# JSON Export
We support two formats for JSON export.
- The `json` format exports the whole trace as a complete JSON.
- The `json-stream` format exports the trace as JSON messages separated by
newlines. This format is also known as NDJSON when `--pretty` is not used.
Use `--output <OUTPUT_FILE_PATH>` to keep exporter data separate from output written by the traced
command.
> [!WARNING]
> The output JSON may contain sensitive credentials that are passed in commandline arguments
> or environment variables. Sharing it may leak such credentials.
## JSON Format
```bash
tracexec collect --format json --output trace.json -- env -C / ls
```
<!-- env - PATH=$PATH HOME=$HOME bash --norc -i -c 'tracexec collect --format json --output trace.json -- env -C / ls' -->
```json
{"version":"0.17.0","generator":"tracexec_exporter_json","baseline":{"cwd":"/home/kxxt","env":{"HOME":"/home/kxxt","PATH":"/home/kxxt/.cargo/bin:/home/kxxt/mambaforge/bin:/home/kxxt/.nix-profile/bin:/nix/var/nix/profiles/default/bin:/usr/local/sbin:/usr/local/bin:/usr/bin:/opt/cuda/bin:/home/kxxt/.local/share/flatpak/exports/bin:/var/lib/flatpak/exports/bin:/usr/lib/jvm/default/bin:/usr/bin/site_perl:/usr/bin/vendor_perl:/usr/bin/core_perl:/usr/lib/rustup/bin","PWD":"/home/kxxt","SHLVL":"0","_":"/usr/bin/tracexec"},"fdinfo":{"0":{"fd":0,"path":"/dev/pts/4","pos":0,"flags":["O_RDWR"],"mnt_id":39,"ino":7,"mnt":"39 36 0:26 / /dev/pts rw,nosuid,noexec,relatime shared:4 - devpts devpts rw,gid=5,mode=600,ptmxmode=000","extra":[]},"1":{"fd":0,"path":"pipe:[202485]","pos":0,"flags":["O_WRONLY"],"mnt_id":16,"ino":202485,"mnt":"Not found. This is probably a pipe or something else.","extra":[]},"2":{"fd":0,"path":"pipe:[202485]","pos":0,"flags":["O_WRONLY"],"mnt_id":16,"ino":202485,"mnt":"Not found. This is probably a pipe or something else.","extra":[]}}},"events":[{"id":1,"pid":20417,"syscall":"execve","exec_pid":20417,"cwd":"/home/kxxt","comm_before_exec":"tracer","result":0,"filename":"/usr/bin/env","argv":{"result":"success","value":["env","-C","/","ls"]},"env":{"result":"success","value":{"has_added_or_modified_keys_starting_with_dash":false,"added":{},"removed":[],"modified":{}}},"fdinfo":{"0":{"fd":0,"path":"/dev/pts/4","pos":0,"flags":["O_RDWR"],"mnt_id":39,"ino":7,"mnt":"39 36 0:26 / /dev/pts rw,nosuid,noexec,relatime shared:4 - devpts devpts rw,gid=5,mode=600,ptmxmode=000","extra":[]},"1":{"fd":0,"path":"pipe:[202485]","pos":0,"flags":["O_WRONLY"],"mnt_id":16,"ino":202485,"mnt":"Not found. This is probably a pipe or something else.","extra":[]},"2":{"fd":0,"path":"pipe:[202485]","pos":0,"flags":["O_WRONLY"],"mnt_id":16,"ino":202485,"mnt":"Not found. This is probably a pipe or something else.","extra":[]}},"timestamp":1787669590103448326,"cred":{"result":"success","value":{"groups":[209,936,953,962,991,992,1000],"uid_real":1000,"uid_effective":1000,"uid_saved_set":1000,"uid_fs":1000,"gid_real":1000,"gid_effective":1000,"gid_saved_set":1000,"gid_fs":1000}},"cgroup":{"kind":"not-collected"}},{"id":2,"pid":20417,"syscall":"execve","exec_pid":20417,"cwd":"/","comm_before_exec":"env","result":-2,"filename":"/home/kxxt/.cargo/bin/ls","argv":{"result":"success","value":["ls"]},"env":{"result":"success","value":{"has_added_or_modified_keys_starting_with_dash":false,"added":{},"removed":[],"modified":{}}},"fdinfo":{"0":{"fd":0,"path":"/dev/pts/4","pos":0,"flags":["O_RDWR"],"mnt_id":39,"ino":7,"mnt":"39 36 0:26 / /dev/pts rw,nosuid,noexec,relatime shared:4 - devpts devpts rw,gid=5,mode=600,ptmxmode=000","extra":[]},"1":{"fd":0,"path":"pipe:[202485]","pos":0,"flags":["O_WRONLY"],"mnt_id":16,"ino":202485,"mnt":"Not found. This is probably a pipe or something else.","extra":[]},"2":{"fd":0,"path":"pipe:[202485]","pos":0,"flags":["O_WRONLY"],"mnt_id":16,"ino":202485,"mnt":"Not found. This is probably a pipe or something else.","extra":[]}},"timestamp":1787669590105681518,"cred":{"result":"success","value":{"groups":[209,936,953,962,991,992,1000],"uid_real":1000,"uid_effective":1000,"uid_saved_set":1000,"uid_fs":1000,"gid_real":1000,"gid_effective":1000,"gid_saved_set":1000,"gid_fs":1000}},"cgroup":{"kind":"not-collected"}},{"id":3,"pid":20417,"syscall":"execve","exec_pid":20417,"cwd":"/","comm_before_exec":"env","result":-2,"filename":"/home/kxxt/mambaforge/bin/ls","argv":{"result":"success","value":["ls"]},"env":{"result":"success","value":{"has_added_or_modified_keys_starting_with_dash":false,"added":{},"removed":[],"modified":{}}},"fdinfo":{"0":{"fd":0,"path":"/dev/pts/4","pos":0,"flags":["O_RDWR"],"mnt_id":39,"ino":7,"mnt":"39 36 0:26 / /dev/pts rw,nosuid,noexec,relatime shared:4 - devpts devpts rw,gid=5,mode=600,ptmxmode=000","extra":[]},"1":{"fd":0,"path":"pipe:[202485]","pos":0,"flags":["O_WRONLY"],"mnt_id":16,"ino":202485,"mnt":"Not found. This is probably a pipe or something else.","extra":[]},"2":{"fd":0,"path":"pipe:[202485]","pos":0,"flags":["O_WRONLY"],"mnt_id":16,"ino":202485,"mnt":"Not found. This is probably a pipe or something else.","extra":[]}},"timestamp":1787669590106807056,"cred":{"result":"success","value":{"groups":[209,936,953,962,991,992,1000],"uid_real":1000,"uid_effective":1000,"uid_saved_set":1000,"uid_fs":1000,"gid_real":1000,"gid_effective":1000,"gid_saved_set":1000,"gid_fs":1000}},"cgroup":{"kind":"not-collected"}},{"id":4,"pid":20417,"syscall":"execve","exec_pid":20417,"cwd":"/","comm_before_exec":"env","result":-2,"filename":"/home/kxxt/.nix-profile/bin/ls","argv":{"result":"success","value":["ls"]},"env":{"result":"success","value":{"has_added_or_modified_keys_starting_with_dash":false,"added":{},"removed":[],"modified":{}}},"fdinfo":{"0":{"fd":0,"path":"/dev/pts/4","pos":0,"flags":["O_RDWR"],"mnt_id":39,"ino":7,"mnt":"39 36 0:26 / /dev/pts rw,nosuid,noexec,relatime shared:4 - devpts devpts rw,gid=5,mode=600,ptmxmode=000","extra":[]},"1":{"fd":0,"path":"pipe:[202485]","pos":0,"flags":["O_WRONLY"],"mnt_id":16,"ino":202485,"mnt":"Not found. This is probably a pipe or something else.","extra":[]},"2":{"fd":0,"path":"pipe:[202485]","pos":0,"flags":["O_WRONLY"],"mnt_id":16,"ino":202485,"mnt":"Not found. This is probably a pipe or something