A monitoring interface, includes logic responsive to a pre-fork event, the
pre-fork event responsive to a vfork system call. The pre-fork event
includes indicia that identifies a child process to be created in
accordance with the vfork system call. A method for controlling the
execution of a child process created from a parent process, where the
parent process is monitored by a software tool includes, receiving
indicia that a vfork system call will be executed by the parent process,
suspending execution of the parent process, extracting a process
identifier from the indicia of the vfork system call, the process
identifier corresponding to a child process to be generated by the parent
process when the parent process executes the vfork system call, setting a
process monitor thread to observe the child process, and resuming
execution of the parent process to enable the parent process to execute
past the vfork system call.