It seems to me that the author of forkstat and I have had a similar problem in the past: Sometimes there are small processes that spawn and end so quickly, it’s difficult to catch them on top or in another system tool.
So that’s when forkstat becomes useful.
forkstat is simple to control and runs smoothly. You can use flag options to set a run duration, modify the output a little, and ask for a summary of statistics. There is also a small option to filter for specific events.
I’ve already pinned down a couple of spawning-respawning processes that I am wondering if I should (or just could) prune back.
And so forkstat has already proven useful. 🙂 If you need something to catch those really small, really fast processes that might be abusing your hospitality, forkstat is probably the man for the job.