else.","extra":[]}},"timestamp":1787669590107950785,"cred":{"result":"success","value":{"groups":[209,936,953,962,991,992,1000],"uid_real":1000,"uid_effective":1000,"uid_saved_set":1000,"uid_fs":1000,"gid_real":1000,"gid_effective":1000,"gid_saved_set":1000,"gid_fs":1000}},"cgroup":{"kind":"not-collected"}},{"id":5,"pid":20417,"syscall":"execve","exec_pid":20417,"cwd":"/","comm_before_exec":"env","result":-2,"filename":"/nix/var/nix/profiles/default/bin/ls","argv":{"result":"success","value":["ls"]},"env":{"result":"success","value":{"has_added_or_modified_keys_starting_with_dash":false,"added":{},"removed":[],"modified":{}}},"fdinfo":{"0":{"fd":0,"path":"/dev/pts/4","pos":0,"flags":["O_RDWR"],"mnt_id":39,"ino":7,"mnt":"39 36 0:26 / /dev/pts rw,nosuid,noexec,relatime shared:4 - devpts devpts rw,gid=5,mode=600,ptmxmode=000","extra":[]},"1":{"fd":0,"path":"pipe:[202485]","pos":0,"flags":["O_WRONLY"],"mnt_id":16,"ino":202485,"mnt":"Not found. This is probably a pipe or something else.","extra":[]},"2":{"fd":0,"path":"pipe:[202485]","pos":0,"flags":["O_WRONLY"],"mnt_id":16,"ino":202485,"mnt":"Not found. This is probably a pipe or something else.","extra":[]}},"timestamp":1787669590109016420,"cred":{"result":"success","value":{"groups":[209,936,953,962,991,992,1000],"uid_real":1000,"uid_effective":1000,"uid_saved_set":1000,"uid_fs":1000,"gid_real":1000,"gid_effective":1000,"gid_saved_set":1000,"gid_fs":1000}},"cgroup":{"kind":"not-collected"}},{"id":6,"pid":20417,"syscall":"execve","exec_pid":20417,"cwd":"/","comm_before_exec":"env","result":-2,"filename":"/usr/local/sbin/ls","argv":{"result":"success","value":["ls"]},"env":{"result":"success","value":{"has_added_or_modified_keys_starting_with_dash":false,"added":{},"removed":[],"modified":{}}},"fdinfo":{"0":{"fd":0,"path":"/dev/pts/4","pos":0,"flags":["O_RDWR"],"mnt_id":39,"ino":7,"mnt":"39 36 0:26 / /dev/pts rw,nosuid,noexec,relatime shared:4 - devpts devpts rw,gid=5,mode=600,ptmxmode=000","extra":[]},"1":{"fd":0,"path":"pipe:[202485]","pos":0,"flags":["O_WRONLY"],"mnt_id":16,"ino":202485,"mnt":"Not found. This is probably a pipe or something else.","extra":[]},"2":{"fd":0,"path":"pipe:[202485]","pos":0,"flags":["O_WRONLY"],"mnt_id":16,"ino":202485,"mnt":"Not found. This is probably a pipe or something else.","extra":[]}},"timestamp":1787669590110303068,"cred":{"result":"success","value":{"groups":[209,936,953,962,991,992,1000],"uid_real":1000,"uid_effective":1000,"uid_saved_set":1000,"uid_fs":1000,"gid_real":1000,"gid_effective":1000,"gid_saved_set":1000,"gid_fs":1000}},"cgroup":{"kind":"not-collected"}},{"id":7,"pid":20417,"syscall":"execve","exec_pid":20417,"cwd":"/","comm_before_exec":"env","result":-2,"filename":"/usr/local/bin/ls","argv":{"result":"success","value":["ls"]},"env":{"result":"success","value":{"has_added_or_modified_keys_starting_with_dash":false,"added":{},"removed":[],"modified":{}}},"fdinfo":{"0":{"fd":0,"path":"/dev/pts/4","pos":0,"flags":["O_RDWR"],"mnt_id":39,"ino":7,"mnt":"39 36 0:26 / /dev/pts rw,nosuid,noexec,relatime shared:4 - devpts