record_activity
Records what a process or whole machine does step by step—started programs, files opened or changed, TCP connections, and syscalls—to diagnose behavior without stopping or injecting anything.
Instructions
Records what a process (with the processes under it), every process of a name, or the whole machine does for some seconds, step by step like Process Monitor: programs started and how they ended, shared libraries loaded, files opened, read, written, renamed and deleted (only when Anabolic has full access; Linux reports what was done, not what failed), TCP connections with the bytes they carried; with syscalls=true, every system call of a process or program like strace, with a per-call summary like strace -c (full access). Nothing is opened, stopped or injected. Reports progress every second; returns the counts and the steps kept (filter them with kinds, filter, only_failures, only_changes).
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| pid | No | Record this process (and, with with_children, the ones under it and what they start). | |
| name | No | Record every running process of this name, e.g. "chrome.exe". | |
| kinds | No | Kinds of steps to keep: process, file, network, syscall (default all). | |
| limit | No | Steps returned at most, the latest kept (default 300, at most 3000). | |
| filter | No | Words a step's process, path or detail must all contain; "-word" leaves out the steps that contain it. | |
| seconds | No | Seconds to record: 1 to 120 (default 10). | |
| syscalls | No | Every system call too, as strace shows it: the call, its arguments, its result and the time it took (default false). With everything, heavy: often hundreds of thousands a second, and calls a thread was already waiting in, or still is at the end, are counted, not listed. Calls a thread repeats within a second are one step with a count; syscall_summary counts every call. | |
| everything | No | Record the whole machine (what a process repeats within a second is one step with a count; at most 30 seconds). | |
| only_changes | No | Only the steps that change something (writes, deletes, renames, set values, starts). | |
| only_failures | No | Only the steps that failed (access denied, not found...). | |
| with_children | No | With pid: the processes under it too (default true). |