Question: I know that with `ps` I can see the list or tree of the current processes running in the system. But what I want to achieve is to "follow" the new processes that are created when using the computer.

As analogy, when you use `tail -f` to follow the new contents appended to a file or to any input, then I want to keep a follow list of the process that are currently being created.

Is this even posible?

Answer: 
The easiest way is to enable system call auditing

See the following link for details，

[Does anyone know a simple way to monitor root process spawn | Server Fault](https://serverfault.com/questions/199654/does-anyone-know-a-simple-way-to-monitor-root-process-spawn)

If you're monitoring all processes, just remove the `-F uid=0` part

Logs are written to `/var/log/audit/audit.log`
**TL;DR**: use `execnsoop`.

---

* Check that KPROBES are enabled in the Kernel

```
$ zgrep CONFIG_KPROBES= /boot/config-$(uname -r) /proc/config* 2> /dev/null
/boot/config-4.15.0-64-generic:CONFIG_KPROBES=y

```
* Install [BPF Compiler Collection (BCC)](https://github.com/iovisor/bcc)

	+ For Debian/Ubuntu the package `linux-headers-*` is also needed:

	```
	sudo apt-get install bpfcc-tools linux-headers-$(uname -r)

	```
	+ For other distributions see [Installing BCC](https://github.com/iovisor/bcc/blob/master/INSTALL.md)
* Run execsnoop ([examples and options](https://github.com/iovisor/bcc/blob/master/tools/execsnoop_example.txt))

```
root@ubuntu ~ # execsnoop-bpfcc -tx
TIME(s) PCOMM            PID    PPID   RET ARGS
5.773   ping             13027  12847    0 /bin/ping hostname

```