{"ts": "2026-11-07T18:04:54+00:00", "source": "auditd", "key": "exec", "audit_key": "tool_exec", "syscall": "execve", "exe": "/usr/bin/bash", "uid": "1001", "pid": "950", "success": "yes", "argv": ["bash", "-c", "/tmp/tool-cmd.sh"], "path": "/bin/bash"}
{"ts": "2026-11-07T18:04:54+00:00", "source": "auditd", "key": "exec", "audit_key": "tool_exec", "syscall": "execve", "exe": "/usr/bin/bash", "uid": "1001", "pid": "950", "success": "yes", "argv": ["/bin/bash", "/tmp/tool-cmd.sh"], "path": "/tmp/tool-cmd.sh"}
{"ts": "2026-11-07T18:04:54+00:00", "source": "auditd", "key": "exec", "audit_key": "tool_exec", "syscall": "execve", "exe": "/usr/bin/python3.13", "uid": "1001", "pid": "950", "success": "yes", "argv": ["/home/tool/.local/ggmcp-venv/bin/python3", "/home/tool/.local/ggmcp-venv/bin/gg-mcp-server"], "path": "/home/tool/.local/ggmcp-venv/bin/gg-mcp-server"}