Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a situation in which I need to monitor processes starting. I have found lots of ways to see what processes are running at any given moment (e.g. by polling), but sometimes processes start and end between polling intervals.

I need to know every process that ever starts (even if it's not running anymore - essentially, some way of logging every "start process"); best of all, I need a way to do it on both a Windows machine, and a way to do it on a Linux box.

share|improve this question

closed as too broad by Mike Pennington, MadHatter, mdpc, Ward, Rex Dec 12 '13 at 5:44

There are either too many possible answers, or good answers would be too long for this format. Please add details to narrow the answer set or to isolate an issue that can be answered in a few paragraphs.If this question can be reworded to fit the rules in the help center, please edit the question.

WHY? -- What specific, practical problem are you trying to solve? – voretaq7 Dec 9 '13 at 18:12
The specific practical application was to observe software being built and identify every source file (and some associated settings), by seeing the compiler being called and taking the compilation information from the process command line. – Moschops Dec 1 '14 at 20:09

The two platforms' process models are so different that a unified tool for them doesn't seem possible. There are several dozen commercial windows tools for this, most of which ultimately run off of the performance counter system, which you could just use directly.

In the Linux world, you can do this if BSD Process Accounting is enabled in your kernel; the userland tool I see most often for this is auditd, from RedHat.

share|improve this answer
Unified way not needed; as stated, I need a way to do it on a Windows machine, and a way to do it on a Linux machine. – Moschops Dec 1 '14 at 20:09

Not the answer you're looking for? Browse other questions tagged or ask your own question.