Re: Detecting process creation/deletion

On Thu, 19 Jan 2006, Kasper Dupont murmured woefully:
> Nix wrote:
>>
>> Can't you use the process events connector to do this?
>
> Maybe it can. I didn't know about that feature.

It's very new, arriving in 2.6.15.

Myself I keep an eye on <http://wiki.kernelnewbies.org/LinuxChanges/>
to spot these new things coming down the pipe (very occasionally with
actual userspace support; I hope some turns up for subtree-shared
mounts. I guess if I really needed it I'd add it).

(I suppose I should help keep that wiki page updated, too.)

>> (Regardless, the process events connector patch makes it pretty
>> obvious which bits to patch:
>
> Yes. Actually I'd say if you started looking for the place to
> put such a hook, you would be bound to come across this
> process events connector feature.

.... and the patch then tells you where to put your other hooks :)

> Seems like it. Guess I should figure out what this feature can
> be used to and update one or two questions in the FAQ to include
> a new way to do it based on this feature.

I think the idea was that top and things like that don't need to
constantly scan /proc anymore but can just look out for events
on the right netlink socket to tell them what to manipulate.

(Am I the only person who thinks that Linux has gone from having too few
ways to talk to userspace to too many? I mean, we've got procfs, sysfs,
relayfs, configfs, debugfs, netlink sockets, read-write-and-mmap() on
device files, and ioctls, and there's probably something new by now
that I'd forgotten about...)

--
`Logic and human nature don't seem to mix very well,
unfortunately.' --- Velvet Wood
.