17.13.1. CONFIG_PROC_EVENTS
Logs proc events such as process creation to a netlink socket.
We then have a userland program that listens to the events and prints them out:
# ./linux/proc_events.out & # set mcast listen ok # sleep 2 & sleep 1 fork: parent tid=48 pid=48 -> child tid=79 pid=79 fork: parent tid=48 pid=48 -> child tid=80 pid=80 exec: tid=80 pid=80 exec: tid=79 pid=79 # exit: tid=80 pid=80 exit_code=0 exit: tid=79 pid=79 exit_code=0 echo a a #
Source: userland/linux/proc_events.c
TODO: why exit: tid=79 shows after exit: tid=80?
Note how echo a is a Bash built-in, and therefore does not spawn a new process.
TODO: why does this produce no output?
./linux/proc_events.out >f &
TODO can you get process data such as UID and process arguments? It seems not since exec_proc_event contains so little data: https://github.com/torvalds/linux/blob/v4.16/include/uapi/linux/cn_proc.h#L80 We could try to immediately read it from /proc, but there is a risk that the process finished and another one took its PID, so it wouldn’t be reliable.