I wrote an eBPF application that is launched and killed by a PAM session script. It uses the PPID to only record commands and arguments associated with that session. My application was heavily influenced by execsnoop:

https://github.com/iovisor/bcc/blob/master/tools/execsnoop.p...