1

I'm trying to identify what child processes a program spawns during execution. Ideally it will include things such as the command line being used to launch. Effectively, I'm looking for the OSX equivalent of Process Monitor by Sysinternals.

It needs to have at least some form of logging capability as the subprocesses are short lived, so they are unable to be captured / viewed in a normal application such as Activity Monitor (if I understand Activity Monitor's limitations correctly).

Is anyone aware of a program on OSX with this capability?

Thank you.

Improve this question
5
  • Activity Monitor has the ability to view processes hierarchically; by process owner. Does this not meet your needs? If not, can you post specifically what you're looking for with an edit. Please remember we are Unix folks over here - referencing a Windows utility severely limits your population sample of people familiar with both.
    – Allan
    Aug 9 at 1:36
  • Thanks for you feedback. Edited. As the edit suggests these are short lived processes that wouldn't typically show in a GUI style program such as Activity Monitor. As a random example imagine an application that executed "id" behind the scenes. It's only present for fractions of a second.
    – Peleus
    Aug 9 at 2:33
  • That sounds like process auditing (similar to auditd in Linux?). macOS has OpenBSM though I don’t know if this is the right solution.
    – Allan
    Aug 9 at 3:09
  • Thank you, searching OpenBSM lead me to osquery which is exactly the type of thing I required. Much appreciated. Feel free to put that as an answer if you want the credit for it.
    – Peleus
    Aug 9 at 3:35
  • I’m just happy you found a solution. Go ahead and write up the answer as it pertains to your environment. Oh, and Welcome to Ask Different!
    – Allan
    Aug 9 at 3:56

1 Answer 1

Reset to default
3

So the solution (lead there via Allan) was to utilise OSQuery (https://www.osquery.io/). This is available on OSX. I could obtain the information I was looking for by running the following commands.

sudo osqueryi --disable_audit=false --disable_events=false --audit_allow_config

followed by the query

select * from process_events

I hope it helps someone in the same situation!

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .