The Linux process and session model as part of security alerting and monitoring