Backtrace

The TUI can reconstruct the exec backtrace of an event. It is NOT a stack backtrace.

Traversing the Backtrace in the Events Pane

Press U when focusing the Events pane to jump to the parent event of the selected event.

View the Full Backtrace

Select an exec event in the Events pane and press T to show the full backtrace. The popup lists the oldest available ancestor first and the selected event last. Its markers distinguish two relationships:

• S (spawns): a process forked a child, and the child later executed the next program;
• B (becomes): the same process replaced its image with another program.

Incomplete backtraces

Parent links refer to earlier event IDs kept by the TUI. A popup is marked incomplete when an ancestor has already been discarded because --max-events was reached. Increase the limit, or use --max-events 0 for an unlimited list when retaining the full lineage matters.

Failed exec attempts appear in the event list but do not replace the last successful program image. They therefore do not become ancestors of later successful execs.