Detect new process creation instantly in linux

Question

I am trying to create an application in userspace that sets affinity of processes. I would like the program to be triggered immediately every time a new pid/tid is spawned by the kernel. I am attempting to write to a file node under /proc from the do_fork() method in the kernel but I feel that it may have too much overhead.

Does anyone know any alternatives to detect a new process creation immediately after it is spawned?

If monitoring do_fork() is the way to go, would a call back to an userspace program via a system call be faster that using a fs node to communicate?

Answer 1

Forkstat is a program that logs process fork() [among other things] Install it:

$ sudo apt-get install forkstat

Use it to log "fork" events:

$ forkstat -e fork