extrace
Trace exec() calls. tldr-pages
On Linux
Linux
Trace all program executions occurring on the system
sudo extraceIdentifyRun a command and only trace descendants of this command
sudo extrace commandIdentifyPrint the current working directory of each process
sudo extrace -dIdentifyResolve the full path of each executable
sudo extrace -lIdentifyDisplay the user running each process
sudo extrace -uIdentify