On Sat, 2004-11-13 at 12:18 -0500, Owen Taylor wrote:
Moving beyond that would probably involve instrumenting the kernel to give notification of process start and termination (possibly providing times(2) style information on termination) to provide visibility for processes that run for too short a time to be picked up by polling. Better kernel reporting of disk utilization might also be needed.
fwiw the kernel rpms have a patch that print all the files that get opened and the programs that get execed; the patch isn't applied by default but it's not hard to change that for running experiments...