How to automate functional testing for background service that act as a system monitor? Such as linux daemon or windows service

I can't seems to find any good articles or guidelines on how to do automated testing for a background process that act as a system monitor, ie, part of the input is the system events or how the system is configured/comprised of, such as the number of users, user logins, file monitoring etc.

Anyone has some experience in this domain? Any help would be greatly appreciated.