3 ms·

Facebook's osquery could help here. You just(1) have to implement update functions as well. (1) that's the "just" that doesn't mean "just" :-)