I am writing a wrapper application to bash scripts and want the application to keep a track of which tools/processes have been launched from user scripts. I would like to know what is the best way to determine the list of child processes that were spawned of this parent process.
I tried
- Periodically invoking ps command and building a process tree (like ps -ejH) but this misses out on processes that ran to completion very quickly.
- Using a tool like forkstat that uses the proc connector interface, but that would only run with elevated privileges. While this gives the correct data, running as sudo would not work in my case?
Any suggestions how this can be achieved?
Best Answer
If you're using Linux, you can use
strace
to trace system calls used by a process. For example:You can see that the script forked off three processes (PIDs 4818, 4819, 4820) using the
clone(2)
system call, and theexecve(2)
system calls in those forked off processes show the commands executed.-e fork,vfork,clone,execve
limits strace output to these system calls-f
follows child processes-b execve
detaches from a process when theexecve
is reached, so we don't see further tracing of child processes.