[pjmlp]

That is where OS tracing like DTrace and ETW come into play, which can then be loaded into a debugging session.