_WRONLY"],"mnt_id":16,"ino":202485,"mnt":"Not found. This is probably a pipe or something else.","extra":[]}},"timestamp":1787669590109016420,"cred":{"result":"success","value":{"groups":[209,936,953,962,991,992,1000],"uid_real":1000,"uid_effective":1000,"uid_saved_set":1000,"uid_fs":1000,"gid_real":1000,"gid_effective":1000,"gid_saved_set":1000,"gid_fs":1000}},"cgroup":{"kind":"not-collected"}},{"id":6,"pid":20417,"syscall":"execve","exec_pid":20417,"cwd":"/","comm_before_exec":"env","result":-2,"filename":"/usr/local/sbin/ls","argv":{"result":"success","value":["ls"]},"env":{"result":"success","value":{"has_added_or_modified_keys_starting_with_dash":false,"added":{},"removed":[],"modified":{}}},"fdinfo":{"0":{"fd":0,"path":"/dev/pts/4","pos":0,"flags":["O_RDWR"],"mnt_id":39,"ino":7,"mnt":"39 36 0:26 / /dev/pts rw,nosuid,noexec,relatime shared:4 - devpts devpts rw,gid=5,mode=600,ptmxmode=000","extra":[]},"1":{"fd":0,"path":"pipe:[202485]","pos":0,"flags":["O_WRONLY"],"mnt_id":16,"ino":202485,"mnt":"Not found. This is probably a pipe or something else.","extra":[]},"2":{"fd":0,"path":"pipe:[202485]","pos":0,"flags":["O_WRONLY"],"mnt_id":16,"ino":202485,"mnt":"Not found. This is probably a pipe or something else.","extra":[]}},"timestamp":1787669590110303068,"cred":{"result":"success","value":{"groups":[209,936,953,962,991,992,1000],"uid_real":1000,"uid_effective":1000,"uid_saved_set":1000,"uid_fs":1000,"gid_real":1000,"gid_effective":1000,"gid_saved_set":1000,"gid_fs":1000}},"cgroup":{"kind":"not-collected"}},{"id":7,"pid":20417,"syscall":"execve","exec_pid":20417,"cwd":"/","comm_before_exec":"env","result":-2,"filename":"/usr/local/bin/ls","argv":{"result":"success","value":["ls"]},"env":{"result":"success","value":{"has_added_or_modified_keys_starting_with_dash":false,"added":{},"removed":[],"modified":{}}},"fdinfo":{"0":{"fd":0,"path":"/dev/pts/4","pos":0,"flags":["O_RDWR"],"mnt_id":39,"ino":7,"mnt":"39 36 0:26 / /dev/pts rw,nosuid,noexec,relatime shared:4 - devpts devpts rw,gid=5,mode=600,ptmxmode=000","extra":[]},"1":{"fd":0,"path":"pipe:[202485]","pos":0,"flags":["O_WRONLY"],"mnt_id":16,"ino":202485,"mnt":"Not found. This is probably a pipe or something else.","extra":[]},"2":{"fd":0,"path":"pipe:[202485]","pos":0,"flags":["O_WRONLY"],"mnt_id":16,"ino":202485,"mnt":"Not found. This is probably a pipe or something else.","extra":[]}},"timestamp":1787669590111465266,"cred":{"result":"success","value":{"groups":[209,936,953,962,991,992,1000],"uid_real":1000,"uid_effective":1000,"uid_saved_set":1000,"uid_fs":1000,"gid_real":1000,"gid_effective":1000,"gid_saved_set":1000,"gid_fs":1000}},"cgroup":{"kind":"not-collected"}},{"id":8,"pid":20417,"syscall":"execve","exec_pid":20417,"cwd":"/","comm_before_exec":"env","result":0,"filename":"/usr/bin/ls","argv":{"result":"success","value":["ls"]},"env":{"result":"success","value":{"has_added_or_modified_keys_starting_with_dash":false,"added":{},"removed":[],"modified":{}}},"fdinfo":{"0":{"fd":0,"path":"/dev/pts/4","pos":0,"flags":["O_RDWR"],"mnt_id":39,"ino":7,"mnt":"39 36 0:26 / /dev/pts rw,nosuid,noexec,relatime shared:4 - devpts devpts rw,gid=5,mode=600,ptmxmode=000","extra":[]},"1":{"fd":0,"path":"pipe:[202485]","pos":0,"flags":["O_WRONLY"],"mnt_id":16,"ino":202485,"mnt":"Not found. This is probably a pipe or something else.","extra":[]},"2":{"fd":0,"path":"pipe:[202485]","pos":0,"flags":["O_WRONLY"],"mnt_id":16,"ino":202485,"mnt":"Not found. This is probably a pipe or something else.","extra":[]}},"timestamp":1787669590112979337,"cred":{"result":"success","value":{"groups":[209,936,953,962,991,992,1000],"uid_real":1000,"uid_effective":1000,"uid_saved_set":1000,"uid_fs":1000,"gid_real":1000,"gid_effective":1000,"gid_saved_set":1000,"gid_fs":1000}},"cgroup":{"kind":"not-collected"}}]}

