Linux process monitoring has evolved from /proc polling to eBPF tracepoints
Linux process monitoring has moved through three generations: polling /proc, using ptrace and exec hooks, and now eBPF tracepoints. Early /proc polling is simple and portable but lossy, misses short-lived processes, scales poorly, and lacks parent-child lineage. The ptrace approach gives precise per-syscall visibility but severely slows traced workloads and only covers processes already known to be attached to. Modern eBPF tracepoints run in kernel space without stopping the traced task, providing lossless, kernel-attributed data suited to fleet-wide monitoring, though they require BTF and kernel 5.8 or newer. The article also stresses practical correctness: using short time windows for detection, matching on binary path and inode rather than spoofable names, and keying process state by PID plus start time to handle PID recycling.
