trace exec() calls system-wide