devpts rw,gid=5,mode=600,ptmxmode=000","extra":[]},"1":{"fd":0,"path":"pipe:[202485]","pos":0,"flags":["O_WRONLY"],"mnt_id":16,"ino":202485,"mnt":"Not found. This is probably a pipe or something else.","extra":[]},"2":{"fd":0,"path":"pipe:[202485]","pos":0,"flags":["O_WRONLY"],"mnt_id":16,"ino":202485,"mnt":"Not found. This is probably a pipe or something else.","extra":[]}},"timestamp":1787669590111465266,"cred":{"result":"success","value":{"groups":[209,936,953,962,991,992,1000],"uid_real":1000,"uid_effective":1000,"uid_saved_set":1000,"uid_fs":1000,"gid_real":1000,"gid_effective":1000,"gid_saved_set":1000,"gid_fs":1000}},"cgroup":{"kind":"not-collected"}},{"id":8,"pid":20417,"syscall":"execve","exec_pid":20417,"cwd":"/","comm_before_exec":"env","result":0,"filename":"/usr/bin/ls","argv":{"result":"success","value":["ls"]},"env":{"result":"success","value":{"has_added_or_modified_keys_starting_with_dash":false,"added":{},"removed":[],"modified":{}}},"fdinfo":{"0":{"fd":0,"path":"/dev/pts/4","pos":0,"flags":["O_RDWR"],"mnt_id":39,"ino":7,"mnt":"39 36 0:26 / /dev/pts rw,nosuid,noexec,relatime shared:4 - devpts devpts rw,gid=5,mode=600,ptmxmode=000","extra":[]},"1":{"fd":0,"path":"pipe:[202485]","pos":0,"flags":["O_WRONLY"],"mnt_id":16,"ino":202485,"mnt":"Not found. This is probably a pipe or something else.","extra":[]},"2":{"fd":0,"path":"pipe:[202485]","pos":0,"flags":["O_WRONLY"],"mnt_id":16,"ino":202485,"mnt":"Not found. This is probably a pipe or something else.","extra":[]}},"timestamp":1787669590112979337,"cred":{"result":"success","value":{"groups":[209,936,953,962,991,992,1000],"uid_real":1000,"uid_effective":1000,"uid_saved_set":1000,"uid_fs":1000,"gid_real":1000,"gid_effective":1000,"gid_saved_set":1000,"gid_fs":1000}},"cgroup":{"kind":"not-collected"}}]}
```
## NDJSON Format
```bash
tracexec collect --format json-stream --output trace.ndjson -- env -C / ls
```
<!-- env - PATH=$PATH HOME=$HOME bash --norc -i -c 'tracexec collect --format json-stream --output trace.ndjson -- env -C / ls' -->
```json
{"version":"0.17.0","generator":"tracexec_exporter_json","baseline":{"cwd":"/home/kxxt","env":{"HOME":"/home/kxxt","PATH":"/home/kxxt/.cargo/bin:/home/kxxt/mambaforge/bin:/home/kxxt/.nix-profile/bin:/nix/var/nix/profiles/default/bin:/usr/local/sbin:/usr/local/bin:/usr/bin:/opt/cuda/bin:/home/kxxt/.local/share/flatpak/exports/bin:/var/lib/flatpak/exports/bin:/usr/lib/jvm/default/bin:/usr/bin/site_perl:/usr/bin/vendor_perl:/usr/bin/core_perl:/usr/lib/rustup/bin","PWD":"/home/kxxt","SHLVL":"0","_":"/usr/bin/tracexec"},"fdinfo":{"0":{"fd":0,"path":"/dev/pts/4","pos":0,"flags":["O_RDWR"],"mnt_id":39,"ino":7,"mnt":"39 36 0:26 / /dev/pts rw,nosuid,noexec,relatime shared:4 - devpts devpts rw,gid=5,mode=600,ptmxmode=000","extra":[]},"1":{"fd":0,"path":"pipe:[205677]","pos":0,"flags":["O_WRONLY"],"mnt_id":16,"ino":205677,"mnt":"Not found. This is probably a pipe or something else.","extra":[]},"2":{"fd":0,"path":"pipe:[205677]","pos":0,"flags":["O_WRONLY"],"mnt_id":16,"ino":205677,"mnt":"Not found. This is probably a pipe or something else.","extra":[]}}}}
