Question: I know that with `ps` I can see the list or tree of the current processes running in the system. But what I want to achieve is to "follow" the new processes that are created when using the computer.

As analogy, when you use `tail -f` to follow the new contents appended to a file or to any input, then I want to keep a follow list of the process that are currently being created.

Is this even posible?

Answer: 
If kprobes are enabled in the kernel you can use `execsnoop` from [perf-tools](https://github.com/brendangregg/perf-tools):

In first terminal:

```sh
% while true; do uptime; sleep 1; done

```

In another terminal:

```sh
% git clone https://github.com/brendangregg/perf-tools.git
% cd perf-tools
% sudo ./execsnoop
Tracing exec()s. Ctrl-C to end.
Instrumenting sys_execve
   PID   PPID ARGS
 83939  83937 cat -v trace_pipe
 83938  83934 gawk -v o=1 -v opt_name=0 -v name= -v opt_duration=0 [...]
 83940  76640 uptime
 83941  76640 sleep 1
 83942  76640 uptime
 83943  76640 sleep 1
 83944  76640 uptime
 83945  76640 sleep 1
^C
Ending tracing...

```
The easiest way is to enable system call auditing

See the following link for details，

[Does anyone know a simple way to monitor root process spawn | Server Fault](https://serverfault.com/questions/199654/does-anyone-know-a-simple-way-to-monitor-root-process-spawn)

If you're monitoring all processes, just remove the `-F uid=0` part

Logs are written to `/var/log/audit/audit.log`