RE: process accounting

[Avery Buffington]

>what technique does grsecurity use?  i would think that the
>only way would be to log system calls.  essentially, an strace.

it logs calls to execve()