> It wouldn't let me build any features that track/audit process executions

Sounds like waitpid(2) is dangerous!