I am working on system call tracing for host based IDS, i need to trace a process as soon as it entered in the system (a new entry in
/proc). Is there any interrupt or signal or kernel datastructure from where this information can be extracted.
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems. It only takes a minute to sign up.Sign up to join this community