To run a command (COMMAND) when a specific program (PROGRAM) starts on Debian without polling and without controlling the start of PROGRAM, you can use systemd or inotify-based approaches. Here are the most reliable methods:

1. Using systemd (Recommended)

If PROGRAM is managed by systemd (e.g., a service), you can create a systemd service unit that triggers your command when PROGRAM starts.

Steps:

1. Find the systemd service name of PROGRAM:

   bash

   Copy

   systemctl list-units --type=service | grep PROGRAM

   (Replace PROGRAM with the actual name or part of it.)

2. Create a new service unit for your COMMAND: Create a file /etc/systemd/system/your-command.service with the following content:

   ini

   Copy

   [Unit]
   Description=Run COMMAND when PROGRAM starts
   After=PROGRAM.service  # Replace with the actual service name
   Requires=PROGRAM.service
   
   [Service]
   Type=oneshot
   ExecStart=/bin/bash -c "COMMAND"  # Replace COMMAND with your actual command
   RemainAfterExit=yes
   
   [Install]
   WantedBy=multi-user.target

3. Enable and start the service:

   bash

   Copy

   sudo systemctl daemon-reload
   sudo systemctl enable your-command.service
   sudo systemctl start your-command.service

4. Verify: Check the logs to confirm your command runs when PROGRAM starts:

   bash

   Copy

   journalctl -u your-command.service -f

2. Using inotifywait (For Process Detection)

If PROGRAM is not a systemd service, you can use inotifywait to monitor its process creation in /proc.

Steps:

1. Install inotify-tools:

   bash

   Copy

   sudo apt update && sudo apt install inotify-tools

2. Create a script to monitor /proc for PROGRAM:

   bash

   Copy

   #!/bin/bash
   PROGRAM_NAME="PROGRAM"  # Replace with the actual program name
   while true; do
       inotifywait -q -e create /proc | while read -r dir event file; do
           if [[ "$file" == *"$PROGRAM_NAME"* ]]; then
               COMMAND  # Replace with your actual command
           fi
       done
   done

   Save this as monitor_program.sh and make it executable:

   bash

   Copy

   chmod +x monitor_program.sh

3. Run the script in the background:

   bash

   Copy

   nohup ./monitor_program.sh > /dev/null 2>&1 &

3. Using auditd (Advanced)

If you need kernel-level monitoring, you can use auditd to trigger your command when PROGRAM starts.

Steps:

1. Install auditd:

   bash

   Copy

   sudo apt update && sudo apt install auditd

2. Add a rule to monitor PROGRAM:

   bash

   Copy

   sudo auditctl -a exit,always -F arch=b64 -S execve -F path=/path/to/PROGRAM

   (Replace /path/to/PROGRAM with the actual binary path.)

3. Create a script to parse auditd logs and run COMMAND:

   bash

   Copy

   #!/bin/bash
   tail -f /var/log/audit/audit.log | while read -r line; do
       if [[ "$line" == *"PROGRAM"* ]]; then
           COMMAND  # Replace with your actual command
       fi
   done

   Run this script in the background.

Which Method to Choose?

Recommendation

• If PROGRAM is a systemd service, use Method 1.
• If PROGRAM is a standalone binary, use Method 2 (inotify).
• For advanced use cases (e.g., security monitoring), use Method 3 (auditd).