How can I log all process launches in Linux?

Your starting point should be auditd.

Try something like this:

apt-get install auditd
auditctl -a task,always
ausearch -i -sc execve

I needed to do this, except (1) I didn't need the time and (2) I was only interested in processes that are started by a given process, and its children and subsequent descendants. Also, in the environment I was using, it wasn't possible to get auditd or accton, but there was valgrind.

Prefix the following to the process of interest on the command line:

valgrind --trace-children=yes

The information you need will be in the log output displayed on STDERR.


You could use snoopy for this.

It is very simple to install, and since 2.x it can log arbitrary data (arguments, environmental variables, cwd, etc.).

Disclosure: Snoopy maintainer here.

Tags:

Linux

Logging