Tracing the kernel
Observe kernel and syscall activity with kprobes, fentry/fexit, and tracepoints — from file deletes and opens to process lifecycle and signals.
kprobe + unlink
Your first kprobe — attach to the kernel function behind file deletion, read the calling process's identity, attempt to read the filename argument, and stream per-event records to user space via a ring buffer.
fentry + unlink
Revisit the unlink target with fentry/fexit — BTF-trampoline probes that are lower overhead than kprobes, give typed argument access, and let fexit read the function's return value, so we can report whether each unlink actually succeeded.
opensnoop
Trace every file open with stable syscall tracepoints — read tracepoint arguments by offset, learn the user-vs-kernel memory-read distinction, and pair entry and exit to report which process opened which file with what result.
sigsnoop
A shorter sibling to opensnoop — one tracepoint on the kill syscall to trace which process signals which, with signal-number-to-name mapping done in user space.
execsnoop
Trace every program launch with its full command line — the new skill is reading argv, an array of user-space string pointers, in a bounded verifier-friendly loop, written straight into the ring-buffer slot.
exitsnoop
The bookend to execsnoop — trace process termination and exit codes via the exit_group tracepoint, getting the status without touching task_struct, and learn how the exit-code encoding differs from the wait() status.