Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Sometimes a process comes and goes faster than I can ps aux, I tried watch -d -n0.1 "ps aux | tail" but again, that's restricted to 1/10th of a second. What I really want is to run a command and follow all new processes, one per line, as they spawn. Even processes that run fast. I know strace has abilities similar to this but I haven't been able to get it to do what I want.

tl;dr : is there a way to log all new processes?

I don't want to know much, no more than a line of ps aux would give me, for the current case I just have a process that's spawned by another and disappears, I want to be able to run it, but I don't know what the command would be. Even knowing new PIDs would be sufficient, since I could figure a script that would take these and run ps | grep on these and give me more info while the process is running (assuming hopefully the process is still around when ps gets going)

share|improve this question
up vote 6 down vote accepted

What do you want to know about those processes? If you can control who spawns the processes, strace -feprocess $SHELL will do.

If it's just an overview of their footprint, use process accounting (in the gnu acct package; use the lastcomm command), or higher-level tools like atop's logger mode. In the future, tools like trace and uprobes will be helpful to get detailed info out of the kernel.

share|improve this answer
I'm pretty sure the process is spawned either by gnome or X, or one of their lackey processes. I can't be sure though. – Vasiliy Sharapov Nov 24 '10 at 22:33
Go with lastcomm then. – Tobu Nov 24 '10 at 22:41
Thanks! lastcomm is what I needed. – Vasiliy Sharapov Jan 31 '11 at 1:21


share|improve this answer
I thought this was just for files? You can't use it on /proc either – James L Nov 25 '10 at 1:26
Can you give an example? – hek2mgl Feb 18 '15 at 10:42

Snoopy might be the right tool for your use case.

If you need simple logger and you are NOT looking for security/auditing solution, then Snoopy might be it.

Disclosure: Snoopy maintainer here.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.