macOS Monitor new forked processes using kevents

Question

I'm trying to monitor all newly created processes using Kevents by monitoring EVFILT_PROC using launchd pid, which is 1:

struct kevent ke = { 0 };
const pid_t pid_of_launchd = 1;
EV_SET(&ke, pid_of_launchd, EVFILT_PROC, EV_ENABLE | EV_ADD | EV_CLEAR, NOTE_FORK | NOTE_EXEC, 0, NULL);

I do receive events when new processes are created by I can't retrieve the new process PID nor name:

struct kevent change = { 0 };
int next_event = kevent(kq, NULL, 0, &change, 1, NULL);
// change.ident always equal 1

Has anyone encountered this ?

Thanks!

Answer 1

the ident is the id (serial #) of the event. You should be checking the filter specific data (a uint64_t).