Depends on your package manager. Linux often tracks services through PID files. When a program is run it creates a file contaning its integer PID; when it quits or dies, it deletes this file. Further details depends on what startup manager you're using. strace works, but has a high performance cost. gdb might be cudgeled into working but isn't really suited to it, and would have an even higher performance cost. I think you need to rethink your system here. If you don't want admins installing things or starting/stopping services without supervision, why are they admins? Instead of writing a giant omniscient daemon with its tentacles hacked into every aspect of the system, just restrict them from doing things you don't want in the first place. You can use sudo to grant admin access for only very specific things in very specific ways, so that to install something or stop a service, they have to run your program instead of the system one...