Use eBPF to get events of new created processes

[izissise]

Use eBPF to get events on newly created processes (https://blog.yadutaf.fr/2016/03/30/turn-any-syscall-into-event-introducing-ebpf-kernel-probes/)

Maybe this could be activated with a CLI flags, so older kernels are still supported using current starting method

https://github.com/iovisor/bcc/blob/master/tools/execsnoop.py

[aviallon]

Very interesting. Thank you for that :)