Using trace gadgets
Trace the kernel functions performing socket binding.
Trace security capability checks.
Trace DNS requests.
Trace new processes.
Trace open, read, write and fsync operations slower than a threshold.
Trace mount and umount system calls.
Trace when OOM killer is triggered and kills a process.
Trace open system calls.
Trace signals received by processes.
Trace Server Name Indication (SNI) from TLS requests.
Trace tcp connect, accept and close.
Trace connect system calls.