1. A method for monitoring computer-implemented instructions comprising: configuring a computer system with at least one processor in communication with memory, said computer system including an operating system in communication with said processor, said operating system running in kernel space and performing services on behalf of one or more user-space programs, said processor implementing a subroutine-call mechanism by saving a return address in temporary storage when a subroutine is called; during initiation of a user process, storing a first breakpoint instruction in an area of said process's user space that will not be overwritten; inserting a second breakpoint instruction at a user-space instruction address when a request is made to monitor a return from a particular subroutine of one of said user-space programs, wherein said address is an entry point of a subroutine to be monitored; transferring control to kernel mode, by said second breakpoint instruction, when said subroutine to be monitored is called; and remembering the return address of said called subroutine, and replacing said return address with an address of said first breakpoint instruction.