NDJSON Format

tracexec collect --format json-stream --output trace.ndjson -- env -C / ls

{"version":"0.17.0","generator":"tracexec_exporter_json","baseline":{"cwd":"/home/kxxt","env":{"HOME":"/home/kxxt","PATH":"/home/kxxt/.cargo/bin:/home/kxxt/mambaforge/bin:/home/kxxt/.nix-profile/bin:/nix/var/nix/profiles/default/bin:/usr/local/sbin:/usr/local/bin:/usr/bin:/opt/cuda/bin:/home/kxxt/.local/share/flatpak/exports/bin:/var/lib/flatpak/exports/bin:/usr/lib/jvm/default/bin:/usr/bin/site_perl:/usr/bin/vendor_perl:/usr/bin/core_perl:/usr/lib/rustup/bin","PWD":"/home/kxxt","SHLVL":"0","_":"/usr/bin/tracexec"},"fdinfo":{"0":{"fd":0,"path":"/dev/pts/4","pos":0,"flags":["O_RDWR"],"mnt_id":39,"ino":7,"mnt":"39 36 0:26 / /dev/pts rw,nosuid,noexec,relatime shared:4 - devpts devpts rw,gid=5,mode=600,ptmxmode=000","extra":[]},"1":{"fd":0,"path":"pipe:[205677]","pos":0,"flags":["O_WRONLY"],"mnt_id":16,"ino":205677,"mnt":"Not found. This is probably a pipe or something else.","extra":[]},"2":{"fd":0,"path":"pipe:[205677]","pos":0,"flags":["O_WRONLY"],"mnt_id":16,"ino":205677,"mnt":"Not found. This is probably a pipe or something else.","extra":[]}}}}
{"id":1,"pid":20782,"syscall":"execve","exec_pid":20782,"cwd":"/home/kxxt","comm_before_exec":"tracer","result":0,"filename":"/usr/bin/env","argv":{"result":"success","value":["env","-C","/","ls"]},"env":{"result":"success","value":{"has_added_or_modified_keys_starting_with_dash":false,"added":{},"removed":[],"modified":{}}},"fdinfo":{"0":{"fd":0,"path":"/dev/pts/4","pos":0,"flags":["O_RDWR"],"mnt_id":39,"ino":7,"mnt":"39 36 0:26 / /dev/pts rw,nosuid,noexec,relatime shared:4 - devpts devpts rw,gid=5,mode=600,ptmxmode=000","extra":[]},"1":{"fd":0,"path":"pipe:[205677]","pos":0,"flags":["O_WRONLY"],"mnt_id":16,"ino":205677,"mnt":"Not found. This is probably a pipe or something else.","extra":[]},"2":{"fd":0,"path":"pipe:[205677]","pos":0,"flags":["O_WRONLY"],"mnt_id":16,"ino":205677,"mnt":"Not found. This is probably a pipe or something else.","extra":[]}},"timestamp":1787669675400640499,"cred":{"result":"success","value":{"groups":[209,936,953,962,991,992,1000],"uid_real":1000,"uid_effective":1000,"uid_saved_set":1000,"uid_fs":1000,"gid_real":1000,"gid_effective":1000,"gid_saved_set":1000,"gid_fs":1000}},"cgroup":{"kind":"not-collected"}}
{"id":2,"pid":20782,"syscall":"execve","exec_pid":20782,"cwd":"/","comm_before_exec":"env","result":-2,"filename":"/home/kxxt/.cargo/bin/ls","argv":{"result":"success","value":["ls"]},"env":{"result":"success","value":{"has_added_or_modified_keys_starting_with_dash":false,"added":{},"removed":[],"modified":{}}},"fdinfo":{"0":{"fd":0,"path":"/dev/pts/4","pos":0,"flags":["O_RDWR"],"mnt_id":39,"ino":7,"mnt":"39 36 0:26 / /dev/pts rw,nosuid,noexec,relatime shared:4 - devpts devpts rw,gid=5,mode=600,ptmxmode=000","extra":[]},"1":{"fd":0,"path":"pipe:[205677]","pos":0,"flags":["O_WRONLY"],"mnt_id":16,"ino":205677,"mnt":"Not found. This is probably a pipe or something else.","extra":[]},"2":{"fd":0,"path":"pipe:[205677]","pos":0,"flags":["O_WRONLY"],"mnt_id":16,"ino":205677,"mnt":"Not found. This is probably a pipe or something else.","extra":[]}},"timestamp":1787669675402808849,"cred":{"result":"success","value":{"groups":[209,936,953,962,991,992,1000],"uid_real":1000,"uid_effective":1000,"uid_saved_set":1000,"uid_fs":1000,"gid_real":1000,"gid_effective":1000,"gid_saved_set":1000,"gid_fs":1000}},"cgroup":{"kind":"not-collected"}}
