I have windows and UNIX process start data in a logfile, including start time, process ID, and parent process ID. I want to be able to identify a specific process entry, and return all entries that are its descendants (children, grandchildren, great grandchildren, etc.), from the start time of the initial process to the present.
Because we're not tracking process termination, the reuse of a process ID, as indicated by a new process start event for one of the parent process IDs currently being traced, but without that new process's parent process ID being a different member of the set being traced, should result in removal of that new process ID from the trace set going forward from that point.
