Question: I know that with `ps` I can see the list or tree of the current processes running in the system. But what I want to achieve is to "follow" the new processes that are created when using the computer.

As analogy, when you use `tail -f` to follow the new contents appended to a file or to any input, then I want to keep a follow list of the process that are currently being created.

Is this even posible?

Answer: 
Some examples of [`bpftrace`](https://github.com/iovisor/bpftrace) usage to achieve the goal.

1. The simplest one is tracing all `exec` calls in the system:

```
sudo bpftrace -e 'tracepoint:syscalls:sys_enter_exec*{ printf("pid: %d, comm: %s, args: ", pid, comm); join(args->argv); }'

```

There are at least two tracepoints you need to watch `sys_enter_execve` and `sys_enter_execveat`. In the example I use the `*` symbol to match both syscalls *(this syntax [works since 2019](https://github.com/iovisor/bpftrace/pull/370))*.
2. One may also want to monitor all threads being created in the system as:

```
sudo bpftrace -e 'kprobe:_do_fork{ printf("pid = %d, comm = %s\n", pid, comm); }'

```

No process arguments for you in this case though, nevertheless it may be useful.

To see the list of all available events execute `bpftrace -l`.
There are multiple Linux APIs that you can use to do this and multiple usermode tools that use the various APIs. Here are some of the APIs:

* Netlink process connector - this an API to do precisely what you want but there are issues tracking detailed information short-lived processes
* audit API - a kernel API enabled by default on most distributions which can send events to usermode for every syscall (if you go this route you need to track exec-like and fork-like syscalls)
* tracepoints and kprobes - two kernel debugging APIs which can be used to get information on events about process lifecycle
* ebpf based solutions - can be used in conjunction with tracepoints/kprobes to filter the - events in kernel or run various logic
* ptrace based solutions - these include simple ptrace debugging as well as the seccomp API

There are really too many details to properly compare these options in a single StackOverflow answer, but [I've written about this in detail elsewhere.](https://natanyellin.com/posts/tracking-running-processes-on-linux/)