[08:52] <mncheck> focal 5.14.0-1051-oem x86_64, generic question: trying to come up with something to show uid,euid and command that makes the call to mount.cifs, but using tracefs nop tracer on sys_enter_mount got me the pid only which is gone by the time I try to ps it, could you suggest something?
[08:55] <mncheck> may have got mount.cifs from sys_enter_execve or hist .execname . I'm trying to pin down a stuck expired credential that spams the server without having session process on the client, according to ps
=== philcox_ is now known as philcox