Yeah I know about the kernel itself being finished by the time it has to call the userspace init. I'm not so much interested in the kernel initialization stuff itself, but everything from userspace init and onwards like I mentioned. Obviously there must be a way to do this, since how would you debug/trace a potentially slow process (that's supposed to be short-lived/transient) that boots between init (the actual systemd process) and the last process to load before user input (agetty, for the sake of an example). systemd-analyze doesn't go deep enough, as that only shows you processes that systemd kicks off, but not potentially what THOSE processes themselves end up executing. I'm just interested in seeing the process called, it's arguments, and potentially the CPU time it used. auditd works fantastic for this, but ONLY after the daemon has already started.
On Windows side of things you have WPR w/ boot tracing and WPA which gives you the entire picture of all processes (whether permanent or transient) during the boot. From everything I've read, I should be able to see these processes with auditd and the audit=1 kernel flag.
EDIT: I figured out what I'll probably need to do, is that I need to call auditctl in the initramfs. Though feel free to chime in on any additional ways or other tools that accomplish what I'm trying to do.
EDIT2: This was indeed the fix. I just edited my initramfs to include auditctl and have it start capturing the execve SYSCALL just prior to the call to switch_root. I can see all process calls now that I want.
