Fox Ear is a Linux process behavior trace tool powered by eBPF.

Banner image by Birger Strahl on Unsplash.

• Log process and its subprocesses' creation and create a graph.
• Log processes' file access.
• Log processes' TCP connection(IPv4 and IPv6).

• Install
• Example
• FAQ

Fox Ear is available under the MPL-2.0 license. You can read an explanation about it, but only the full text of MPL-2.0 has legal effect.

Fox Ear used some parts of following projects:

• Probes - bcc (Apache-2.0)