Efficient way to determine when a child process forks or calls exec

[Dan McNulty]

Hi all,

I have been experimenting with ptrace to determine when a child
process forks or calls exec. Particularly, I have explored tracing
every system call entry and exit similar to what the truss utility
does, and for my case, the performance impact of tracing every system
call is too great.

Is there a more efficient way than tracing every system call entry and
exit to determine when a child process forks, calls exec, or creates a
new LWP?

Thanks a lot for your help!
-Dan