Comment by ranger_danger

Does this use eBPF? Can it be expanded to work with other syscalls besides exec? I find myself using not only execsnoop.bt but also opensnoop.bt, statsnoop.bt, tcpconnect.bt etc.