In Linux you can use eBPF. See https://github.com/iovisor/bcc https://github.com/iovisor/bcc for an easy way to write eBPF, or look for something in the tools/

In Linux you can use eBPF. See https://github.com/iovisor/bcc https://github.com/iovisor/bcc for an easy way to write eBPF, or look for something in the tools/ dir that does what you want. You distro might have these packaged in bcc-tools or similar.