A BSD-licensed library for observing the private behavior of a child process.
Mac OS X and Linux are supported.
The following calls are currently observable:
- Process creation with
exec* - File access with
openandclose
More are planned. The library has been designed so that adding support for new calls is easy.
There is a significant performance cost to the observed process, because the details of the calls are sent to the observing process over IPC, and locking is required. However, libvoyeur tries to be as efficient as possible: you only pay a performance penalty for the calls that you actually want to observe.
Just run make. You can check that everything built correctly with make check.
The program doing the observing must link against libvoyeur.
If you link statically, or if the various helper libraries like libvoyeur-exec
are not in the same directory as libvoyeur, you'll need to tell the library
where to find them using voyeur_set_resource_path.
The public API is documented in voyeur.h.
The examples directory contains some sample programs built using
libvoyeur. You can build the examples with make examples.