Process & Resource Monitoring (Top/Htop/Ps/Systemd)

Catching processes that only exist for a split second

🧩 The Challenge

Dealing with a recurring cron job or a weird script that crashes so fast you can never actually catch it in ps or top is enough to drive anyone to drink. I’ve spent whole afternoons waiting for a race condition to show up in a process list just to see what the command line arguments actually were.

💡 The Fix

Use the audit subsystem to trigger a signal or log the event the moment the kernel spawns the process, because it’s much faster than any human reaction time. You’ll get an exact record of the command line and the parent process ID without having to stare at a terminal window.

auditctl -a exit,always -F arch=b64 -S execve
ausearch -sc execve --format text

⚙️ Why It Works

By hooking into the system call interface directly at the kernel level, you aren’t reliant on user-space polling which is almost always too slow for short-lived spikes. This makes the OS do the heavy lifting for you so you can just read the logs later.

🚀 Pro-Tip: Don’t leave these rules enabled forever unless you want your disk filled with audit logs in about twenty minutes.

Linux Tips & Tricks | © ngelinux.com | 9/17/2026