Re: kqueue EVFILT_PROC and child process pid
Re: kqueue EVFILT_PROC and child process pid
- Subject: Re: kqueue EVFILT_PROC and child process pid
- From: Damien Sorresso <email@hidden>
- Date: Sun, 11 Oct 2009 12:40:01 -0700
On Oct 11, 2009, at 9:18 AM, Rustam Muginov wrote:
> Then using kqueue with EVFILT_PROC i can get the notification that observed process forked/execed a child process.
Yes.
> How could I know the pid of child process?
Unfortunately, you cannot get this information directly from kqueue(3). You can do some sysctl(3) magic, but that's a very large club for this problem.
> Additionaly, how much overhead for the system adds observing all of the running processes? Is it any other, more lightweight way to watch for newer spawned processes then kqueue?
On Mac OS X, launchd attaches kevents to most PIDs on the system. It's a very lightweight mechanism, and your process' contribution to this overhead in the kernel would negligible compared to what's already there anyway.
--
Damien Sorresso
BSD Engineering
Apple Inc.
_______________________________________________
Do not post admin requests to the list. They will be ignored.
Darwin-dev mailing list (email@hidden)
Help/Unsubscribe/Update your Subscription:
This email sent to email@hidden