Hello,
I'd like to know how to stop a process immediately after its creation.
What I have to do is to track all the system call invoked by a "monitored" process. The monitor needs the PID of the monitored process.
Some of you might say, start the monitored and provide to it the PID of the monitored process. Unfortunately,
it is not that easy (I'm using systemtap for monitoring, I don't know if u are familiar with it). The monitored can be started only after the PID is known. As an example, try to imagine that we want to monitor all the system calls invoked by the "top" command. My current workflow goes as follows:
start top
start monitor
collect data

Starting the monitor takes some time, in the meanwhile some calls are not logged. Therefore, I thought of doing something like this:

start top, pause it (immediately for some seconds)
start monitor
top resumes, the monitor is ready to collect data.

How do I pause a monitor for some seconds right after its creation (it shouldn't execute any instruction).
Thank you in advance

Unless it ignores TSTP: SIGSTOP / SIGCONT?

Perhaps you could write a simple wrapper that pauses for several seconds (or waits for some event) and then exec()s the program you want to monitor. You'll catch some extra stuff at the beginning, but shouldn't miss anything.

(No, I've never used systemtap, so perhaps this is totally wrong.)