Why catching short-lived processes requires eBPF on Linux but just a header on macOS