Hello Volodymyr, This is a cut-from-whole-cloth response, made from user-land network programming experience. There are two ways in which a signal can interrupt kevent(). One is by being unexpected, and causing it to return EINTR; the other is by being expected, and being returned as a kernel event. Can you arrange for the watcher of process exits to be interruptible by a signal, and then to read a thread-safe queue of processes to add? If so, can you arrange for the watcher of process starts to put them on the queue and then generate the signal? None of this tells you how to do the locking around the rest of your per-process state, which also needs to be done right. Alternatively, taking a giant leap into left field, does anyone know if Grand Central Dispatch can take input from kqueue? If so, there may be an elegant GCD solution to this problem. Regards, James. On Tue, May 22, 2012 at 7:00 AM, <darwin-kernel-request@lists.apple.com> wrote:

Message: 1 Date: Mon, 21 May 2012 13:10:49 +0200 From: Volodymyr Shcherbyna <volodymyr@shcherbyna.com> To: darwin-kernel@lists.apple.com Subject: getting process exit notifications in kext or how to use        kqueue  efficiently in user mode daemon Message-ID:        <CAPzHgeJ77hppDMTW_cYjUbdigfEA0yOd7AcpnQ9=vTPCgbX0+Q@mail.gmail.com> Content-Type: text/plain; charset="iso-8859-1"

Hello Everyone,

Thanks for reading this and trying to help :).

To make long story short. I am trying to monitor process start & stop in my NKE in order to make associations between processes doing network IO. I need the exit event as I need to clear-up resources associated with the given PID. I saw a simular question here: http://lists.apple.com/archives/darwin-kernel/2010/Jun/msg00018.html and the basic idea is that if you want to get process exit events you should use user daemon with kqueues.

I did a sample prototype and I can see that the kqueues do work for a single process or a set of processes if I know it's pids. The question is how to use it efficiently for the cases when I don't know a finite set of PIDs beforehand? I would like to use single kqueue on a single thread in order to make things efficient as much as possible. What I need is to be able to add new PIDs in a kqueue while it blocks in kevent. I.e., in the simplest scenario:

struct kevent kev; int kq = kqueue(); EV_SET(&kev, pid, EVFILT_PROC, EV_ADD, NOTE_EXIT, 0, NULL); kevent(kq, &kev, 1, NULL, 0, NULL);

How can I add kevent for a new PID while I am blocked in kevent(...) ? I can do a call with timeout and in when I am interrupted I can register for a new set of PIDs, but this way is not free from race conditions and is not efficient.

-- with best regards, Volodymyr.