You could poll sysprocesses every so often, but the only way of getting a 'push' from those events is with a trace, I think. But for a snapshot, it would work fine.
Tim Wilkinson
"If it doesn't work in practice, you're using the wrong theory"
- Immanuel Kant