A monitor for Claude CLI: what files is it accessing, what network connections is it making, and what processes it is spawning.

Uses Linux eBPF tracing tools to attach to Claude CLI processes and log activity per session.

• File access — via opensnoop: every file Claude opens
• Network connections — via tcpconnect: outbound connections as they are made
• Connection lifecycle — via tcplife: connection duration and bytes transferred
• Subprocess execution — via execsnoop: every process Claude spawns

Each Claude session gets its own timestamped directory under LOG_DIR.

Download the .deb from the latest release and install:

sudo apt-get install ./clouseau_*.deb

This installs:

The package depends on bpfcc-tools and procps, which will be pulled in automatically.

sudo systemctl enable --now clouseau

Logs go to /var/log/clouseau/ by default and are also available via journald:

journalctl -u clouseau -f

Usage: clouseau [-v]
  -v  verbose: print session events to stdout (default when tty)

Run directly (requires root or sudo for eBPF tools):

sudo clouseau          # daemon mode, quiet
sudo clouseau -v       # daemon mode, print events to stdout

Clouseau polls for a running claude process every POLL_INTERVAL seconds (default: 5). When found, it attaches all tracers to that PID and logs until the process exits.

Edit /etc/default/clouseau to override defaults:

LOG_DIR=/var/log/clouseau   # where session logs are written
POLL_INTERVAL=5             # seconds between polls for a claude process

These variables can also be set in the environment when running manually:

LOG_DIR=~/my-logs POLL_INTERVAL=2 sudo -E clouseau -v

Each session produces a directory at $LOG_DIR/session_<timestamp>_pid<N>/ containing: