sudo ./ktap -e 'trace syscalls:sys_enter_open { print( execname(), user_string(arg2)) }' Tracing... Hit Ctrl-C to end. ktap /sys/kernel/debug/ktap/trace_pipe_6976 sh /etc/ld.so.cache sh /lib/x86_64-linux-gnu/libc.so.6 sh /tmp/numLogin.txt sh /etc/ld.so.cache sh /lib/x86_64-linux-gnu/libc.so.6 w /etc/ld.so.cache w /lib/libproc-3.2.8.so w /lib/x86_64-linux-gnu/libc.so.6 grep /etc/ld.so.cache grep /lib/x86_64-linux-gnu/libdl.so.2 grep /lib/x86_64-linux-gnu/libc.so.6 w /proc/version w w /proc/1/stat [...]