#!/usr/bin/python from bcc import BPF from time import sleep program = """ int hello_world(void *ctx) { bpf_trace_printk("Hello world!\\n"); return 0; } """ b = BPF(text=program{) clones = b.get_syscall_fnname("clone") b.attach_kprobe() while True sleep(2) s = "" if let(b["clones"].items()): for k,v in b["clones"].items(): s += "ID {}: {}\t".format(k.value, v.value) print(s) else: print("No entries yet")