# System-wide TLS monitoring
Running with no PID filter — catches every SSL call on the machine.
sudo proc-trace-tls
proc-trace-tls v0.1.0 lib : /lib/x86_64-linux-gnu/libssl.so.3 pids: all Watching 4 probe(s). Press Ctrl-C to stop. 09:14:22.118 3821 nginx RX SSL_read client-22.ximg.app:58412 09:14:22.119 3821 nginx TX SSL_write client-22.ximg.app:58412 09:14:22.201 14821 curl RX SSL_read api.github.com:443 09:14:22.202 14821 curl TX SSL_write api.github.com:443 09:14:22.310 9204 python3 TX SSL_write pypi.org:443 09:14:22.311 9204 python3 RX SSL_read_ex pypi.org:443 09:14:22.450 22011 node TX SSL_write registry.npmjs.org:443 09:14:22.451 22011 node RX SSL_read registry.npmjs.org:443
# Per-process filter
Watching only a specific curl command's TLS calls.
sudo proc-trace-tls -p $(pgrep curl)
proc-trace-tls v0.1.0 lib : /lib/x86_64-linux-gnu/libssl.so.3 pids: 14821 Watching 4 probe(s). Press Ctrl-C to stop. 14:23:01.441 14821 curl RX SSL_read api.github.com:443 14:23:01.442 14821 curl TX SSL_write api.github.com:443 14:23:01.449 14821 curl RX SSL_read api.github.com:443 14:23:01.451 14821 curl RX SSL_read_ex api.github.com:443 ^C captured 4 TLS events
# Verbose probe registration
Using -v to see exactly which symbols were found and at what offsets.
sudo proc-trace-tls -v
proc-trace-tls v0.1.0 lib : /lib/x86_64-linux-gnu/libssl.so.3 pids: all Registering uprobes on /lib/x86_64-linux-gnu/libssl.so.3... registered: tls_read_SSL_read @ 0x2e440 registered: tls_read_SSL_read_ret @ 0x2e440 registered: tls_write_SSL_write @ 0x2e180 registered: tls_read_SSL_read_ex @ 0x2e5c0 Watching 4 probe(s). Press Ctrl-C to stop.