Yes, there is a kernel facility: the audit subsystem. The
auditd daemon does the logging, and the command
auditctl sets up the logging rules. You can log all calls to a specific system alls, with some filtering. If you want to log all commands executed and their arguments, log the
execve system call:
auditctl -a exit,always -S execve
To specifically trace the invocation of a specific program, add a filter on the program executable:
auditctl -a exit,always -S execve -F path=/usr/bin/rrdtool
The logs show up in
/var/log/audit.log, or wherever your distribution puts them. You need to be root to control the audit subsystem.
For debugging purposes, replacing the program by a wrapper script gives you more flexibility to log things like the environment, information about the parent process, etc.