detect start/stop applications

[Koala <koala.gnu@xxxxxxxxxx>]

Hi all,

In kernel space it is possible detect start/stop application creating a 
wrapper on fork/clone/exit system calls. Is there a way to do that in 
user space?

The only technique I know is a polling on proc fs but it has several 
troubles:

1. proc fs not compiled in the kernel.
2. it is necessary perform a polling and this mean I detect start of 
applications after they really start.
3. if the application execution duration is less than the polling 
periodo I am not able to detect the start/stop.

Any suggestions?


--
Kernelnewbies: Help each other learn about the Linux kernel.
Archive:       http://mail.nl.linux.org/kernelnewbies/
FAQ:           http://kernelnewbies.org/faq/