Using trace gadgets
Trace the kernel functions performing socket binding.
Trace security capability checks.
Trace DNS queries and responses.
Trace new processes.
Trace open, read, write and fsync operations slower than a threshold.
Trace mount and umount system calls.
Trace when OOM killer is triggered and kills a process.
Trace open system calls.
Trace signals received by processes.
Trace Server Name Indication (SNI) from TLS requests.
Trace tcp connect, accept and close.
Trace connect system calls.
Trace TCP kernel-dropped packets/segments.
Trace TCP retransmissions.