title: Getting Notified when a process (daemons & applications included) are created in MAC
body: <p>I am trying to detect / get notified whenever a new process is created in MAC. The easiest way is to poll all the processes and see if a new process has been launched but that is too time consuming and i wanted to know if i could somehow get some notification whenever a new process is launched using "forked" and "execve". Here is what i have already found :</p>
  
  <p>On how a new process is launched in MAC :</p>
  
  <p>OS X is a variety of Unix. New processes are created with the fork() system call. This creates an almost identical copy of the process that makes the call (the difference is that fork returns 0 in the child and the pid of the child in the parent). It's then normal to use one of the exec() syscalls in the child to transform the child into a process running a different executable.
  <a href="https://stackoverflow.com/questions/7568605/how-is-new-application-launched-on-mac">How is new application launched on Mac?</a></p>
  
  <p>On getting the list of all processes through polling</p>
  
  <p><a href="http://www.cocoabuilder.com/archive/cocoa/92971-bsd-processes-with-code.html" rel="nofollow noreferrer">http://www.cocoabuilder.com/archive/cocoa/92971-bsd-processes-with-code.html</a></p>
  
  <p>I have also gone through kAuth kext thing, but it seems beyond my level unless i have some example code for made simple so that i can understand on how to generate the kext and use it in a sample app.
  <a href="https://developer.apple.com/library/mac/technotes/tn2127/_index.html" rel="nofollow noreferrer">https://developer.apple.com/library/mac/technotes/tn2127/_index.html</a></p>
  
  <p>NSWorkspace has a notifier but that is only true for applications and not for all processes.</p>
  
  <p>Any tutorial/ sample code with some basic understanding on how to go about this problem, will be greatly appreciated.</p>