Tell me more ×  I Would like to capture the process entry, exit
and maintain a log for the entire system (probably a daemon
process).  One approach was to read /proc file system
periodically and maintain the list, as I do not see the
possibility to register inotify for /proc. Also, for desktop
applications, I could get the help of dbus, and whenever client
registers to desktop, I can capture.  But for non-desktop
applications, I don't know how to go ahead apart from reading
/proc periodically.  Kindly provide suggestions.  share|improve
this question You're probably going to have to write a kernel
module; I don't think you can do this from userspace accurately.
–  Dan Fego Jan 11 '12 at 13:51 You could try using ptrace (
which will allow you to trap syscalls just like gdb can. You'll
need to run your program as root. I've no idea how 'heavy' such
an approach would be for the entire system though. –  Mathew
Hall Jan 11 '12 at 13:58 Maybe SystemTap: ? –  Douglas Leeder
Jan 11 '12 at 14:02 add comment  4 Answers