{"id":3,"pid":20782,"syscall":"execve","exec_pid":20782,"cwd":"/","comm_before_exec":"env","result":-2,"filename":"/home/kxxt/mambaforge/bin/ls","argv":{"result":"success","value":["ls"]},"env":{"result":"success","value":{"has_added_or_modified_keys_starting_with_dash":false,"added":{},"removed":[],"modified":{}}},"fdinfo":{"0":{"fd":0,"path":"/dev/pts/4","pos":0,"flags":["O_RDWR"],"mnt_id":39,"ino":7,"mnt":"39 36 0:26 / /dev/pts rw,nosuid,noexec,relatime shared:4 - devpts devpts rw,gid=5,mode=600,ptmxmode=000","extra":[]},"1":{"fd":0,"path":"pipe:[205677]","pos":0,"flags":["O_WRONLY"],"mnt_id":16,"ino":205677,"mnt":"Not found. This is probably a pipe or something else.","extra":[]},"2":{"fd":0,"path":"pipe:[205677]","pos":0,"flags":["O_WRONLY"],"mnt_id":16,"ino":205677,"mnt":"Not found. This is probably a pipe or something else.","extra":[]}},"timestamp":1787669675404058242,"cred":{"result":"success","value":{"groups":[209,936,953,962,991,992,1000],"uid_real":1000,"uid_effective":1000,"uid_saved_set":1000,"uid_fs":1000,"gid_real":1000,"gid_effective":1000,"gid_saved_set":1000,"gid_fs":1000}},"cgroup":{"kind":"not-collected"}}
{"id":4,"pid":20782,"syscall":"execve","exec_pid":20782,"cwd":"/","comm_before_exec":"env","result":-2,"filename":"/home/kxxt/.nix-profile/bin/ls","argv":{"result":"success","value":["ls"]},"env":{"result":"success","value":{"has_added_or_modified_keys_starting_with_dash":false,"added":{},"removed":[],"modified":{}}},"fdinfo":{"0":{"fd":0,"path":"/dev/pts/4","pos":0,"flags":["O_RDWR"],"mnt_id":39,"ino":7,"mnt":"39 36 0:26 / /dev/pts rw,nosuid,noexec,relatime shared:4 - devpts devpts rw,gid=5,mode=600,ptmxmode=000","extra":[]},"1":{"fd":0,"path":"pipe:[205677]","pos":0,"flags":["O_WRONLY"],"mnt_id":16,"ino":205677,"mnt":"Not found. This is probably a pipe or something else.","extra":[]},"2":{"fd":0,"path":"pipe:[205677]","pos":0,"flags":["O_WRONLY"],"mnt_id":16,"ino":205677,"mnt":"Not found. This is probably a pipe or something else.","extra":[]}},"timestamp":1787669675405266417,"cred":{"result":"success","value":{"groups":[209,936,953,962,991,992,1000],"uid_real":1000,"uid_effective":1000,"uid_saved_set":1000,"uid_fs":1000,"gid_real":1000,"gid_effective":1000,"gid_saved_set":1000,"gid_fs":1000}},"cgroup":{"kind":"not-collected"}}
{"id":5,"pid":20782,"syscall":"execve","exec_pid":20782,"cwd":"/","comm_before_exec":"env","result":-2,"filename":"/nix/var/nix/profiles/default/bin/ls","argv":{"result":"success","value":["ls"]},"env":{"result":"success","value":{"has_added_or_modified_keys_starting_with_dash":false,"added":{},"removed":[],"modified":{}}},"fdinfo":{"0":{"fd":0,"path":"/dev/pts/4","pos":0,"flags":["O_RDWR"],"mnt_id":39,"ino":7,"mnt":"39 36 0:26 / /dev/pts rw,nosuid,noexec,relatime shared:4 - devpts devpts rw,gid=5,mode=600,ptmxmode=000","extra":[]},"1":{"fd":0,"path":"pipe:[205677]","pos":0,"flags":["O_WRONLY"],"mnt_id":16,"ino":205677,"mnt":"Not found. This is probably a pipe or something else.","extra":[]},"2":{"fd":0,"path":"pipe:[205677]","pos":0,"flags":["O_WRONLY"],"mnt_id":16,"ino":205677,"mnt":"Not found. This is probably a pipe or something else.","extra":[]}},"timestamp":1787669675406620724,"cred":{"result":"success","value":{"groups":[209,936,953,962,991,992,1000],"uid_real":1000,"uid_effective":1000,"uid_saved_set":1000,"uid_fs":1000,"gid_real":1000,"gid_effective":1000,"gid_saved_set":1000,"gid_fs":1000}},"cgroup":{"kind":"not-collected"}}
