site_archiver@lists.apple.com Delivered-To: darwin-dev@lists.apple.com Then using kqueue with EVFILT_PROC i can get the notification that observed process forked/execed a child process. Yes that is correct. Additionaly, how much overhead for the system adds observing all of the running processes? Is it any other, more lightweight way to watch for newer spawned processes then kqueue? See this technote: http://developer.apple.com/mac/library/technotes/tn/tn2050.html Ryan _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-dev mailing list (Darwin-dev@lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-dev/site_archiver%40lists.appl... How could I know the pid of child process? I am guessing by this statement and the one below you are misunderstanding what a child process is. A child process is a process that you yourself created using fork/exec. Therefore, you know the PID because that's the PID returned from fork(). You cannot watch for all processes, only processes you created. After you fork, you can add a kqueue to watch for the new process' death, in lieu of waitpid() or a SIGCHLD signal. You cannot however sit there, watching for any random process' death. Mac OS X has no such mechanism, AFAIK. Depending on what processes you care about, it might be possible to watch process creation/deaths for all processes of a certain type. But the mechanisms I am aware of only work on GUI processes, not faceless (daemon) processes--in short, it only works on processes that connect to the WindowServer, and only in the same bootstrap context as your own application, meaning you will need to have multiple instances of the application running for every user logged into the system. This email sent to site_archiver@lists.apple.com