PROC_EVENT_COREDUMP
ev->what = PROC_EVENT_COREDUMP;
PROC_EVENT_COREDUMP | PROC_EVENT_EXIT)
case PROC_EVENT_COREDUMP: