title: Monitor process creation in FreeBSD
body: <p>I'm looking to monitor all the commands that are executed on a FreeBSD system. I already looked at lastcomm which uses process accounting facilities in BSD. Unfortunately, it stores only the first ten characters of each command that is executed. I would ideally want the whole command including the CLI parameters.</p>
  
  <p>Also, for reasons that I would not like to get into, I am working on a FreeBSD 4.x system here so I dont think I will have access to "auditd" or such facilities.</p>
  
  <p>/proc has all the info I require but I am not able to find a good way to monitor procfs for creation and deletion of new nodes.</p>
  
  <p>Edit: Thanks for the input. Unfortunately dtrace isn't an option as I mentioned these are FreeBSD 4.x systems. Next - I did look at the modification time in /proc. It's just that the kqueue doesn't specifically say what file was modified. </p>