I am working on system call tracing for host based IDS, i need to trace a process as soon as it entered in the system (a new entry in /proc). Is there any interrupt or signal or kernel datastructure from where this information can be extracted.

  • @JMoore Please elaborate and make that an answer. – jlliagre May 10 '13 at 8:05
  • What operating system and computer architecture? – Stéphane Chazelas May 10 '13 at 9:59

On Linux, you can use the audit infrastructure. Install the auditd package and add rules for the system calls you want to trace and for which process/user or other criteria.

| improve this answer | |

Not the answer you're looking for? Browse other questions tagged or ask your own question.