This issue is inherited from Brendan's code, so this is more documenting for the record, but...
In the master branch, execsnoop monitors two tracepoints on line 158: syscall::exec:return and syscall::exece:return.
In Solaris 11, syscall::exec:return is renamed to fbt:s10_brand_s10_exec:return. Therefore, the script does not run as-is in a Solaris 11 native zone (including the global zone). It should still work properly from inside a Solaris 10 branded zone.
This issue is inherited from Brendan's code, so this is more documenting for the record, but...
In the master branch, execsnoop monitors two tracepoints on line 158:
syscall::exec:returnandsyscall::exece:return.In Solaris 11,
syscall::exec:returnis renamed tofbt:s10_brand_s10_exec:return. Therefore, the script does not run as-is in a Solaris 11 native zone (including the global zone). It should still work properly from inside a Solaris 10 branded zone.