On Sat, 2004-11-13 at 12:18 -0500, Owen Taylor wrote:
Moving beyond that would probably involve instrumenting the kernel
to
give notification of process start and termination (possibly providing
times(2) style information on termination) to provide visibility for
processes that run for too short a time to be picked up by
polling. Better kernel reporting of disk utilization might also be
needed.
fwiw the kernel rpms have a patch that print all the files that get
opened and the programs that get execed; the patch isn't applied by
default but it's not hard to change that for running experiments...