Techniques for analyzing and controlling operation of a system of cooperating processes. A library of system calls used by the processes is replaced by a dynamically-linked library which performs the system calls and also sends messages indicating that the system calls have been performed. The messages are received by a display system which responds to the messages by making a graphical display showing the current state of the system of processes. The graphical display displays the system of processes as a tree. Nodes in the tree represent the processes in the system and resources such as files used by the processes; edges in the tree represent relationships between processes and other processes or resources. Users may control which system calls result in messages, may control the rate at which the display system responds to the messages, and may also control execution of the processes.