I am working on system call tracing for host based IDS, i need to trace a process as soon as it entered in the system (a new entry in /proc). Is there any interrupt or signal or kernel datastructure from where this information can be extracted.

closed as not a real question by Mat, slm, jasonwryan, vonbrand, Ulrich Dangel May 10 '13 at 11:56

It's difficult to tell what is being asked here. This question is ambiguous, vague, incomplete, overly broad, or rhetorical and cannot be reasonably answered in its current form. For help clarifying this question so that it can be reopened, visit the help center. If this question can be reworded to fit the rules in the help center, please edit the question.

  • @JMoore Please elaborate and make that an answer. – jlliagre May 10 '13 at 8:05
  • What operating system and computer architecture? – Stéphane Chazelas May 10 '13 at 9:59

On Linux, you can use the audit infrastructure. Install the auditd package and add rules for the system calls you want to trace and for which process/user or other criteria.

Not the answer you're looking for? Browse other questions tagged or ask your own question.