Just a quick test with LTTng (lttngtrace part of lttngtop) : http://pastebin.com/rvebt7rp

I know kernel tracing is cheating for this kind of backdoor, but it can be easy ;-)