A method and structure for OS event notification, including a central processing unit (CPU) and a memory including instructions for an event notification mechanism for monitoring operating system events in an operating system (OS) being executed by the CPU. The OS includes a kernel having a plurality of kernel subcomponents that provide services to one or more applications executing in the OS in a user mode, using system calls to the kernel. The OS event notification mechanism is capable of monitoring events within the kernel, at a level below the user mode level. The OS event notification mechanism includes Application Program Interfaces (APIs) that are standard for the OS.