Search code examples
linuxmoduleprocesskernelmonitor

How to monitor process creation and statistics using kernel module


I wrote a kernel module to monitor cpu and memory time series. Additionally to that, I would like to log all process creations (and their meta date like pid, cmdline, ...) and also exists with their statistics like total I/O and CPU usage.

The main questions is: Can I create a kind of listener to process creation and exit? Especially on exit, I would also need the meta information for the process. How can this be done?


Solution

  • What you're describing sounds eerily like the Linux process accounting system, which already exists in the kernel. If it isn't an exact fit, your best bet will be to consider extending it, rather than building something entirely new.

    Another existing system to look at will be the process events connector, which can be used to notify userspace processes when other processes are created and exit.