|
First I would question why the monitor part needs to be a kernel module (unless it does something that is kernel specific, although even then you might find the ptrace facilities provide what you need).
If it is going to be a kernel module, you'd probably want to insert it at the start and remove it at the end. So perhaps you would have a main component, one that inserts the system module, starts the application, waits on the application process to terminate, queries the system module and reports the results (or they could be logged), and then unloads the system module.
Last edited by neonsignal; 08-17-2009 at 01:32 AM.
|