On Windows, there is a program available for download which is part of what's called the sysinternals suite of tools. This program is called Process Explorer 64 aka ProcExp64. The program is useful for amongst many other things, identifying potential malware on a machine because one common behavior of malware is to launch and kill processes essentially faster than the typical program and/or the human eye could perceive/notice. This posed a challenge using the Windows Task Manager, because a malware may quickly launch, launch a child process, inject into another process and then kill the child all in under 1 second, for example (potentially even under 200ms). ProcExp64 has what's called Difference Highlight Duration which highlights a killed process to a specified color and keeps it in the process list for some duration, even after it's killed. In fact, the user can even specify to "scroll to new process", which I simply use sort by PID for on linux in htop. I do see an update time setting in htop but if I make that larger, it may miss the launch altogether.
On Linux, I've found a similar issue and I'm not sure how to solve it. In this case, I am not trying to observe malware, but I am trying to observe other, non-malicious processes that begin and exit quickly. An example is that I noticed that when I enter the command ps aux | grep ld-linux, I get an output, but then when I view htop, there is no such process still running because I believe the ld-linux executable exits and remains present only in shared object (.so) space rather than as a separate process (I could be wrong, but this is how I understand what's happening). One reason I suspect this is the case is that every time I run the aforementioned command, the PID is incremented further and further for ld-linux because I think that is the instance that was loaded in the actual loading process for ps itself (again, just speculation). Is there a way to observe this in action using htop or some other tool to put some kind of delay on the existence of the ld-linux loader process in the process table/list, and otherwise highlight it so that it stands out?
auditd.