Catching invoking a new process by the audit subsyetm