process logging without using process accounting
 

I would like to log when a process starts and when it finishes whenever a user starts the process. What ways can this be done? I would prefer not to have to install process accounting for linux.

Thanks Mike

maye some sort of

Why (accounting, suspicion, auditing)?
What kind of user (no shell, unprivileged, wheel group, privileged)?
What kind of process (service, daemon, cronjob, at, userland one-off, background process)?


Any reason why not?

Saavik thanks but I want the tracking to be constant while I am not logged in. I just want to look at the logs when I log in in the morning.

unSpawn:
Accounting, I want to know how long particular users use an app, for example gimp. How often it is started and how long the application is running.
I have root, but I want the logging to be with no shell.
Like I said it is a userland one-off like gimp.

You didn't respond to me asking why you would prefer not to have psacct installed. Other methods would be either relatively slow or inaccurate (shell or d|inotify-based), provide excessive logging (rootsh or equivalant) or otherwise disproportional (syscall logging basically). IMHO for this task it is the ideal tool.

two words: "change control". Accounting is not installed, I would like some sort of indication in the interim while the change control goes through - which will at least take 2 weeks. I will get it installed.

I don't mind slow, I was thinking nohup or some sort of syslogd equivalent. Is that what you mean with shell and syscall? I don't seem to have d|inotify installed either???

One quick 'n dirty method (if you don't have access to the src code) is to rename the actual app to myapp, then put a short shell script called app in its place
remember to

chmod +x app # the shell script

Presumes your users aren't smart enough to directly call the real exec. And there aren't too many scripts you need to write.
A systemtap probe would work, but if you can't get accounting past the change control pixies, a debug kernel would be no chance.

Like I said, quick 'n dirty. Also, because you rename the actual app, the users won't know what its now called unless they have a good reason to to 'check' and discover the 'app' is now a shell script, especially as I said to call it the exact same name, sans .sh extension.