Monitoring running processes

[kaima]

Hi all,

What I want to make is a program that basically watches and stores the time that any processes in a system start or stop. Is there C lib functions available for catching the events when some processes start or stop?

[wje_lf]

There have been no takers here for eight hours, so I'm going to stick my oar in, and probably also my foot in my mouth.

I assume here that you want to write a user application, as opposed to messing with the kernel. Under that assumption, I'm going to stick my neck out and say that there is no way to guarantee that a user application can catch all occurrences of a process starting and finishing. You could modify the kernel, I suppose, to provide hooks for this. That would be a major project.

Your program can also sit there and spin (optionally sleeping for a small period of time), checking /proc for new processes. But there's no guarantee that you'll catch all the very short-lived ones.

You can at least detect that you missed some processes. Process numbers are assigned as ascending integers. When you get to a maximum process number, the new process numbers wrap around at 2, skipping those which are already in use. So you can predict what process number should be used next. If that process number is skipped (there might be more than one skipped process number), then you know that your program hasn't been fast enough at this point.

And I know of no libraries that can do this for you.

Hope this helps.

[kaima]

Sorry for no reply such a long time for my own thread.
Thanks wje_lf very much for your idea. It makes much sense to me.
I am trying to make it in kernel level, just do not know which place is the best place for hacking yet But I will try.