forkstat (process fork/exec/exit monitoring tool).

Forkstat  monitors   process  fork(),  exec()  and  exit()  activity.
It is useful for monitoring system behaviour and to track down r ogue
processes that are spawning off processes and potentially abusing the
system.

Note that forkstat uses the Linux netlink connector to gather process
activity and this may miss events if the system is overly busy.
Netlink connector also requires root privilege.