pspy

Observe process execution through procfs scans triggered by polling and inotify events. Capture timestamp, UID, PID, and command line; missed events remain possible.

Workflow

1. Select the correct architecture. pspy32/pspy64 are static; the smaller s variants depend on libc. Check the downloaded binary's help.
2. Choose an observation window from the job schedule or reproducer. Start with process output; enable filesystem output only when it answers the question.
3. Save the log, correlate events with the triggering action, and stop after the needed observation.

./pspy64 --help
./pspy64 -p -i 1000 > process-observations.log

# Process output plus filesystem events; interval is milliseconds
./pspy64 -pf -i 1000