Re: kqueue EVFILT_PROC and child process pid
Re: kqueue EVFILT_PROC and child process pid
- Subject: Re: kqueue EVFILT_PROC and child process pid
- From: Ryan McGann <email@hidden>
- Date: Sun, 11 Oct 2009 12:15:29 -0700
Then using kqueue with EVFILT_PROC i can get the notification that
observed process forked/execed a child process.
Yes that is correct.
How could I know the pid of child process?
I am guessing by this statement and the one below you are
misunderstanding what a child process is. A child process is a process
that you yourself created using fork/exec. Therefore, you know the PID
because that's the PID returned from fork().
Additionaly, how much overhead for the system adds observing all of
the running processes? Is it any other, more lightweight way to watch
for newer spawned processes then kqueue?
You cannot watch for all processes, only processes you created. After
you fork, you can add a kqueue to watch for the new process' death, in
lieu of waitpid() or a SIGCHLD signal. You cannot however sit there,
watching for any random process' death. Mac OS X has no such
mechanism, AFAIK.
Depending on what processes you care about, it might be possible to
watch process creation/deaths for all processes of a certain type. But
the mechanisms I am aware of only work on GUI processes, not faceless
(daemon) processes--in short, it only works on processes that connect
to the WindowServer, and only in the same bootstrap context as your
own application, meaning you will need to have multiple instances of
the application running for every user logged into the system.
See this technote:
http://developer.apple.com/mac/library/technotes/tn/tn2050.html
Ryan
_______________________________________________
Do not post admin requests to the list. They will be ignored.
Darwin-dev mailing list (email@hidden)
Help/Unsubscribe/Update your Subscription:
This email sent to email@hidden