kprobe

Documentation

Overview

This program demonstrates attaching an gBPF program to a kernel symbol. The gBPF program will be attached to the start of the sys_execve kernel function and prints out the number of times it has been called every second.