{"id":6,"pid":20782,"syscall":"execve","exec_pid":20782,"cwd":"/","comm_before_exec":"env","result":-2,"filename":"/usr/local/sbin/ls","argv":{"result":"success","value":["ls"]},"env":{"result":"success","value":{"has_added_or_modified_keys_starting_with_dash":false,"added":{},"removed":[],"modified":{}}},"fdinfo":{"0":{"fd":0,"path":"/dev/pts/4","pos":0,"flags":["O_RDWR"],"mnt_id":39,"ino":7,"mnt":"39 36 0:26 / /dev/pts rw,nosuid,noexec,relatime shared:4 - devpts devpts rw,gid=5,mode=600,ptmxmode=000","extra":[]},"1":{"fd":0,"path":"pipe:[205677]","pos":0,"flags":["O_WRONLY"],"mnt_id":16,"ino":205677,"mnt":"Not found. This is probably a pipe or something else.","extra":[]},"2":{"fd":0,"path":"pipe:[205677]","pos":0,"flags":["O_WRONLY"],"mnt_id":16,"ino":205677,"mnt":"Not found. This is probably a pipe or something else.","extra":[]}},"timestamp":1787669675408335310,"cred":{"result":"success","value":{"groups":[209,936,953,962,991,992,1000],"uid_real":1000,"uid_effective":1000,"uid_saved_set":1000,"uid_fs":1000,"gid_real":1000,"gid_effective":1000,"gid_saved_set":1000,"gid_fs":1000}},"cgroup":{"kind":"not-collected"}}
{"id":7,"pid":20782,"syscall":"execve","exec_pid":20782,"cwd":"/","comm_before_exec":"env","result":-2,"filename":"/usr/local/bin/ls","argv":{"result":"success","value":["ls"]},"env":{"result":"success","value":{"has_added_or_modified_keys_starting_with_dash":false,"added":{},"removed":[],"modified":{}}},"fdinfo":{"0":{"fd":0,"path":"/dev/pts/4","pos":0,"flags":["O_RDWR"],"mnt_id":39,"ino":7,"mnt":"39 36 0:26 / /dev/pts rw,nosuid,noexec,relatime shared:4 - devpts devpts rw,gid=5,mode=600,ptmxmode=000","extra":[]},"1":{"fd":0,"path":"pipe:[205677]","pos":0,"flags":["O_WRONLY"],"mnt_id":16,"ino":205677,"mnt":"Not found. This is probably a pipe or something else.","extra":[]},"2":{"fd":0,"path":"pipe:[205677]","pos":0,"flags":["O_WRONLY"],"mnt_id":16,"ino":205677,"mnt":"Not found. This is probably a pipe or something else.","extra":[]}},"timestamp":1787669675409465881,"cred":{"result":"success","value":{"groups":[209,936,953,962,991,992,1000],"uid_real":1000,"uid_effective":1000,"uid_saved_set":1000,"uid_fs":1000,"gid_real":1000,"gid_effective":1000,"gid_saved_set":1000,"gid_fs":1000}},"cgroup":{"kind":"not-collected"}}
{"id":8,"pid":20782,"syscall":"execve","exec_pid":20782,"cwd":"/","comm_before_exec":"env","result":0,"filename":"/usr/bin/ls","argv":{"result":"success","value":["ls"]},"env":{"result":"success","value":{"has_added_or_modified_keys_starting_with_dash":false,"added":{},"removed":[],"modified":{}}},"fdinfo":{"0":{"fd":0,"path":"/dev/pts/4","pos":0,"flags":["O_RDWR"],"mnt_id":39,"ino":7,"mnt":"39 36 0:26 / /dev/pts rw,nosuid,noexec,relatime shared:4 - devpts devpts rw,gid=5,mode=600,ptmxmode=000","extra":[]},"1":{"fd":0,"path":"pipe:[205677]","pos":0,"flags":["O_WRONLY"],"mnt_id":16,"ino":205677,"mnt":"Not found. This is probably a pipe or something else.","extra":[]},"2":{"fd":0,"path":"pipe:[205677]","pos":0,"flags":["O_WRONLY"],"mnt_id":16,"ino":205677,"mnt":"Not found. This is probably a pipe or something else.","extra":[]}},"timestamp":1787669675411122028,"cred":{"result":"success","value":{"groups":[209,936,953,962,991,992,1000],"uid_real":1000,"uid_effective":1000,"uid_saved_set":1000,"uid_fs":1000,"gid_real":1000,"gid_effective":1000,"gid_saved_set":1000,"gid_fs":1000}},"cgroup":{"kind":"not-collected"}}