site_archiver@lists.apple.com Delivered-To: Darwin-dev@lists.apple.com On Oct 11, 2009, at 9:18 AM, Rustam Muginov wrote:
Then using kqueue with EVFILT_PROC i can get the notification that observed process forked/execed a child process.
Yes.
How could I know the pid of child process?
Unfortunately, you cannot get this information directly from kqueue(3). You can do some sysctl(3) magic, but that's a very large club for this problem.
Additionaly, how much overhead for the system adds observing all of the running processes? Is it any other, more lightweight way to watch for newer spawned processes then kqueue?
On Mac OS X, launchd attaches kevents to most PIDs on the system. It's a very lightweight mechanism, and your process' contribution to this overhead in the kernel would negligible compared to what's already there anyway. -- Damien Sorresso BSD Engineering Apple Inc. _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-dev mailing list (Darwin-dev@lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-dev/site_archiver%40lists.appl... This email sent to site_archiver@lists.apple.com