An API for monitoring new PIDs / processes

[User087]

Summary

• OS: Examples below given for Linux but could be generally useful to other OSes using whatever features they provide
• Type: new-api

Description

A system monitoring API for tracking events like processes being created and exiting.

There are a number of LInux kernel features that could be of use in implementing this and that are implemented by some of the existing third-party tools for this purpose. See e.g. https://natanyellin.com/posts/tracking-running-processes-on-linux/ for an overview. The process accounting option (as used by acct) is another one. https://github.com/ColinIanKing/forkstat is an example of a basic implementation using the netlink process connector.

At the moment, the closest thing with psutils would seem to be just polling psutil.pids().

[giampaolo]

Useful links for Linux:

• https://fabiensanglard.net/st/process-events.txt
• https://www.kernel.org/doc/Documentation/connector/connector.txt

Windows:

• https://github.com/zodiacon/ProcMonX
• https://web.archive.org/web/20190304160548/http://blogs.microsoft.co.il/pavely/2018/01/17/procmon-vs-procmonx/

All:

• https://jarekprzygodzki.dev/post/monitor-new-process-creation/