This is the previous sample code running on a system. Adding probes of exec() and exit() calls may give some additional insight into what is happening here (if this were an actual point of interest).

I rsh logged into the system to show a more interesting thread of fork() calls than the shell running ÒlsÓ over and over.

It would be nice to offer a (wall clock) timestamp that could be matched with wall time for these events. ProbeVue does not currently offer this capability (other than reading the kernel time variable). There is no option within ProbeVue for conversion to localtime. Still, the ability to display a chronological view of forks (exec()s and exit()s) across the system is rather unique in system tools of this simplicity.

[Conceivably one could pass a parameter to diff_time() that was set to the Unix epoch (0) to get a more reliable result than relying on the kernel time variable. (Note: Some early versions of ProbeVue did not always return the proper value for time (from the kernel variable). This was based upon personal experience, and not a methodical / thorough testing of the problem).]