Question: I know that with `ps` I can see the list or tree of the current processes running in the system. But what I want to achieve is to "follow" the new processes that are created when using the computer.

As analogy, when you use `tail -f` to follow the new contents appended to a file or to any input, then I want to keep a follow list of the process that are currently being created.

Is this even posible?

Answer: 
Some examples of [`bpftrace`](https://github.com/iovisor/bpftrace) usage to achieve the goal.

1. The simplest one is tracing all `exec` calls in the system:

```
sudo bpftrace -e 'tracepoint:syscalls:sys_enter_exec*{ printf("pid: %d, comm: %s, args: ", pid, comm); join(args->argv); }'

```

There are at least two tracepoints you need to watch `sys_enter_execve` and `sys_enter_execveat`. In the example I use the `*` symbol to match both syscalls *(this syntax [works since 2019](https://github.com/iovisor/bpftrace/pull/370))*.
2. One may also want to monitor all threads being created in the system as:

```
sudo bpftrace -e 'kprobe:_do_fork{ printf("pid = %d, comm = %s\n", pid, comm); }'

```

No process arguments for you in this case though, nevertheless it may be useful.

To see the list of all available events execute `bpftrace -l`.
**TL;DR**: use `execnsoop`.

---

* Check that KPROBES are enabled in the Kernel

```
$ zgrep CONFIG_KPROBES= /boot/config-$(uname -r) /proc/config* 2> /dev/null
/boot/config-4.15.0-64-generic:CONFIG_KPROBES=y

```
* Install [BPF Compiler Collection (BCC)](https://github.com/iovisor/bcc)

	+ For Debian/Ubuntu the package `linux-headers-*` is also needed:

	```
	sudo apt-get install bpfcc-tools linux-headers-$(uname -r)

	```
	+ For other distributions see [Installing BCC](https://github.com/iovisor/bcc/blob/master/INSTALL.md)
* Run execsnoop ([examples and options](https://github.com/iovisor/bcc/blob/master/tools/execsnoop_example.txt))

```
root@ubuntu ~ # execsnoop-bpfcc -tx
TIME(s) PCOMM            PID    PPID   RET ARGS
5.773   ping             13027  12847    0 /bin/ping hostname

```