{"ID":"1615114232.375:15558","NODE":"work","SYSCALL":{"arch":"0xc000003e","syscall":59,"success":"yes","exit":0,"items":2,"ppid":10883,"pid":10884,"auid":1000,"uid":0,"gid":0,"euid":0,"suid":0,"fsuid":0,"egid":0,"sgid":0,"fsgid":0,"tty":"pts1","ses":1,"comm":"whoami","exe":"/usr/bin/whoami","key":null,"ARCH":"x86_64","SYSCALL":"execve","AUID":"user","UID":"root","GID":"root","EUID":"root","SUID":"root","FSUID":"root","EGID":"root","SGID":"root","FSGID":"root","ARGV":["0x63b29337fd18","0x63b293387d58","0x63b293375640","0xfffffffffffff000"]},"EXECVE":{"argc":1,"ARGV":["whoami"]},"CWD":{"cwd":"/home/user/tmp"},"PATH":[{"item":0,"name":"/usr/bin/whoami","inode":261214,"dev":"ca:03","mode":"0o100755","ouid":0,"ogid":0,"rdev":"00:00","nametype":"NORMAL","cap_fp":"0x0","cap_fi":"0x0","cap_fe":0,"cap_fver":"0x0","OUID":"root","OGID":"root"},{"item":1,"name":"/lib64/ld-linux-x86-64.so.2","inode":262146,"dev":"ca:03","mode":"0o100755","ouid":0,"ogid":0,"rdev":"00:00","nametype":"NORMAL","cap_fp":"0x0","cap_fi":"0x0","cap_fe":0,"cap_fver":"0x0","OUID":"root","OGID":"root"}],"PROCTITLE":{"ARGV":["whoami"]}}