Question: I know that with `ps` I can see the list or tree of the current processes running in the system. But what I want to achieve is to "follow" the new processes that are created when using the computer.

As analogy, when you use `tail -f` to follow the new contents appended to a file or to any input, then I want to keep a follow list of the process that are currently being created.

Is this even posible?

Answer: 
If kprobes are enabled in the kernel you can use `execsnoop` from [perf-tools](https://github.com/brendangregg/perf-tools):

In first terminal:

```sh
% while true; do uptime; sleep 1; done

```

In another terminal:

```sh
% git clone https://github.com/brendangregg/perf-tools.git
% cd perf-tools
% sudo ./execsnoop
Tracing exec()s. Ctrl-C to end.
Instrumenting sys_execve
   PID   PPID ARGS
 83939  83937 cat -v trace_pipe
 83938  83934 gawk -v o=1 -v opt_name=0 -v name= -v opt_duration=0 [...]
 83940  76640 uptime
 83941  76640 sleep 1
 83942  76640 uptime
 83943  76640 sleep 1
 83944  76640 uptime
 83945  76640 sleep 1
^C
Ending tracing...

```
Some examples of [`bpftrace`](https://github.com/iovisor/bpftrace) usage to achieve the goal.

1. The simplest one is tracing all `exec` calls in the system:

```
sudo bpftrace -e 'tracepoint:syscalls:sys_enter_exec*{ printf("pid: %d, comm: %s, args: ", pid, comm); join(args->argv); }'

```

There are at least two tracepoints you need to watch `sys_enter_execve` and `sys_enter_execveat`. In the example I use the `*` symbol to match both syscalls *(this syntax [works since 2019](https://github.com/iovisor/bpftrace/pull/370))*.
2. One may also want to monitor all threads being created in the system as:

```
sudo bpftrace -e 'kprobe:_do_fork{ printf("pid = %d, comm = %s\n", pid, comm); }'

```

No process arguments for you in this case though, nevertheless it may be useful.

To see the list of all available events execute `bpftrace -l`.