{"id":1,"pid":20782,"syscall":"execve","exec_pid":20782,"cwd":"/home/kxxt","comm_before_exec":"tracer","result":0,"filename":"/usr/bin/env","argv":{"result":"success","value":["env","-C","/","ls"]},"env":{"result":"success","value":{"has_added_or_modified_keys_starting_with_dash":false,"added":{},"removed":[],"modified":{}}},"fdinfo":{"0":{"fd":0,"path":"/dev/pts/4","pos":0,"flags":["O_RDWR"],"mnt_id":39,"ino":7,"mnt":"39 36 0:26 / /dev/pts rw,nosuid,noexec,relatime shared:4 - devpts devpts rw,gid=5,mode=600,ptmxmode=000","extra":[]},"1":{"fd":0,"path":"pipe:[205677]","pos":0,"flags":["O_WRONLY"],"mnt_id":16,"ino":205677,"mnt":"Not found. This is probably a pipe or something else.","extra":[]},"2":{"fd":0,"path":"pipe:[205677]","pos":0,"flags":["O_WRONLY"],"mnt_id":16,"ino":205677,"mnt":"Not found. This is probably a pipe or something else.","extra":[]}},"timestamp":1787669675400640499,"cred":{"result":"success","value":{"groups":[209,936,953,962,991,992,1000],"uid_real":1000,"uid_effective":1000,"uid_saved_set":1000,"uid_fs":1000,"gid_real":1000,"gid_effective":1000,"gid_saved_set":1000,"gid_fs":1000}},"cgroup":{"kind":"not-collected"}}
{"id":2,"pid":20782,"syscall":"execve","exec_pid":20782,"cwd":"/","comm_before_exec":"env","result":-2,"filename":"/home/kxxt/.cargo/bin/ls","argv":{"result":"success","value":["ls"]},"env":{"result":"success","value":{"has_added_or_modified_keys_starting_with_dash":false,"added":{},"removed":[],"modified":{}}},"fdinfo":{"0":{"fd":0,"path":"/dev/pts/4","pos":0,"flags":["O_RDWR"],"mnt_id":39,"ino":7,"mnt":"39 36 0:26 / /dev/pts rw,nosuid,noexec,relatime shared:4 - devpts devpts rw,gid=5,mode=600,ptmxmode=000","extra":[]},"1":{"fd":0,"path":"pipe:[205677]","pos":0,"flags":["O_WRONLY"],"mnt_id":16,"ino":205677,"mnt":"Not found. This is probably a pipe or something else.","extra":[]},"2":{"fd":0,"path":"pipe:[205677]","pos":0,"flags":["O_WRONLY"],"mnt_id":16,"ino":205677,"mnt":"Not found. This is probably a pipe or something else.","extra":[]}},"timestamp":1787669675402808849,"cred":{"result":"success","value":{"groups":[209,936,953,962,991,992,1000],"uid_real":1000,"uid_effective":1000,"uid_saved_set":1000,"uid_fs":1000,"gid_real":1000,"gid_effective":1000,"gid_saved_set":1000,"gid_fs":1000}},"cgroup":{"kind":"not-collected"}}
{"id":3,"pid":20782,"syscall":"execve","exec_pid":20782,"cwd":"/","comm_before_exec":"env","result":-2,"filename":"/home/kxxt/mambaforge/bin/ls","argv":{"result":"success","value":["ls"]},"env":{"result":"success","value":{"has_added_or_modified_keys_starting_with_dash":false,"added":{},"removed":[],"modified":{}}},"fdinfo":{"0":{"fd":0,"path":"/dev/pts/4","pos":0,"flags":["O_RDWR"],"mnt_id":39,"ino":7,"mnt":"39 36 0:26 / /dev/pts rw,nosuid,noexec,relatime shared:4 - devpts devpts rw,gid=5,mode=600,ptmxmode=000","extra":[]},"1":{"fd":0,"path":"pipe:[205677]","pos":0,"flags":["O_WRONLY"],"mnt_id":16,"ino":205677,"mnt":"Not found. This is probably a pipe or something else.","extra":[]},"2":{"fd":0,"path":"pipe:[205677]","pos":0,"flags":["O_WRONLY"],"mnt_id":16,"ino":205677,"mnt":"Not found. This is probably a pipe or something else.","extra":[]}},"timestamp":1787669675404058242,"cred":{"result":"success","value":{"groups":[209,936,953,962,991,992,1000],"uid_real":1000,"uid_effective":1000,"uid_saved_set":1000,"uid_fs":1000,"gid_real":1000,"gid_effective":1000,"gid_saved_set":1000,"gid_fs":1000}},"cgroup":{"kind":"not-collected"}}
