3 ms·

> Following process/thread creation is done via netlink(7). shouldn't ptrace with PTRACE_O_TRACEFORK (etc.) be enough (and much easier)? the high overhead of

by 5- 3y ago

> Following process/thread creation is done via netlink(7). shouldn't ptrace with PTRACE_O_TRACEFORK (etc.) be enough (and much easier)? the high overhead of strace the author notes is due to it doing PTRACE_SYSCALL, which is not needed here.