Method and apparatus for passive process monitoring

摘要

Method or apparatus for passive process monitoring is described. One aspect of the invention relates to monitoring a process executing on a computer system. An operating system is instructed to report at least one event related to process termination. Termination of the process is detected in response to a reported instance of the at least one event by the operating system. A notification is provided to an agent in the computer system that the process has terminated.