how to see started processs

docs/admin-guide/troubleshooting/processes.md

@@ -1,5 +1,7 @@
 # Processes
 
+## Single Process
+
 Processes can be investigated through a variety of tools:
 
 1. The files in `/proc/$PID/`, in particular
@@ -11,3 +13,16 @@ Processes can be investigated through a variety of tools:
 ```{note}
 Both `strace` and `ltrace` slow the target process down **a lot**, which might cause problems.
 ```
+
+
+## What Processes are Started
+
+To see what processes are started by the system install `bcc-tools` and run
+
+```
+# /usr/share/bcc/tools/execsnoop
+PCOMM            PID     PPID    RET ARGS
+kill             1067985 433809    0 /bin/kill -0 433461
+sleep            1067986 433809    0 /usr/bin/sleep 5
+kcm-cleanup      1067989 847604    0 /opt/pli/bin/kcm-cleanup
+klist            1067992 1067991   0 /usr/bin/klist -l