This watches file changes in one directory tree only, not the whole server. The larger the tree that you watch, the more likely you are to get the error message "upper limit on inotify watches reached".
To check if your kernel supports fanotify: grep CONFIG_FANOTIFY /boot/config-$(uname -r)
processes being created
forkstat
This works, even on my super-old servers at work.
based on netlink, which should be available in kernels v2.0 and v2.2+
Note, however, that netlink is considered an unreliable communication channel, and that events may be dropped in two situations: 1) global memory exhaustion, or 2) receiver queue buffer overrun.
to check if netlink is enabled in your kernel, confirm that /proc/net/netlink exists