{"id":4,"pid":20782,"syscall":"execve","exec_pid":20782,"cwd":"/","comm_before_exec":"env","result":-2,"filename":"/home/kxxt/.nix-profile/bin/ls","argv":{"result":"success","value":["ls"]},"env":{"result":"success","value":{"has_added_or_modified_keys_starting_with_dash":false,"added":{},"removed":[],"modified":{}}},"fdinfo":{"0":{"fd":0,"path":"/dev/pts/4","pos":0,"flags":["O_RDWR"],"mnt_id":39,"ino":7,"mnt":"39 36 0:26 / /dev/pts rw,nosuid,noexec,relatime shared:4 - devpts devpts rw,gid=5,mode=600,ptmxmode=000","extra":[]},"1":{"fd":0,"path":"pipe:[205677]","pos":0,"flags":["O_WRONLY"],"mnt_id":16,"ino":205677,"mnt":"Not found. This is probably a pipe or something else.","extra":[]},"2":{"fd":0,"path":"pipe:[205677]","pos":0,"flags":["O_WRONLY"],"mnt_id":16,"ino":205677,"mnt":"Not found. This is probably a pipe or something else.","extra":[]}},"timestamp":1787669675405266417,"cred":{"result":"success","value":{"groups":[209,936,953,962,991,992,1000],"uid_real":1000,"uid_effective":1000,"uid_saved_set":1000,"uid_fs":1000,"gid_real":1000,"gid_effective":1000,"gid_saved_set":1000,"gid_fs":1000}},"cgroup":{"kind":"not-collected"}}
{"id":5,"pid":20782,"syscall":"execve","exec_pid":20782,"cwd":"/","comm_before_exec":"env","result":-2,"filename":"/nix/var/nix/profiles/default/bin/ls","argv":{"result":"success","value":["ls"]},"env":{"result":"success","value":{"has_added_or_modified_keys_starting_with_dash":false,"added":{},"removed":[],"modified":{}}},"fdinfo":{"0":{"fd":0,"path":"/dev/pts/4","pos":0,"flags":["O_RDWR"],"mnt_id":39,"ino":7,"mnt":"39 36 0:26 / /dev/pts rw,nosuid,noexec,relatime shared:4 - devpts devpts rw,gid=5,mode=600,ptmxmode=000","extra":[]},"1":{"fd":0,"path":"pipe:[205677]","pos":0,"flags":["O_WRONLY"],"mnt_id":16,"ino":205677,"mnt":"Not found. This is probably a pipe or something else.","extra":[]},"2":{"fd":0,"path":"pipe:[205677]","pos":0,"flags":["O_WRONLY"],"mnt_id":16,"ino":205677,"mnt":"Not found. This is probably a pipe or something else.","extra":[]}},"timestamp":1787669675406620724,"cred":{"result":"success","value":{"groups":[209,936,953,962,991,992,1000],"uid_real":1000,"uid_effective":1000,"uid_saved_set":1000,"uid_fs":1000,"gid_real":1000,"gid_effective":1000,"gid_saved_set":1000,"gid_fs":1000}},"cgroup":{"kind":"not-collected"}}
{"id":6,"pid":20782,"syscall":"execve","exec_pid":20782,"cwd":"/","comm_before_exec":"env","result":-2,"filename":"/usr/local/sbin/ls","argv":{"result":"success","value":["ls"]},"env":{"result":"success","value":{"has_added_or_modified_keys_starting_with_dash":false,"added":{},"removed":[],"modified":{}}},"fdinfo":{"0":{"fd":0,"path":"/dev/pts/4","pos":0,"flags":["O_RDWR"],"mnt_id":39,"ino":7,"mnt":"39 36 0:26 / /dev/pts rw,nosuid,noexec,relatime shared:4 - devpts devpts rw,gid=5,mode=600,ptmxmode=000","extra":[]},"1":{"fd":0,"path":"pipe:[205677]","pos":0,"flags":["O_WRONLY"],"mnt_id":16,"ino":205677,"mnt":"Not found. This is probably a pipe or something else.","extra":[]},"2":{"fd":0,"path":"pipe:[205677]","pos":0,"flags":["O_WRONLY"],"mnt_id":16,"ino":205677,"mnt":"Not found. This is probably a pipe or something else.","extra":[]}},"timestamp":1787669675408335310,"cred":{"result":"success","value":{"groups":[209,936,953,962,991,992,1000],"uid_real":1000,"uid_effective":1000,"uid_saved_set":1000,"uid_fs":1000,"gid_real":1000,"gid_effective":1000,"gid_saved_set":1000,"gid_fs":1000}},"cgroup":{"kind":"not-collected"}}
{"id":7,"pid":20782,"syscall":"execve","exec_pid":20782,"cwd":"/","comm_before_exec":"env","result":-2,"filename":"/usr/local/bin/ls","argv":{"result":"success","value":["ls"]},"env":{"result":"success","value":{"has_added_or_modified_keys_starting_with_dash":false,"added":{},"removed":[],"modified":{}}},"fdinfo":{"0":{"fd":0,"path":"/dev/pts/4","pos":0,"flags":["O_RDWR"],"mnt_id":39,"ino":7,"mnt":"39 36 0:26 / /dev/pts rw,nosuid,noexec,relatime shared:4 - devpts devpts rw,gid=5,mode=600,ptmxmode=000","extra":[]},"1":{"fd":0,"path":"pipe:[205677]","pos":0,"flags":["O_WRONLY"],"mnt_id":16,"ino":205677,"mnt":"Not found. This is probably a pipe or something else.","extra":[]},"2":{"fd":0,"path":"pipe:[205677]","pos":0,"flags":["O_WRONLY"],"mnt_id":16,"ino":205677,"mnt":"Not found. This is probably a pipe or something else.","extra":[]}},"timestamp":1787669675409465881,"cred":{"result":"success","value":{"groups":[209,936,953,962,991,992,1000],"uid_real":1000,"uid_effective":1000,"uid_saved_set":1000,"uid_fs":1000,"gid_real":1000,"gid_effective":1000,"gid_saved_set":1000,"gid_fs":1000}},"cgroup":{"kind":"not-collected"}}
{"id":8,"pid":20782,"syscall":"execve","exec_pid":20782,"cwd":"/","comm_before_exec":"env","result":0,"filename":"/usr/bin/ls","argv":{"result":"success","value":["ls"]},"env":{"result":"success","value":{"has_added_or_modified_keys_starting_with_dash":false,"added":{},"removed":[],"modified":{}}},"fdinfo":{"0":{"fd":0,"path":"/dev/pts/4","pos":0,"flags":["O_RDWR"],"mnt_id":39,"ino":7,"mnt":"39 36 0:26 / /dev/pts rw,nosuid,noexec,relatime shared:4 - devpts devpts rw,gid=5,mode=600,ptmxmode=000","extra":[]},"1":{"fd":0,"path":"pipe:[205677]","pos":0,"flags":["O_WRONLY"],"mnt_id":16,"ino":205677,"mnt":"Not found. This is probably a pipe or something else.","extra":[]},"2":{"fd":0,"path":"pipe:[205677]","pos":0,"flags":["O_WRONLY"],"mnt_id":16,"ino":205677,"mnt":"Not found. This is probably a pipe or something else.","extra":[]}},"timestamp":1787669675411122028,"cred":{"result":"success","value":{"groups":[209,936,953,962,991,992,1000],"uid_real":1000,"uid_effective":1000,"uid_saved_set":1000,"uid_fs":1000,"gid_real":1000,"gid_effective":1000,"gid_saved_set":1000,"gid_fs":1000}},"cgroup":{"kind":"not-collected"}}
```