Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Sometimes a process comes and goes faster than I can ps aux, I tried watch -d -n0.1 "ps aux | tail" but again, that's restricted to 1/10th of a second. What I really want is to run a command and follow all new processes, one per line, as they spawn. Even processes that run fast. I know strace has abilities similar to this but I haven't been able to get it to do what I want.

tl;dr : is there a way to log all new processes?

I don't want to know much, no more than a line of ps aux would give me, for the current case I just have a process that's spawned by another and disappears, I want to be able to run it, but I don't know what the command would be. Even knowing new PIDs would be sufficient, since I could figure a script that would take these and run ps | grep on these and give me more info while the process is running (assuming hopefully the process is still around when ps gets going)

share|improve this question

2 Answers 2

up vote 4 down vote accepted

What do you want to know about those processes? If you can control who spawns the processes, strace -feprocess $SHELL will do.

If it's just an overview of their footprint, use process accounting (in the gnu acct package; use the lastcomm command), or higher-level tools like atop's logger mode. In the future, tools like trace and uprobes will be helpful to get detailed info out of the kernel.

share|improve this answer
    
I'm pretty sure the process is spawned either by gnome or X, or one of their lackey processes. I can't be sure though. –  Vasiliy Sharapov Nov 24 '10 at 22:33
2  
Go with lastcomm then. –  Tobu Nov 24 '10 at 22:41
    
Thanks! lastcomm is what I needed. –  Vasiliy Sharapov Jan 31 '11 at 1:21

auditd?

http://linux.die.net/man/8/auditctl

share|improve this answer
    
I thought this was just for files? You can't use it on /proc either –  James Lawrie Nov 25 '10 at 1:26

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.