I am intercepting three tracepoints in an eBPF program: sched_wakeup_new, sys_enter_execve, and sys_exit_execve. To test it out, I spawned a bash shell and ran something like "ps -aux | grep exe". I think I'm misunderstanding how the two events relate to each other. Here's an example result (not actual data). Time | PID | Event | Name 1 | 5 | sched_wakeup_new | bash 1 | 5 | sched_wakeup_new | bash 4 | 10 | sys_enter_execve | ps 6 | 12 | sys_enter_execve | grep 10 | 10 | sys_exit_execve 14 | 12 | sys_exit_execve My question: why do ps and grep not trigger sched_wakeup_new? When would sched_wakeup_new actually be triggered or not triggered? I assumed it would trigger an event for each new process that's created.
