Can I cause only APP_TRACED events to show up in the RootCause Log?
Yes, by turning verbose logging off. This is done on Windows with the DOS command rootcause on quiet and on Unix with: rootcause register -s verbose -e off Also, on Unix, you can set the environment variable APROBE_LD_AUDIT_VERBOSE=FALSE in a shell and it will disable logging of all commands started in that shell and its subshells. This trick is used by the rootcause_status script.