execsnoop no longer runs on Solaris 11.3 #3
Description
This issue is inherited from Brendan's code, so this is more documenting for the record, but...
In the master branch, execsnoop monitors two tracepoints on line 158: syscall::exec:return and syscall::exece:return.
In Solaris 11, syscall::exec:return is renamed to fbt:s10_brand_s10_exec:return. Therefore, the script does not run as-is in a Solaris 11 native zone (including the global zone). It should still work properly from inside a Solaris 10 branded zone.