How to be Notified when a Thread is Created in the System

Question

I would like to create a C/C++ program that is informed in "real-time" (i.e. as fast as possible) when a thread is created in the system (not in the current process):

• new thread in an existing process
• new process

I would like a solution working on Linux. Even better if it is portable on any UNIX.

• Is there a POSIX API that I can use?
• Is it possible to get this information from "anywhere" in /sys/kernel?
• Any other solution?

Answer 1

There are no POSIX interfaces for anything related to system monitoring/administration/whatever and probably there are no de facto portable interfaces of the sort either. Most definitely there is nothing portable to get notified about arbitrary thread creation.

There are 2 basic things you can do on Linux:

• so called proc connector. Personally, I've never played with it, but apparently it kind of works
• systemtap

However, I strongly suggest you explain what do you need/want this for. A crucial note is that whatever was created can be gone before you get to act on the information (apart from systemtap case, as long as you keep all the actions within the probe).