I've been tracking all process terminations using a rule for the exit and exit_group syscalls. However, by looking at the audit events for exit it is impossible to differentiate between the death of different threads in the same thread group. Is there an alternative way to track this?

For my use case, I would like to know when either processes or individual threads execute and terminate. (I'm fine tracking at either granularity.) Right now I can track the creation properly using fork/clone/etc but for termination I receive multiple exit events with identical information that doesn't let me know which thread died.

Thanks,

Natan