To really capture any new process, on an x86 chip at least, you'd need to implement some kind of hardware callback to the OS whenever a new Task State Segment (

To really capture any new process, on an x86 chip at least, you'd need to implement some kind of hardware callback to the OS whenever a new Task State Segment (TSS) was created in the GDT. Note however, that this wouldn't capture new threads that are created inside of existing tasks/processes, nor those inside of software emulated virtual machines, and the capture of those, additionally, for logging purposes, might be desirable... But, for future hardware designers out there -- if you're going to create a new CPU, then I think a hardware callback for anytime a new task is created -- would be a great addition for your new CPU... Perhaps such a callback could be done in microcode... Also, this callback should work in all nested VM/protection levels, from the highest level hypervisor, down to the lowest level OS... Anyway, just thinking aloud...