Logo Questions Linux Laravel Mysql Ubuntu Git Menu
 

when a process is killed is this information recorded anywhere?

Question:

  • When a process is killed, is this information recorded anywhere (i.e., in kernel), such as syslog (or can be configured to be recorded syslog.conf)
  • Is the information of the killer's PID, time and date when killed and reason

update - you have all giving me some insight, thank you very much|

like image 532
Aaron Avatar asked Dec 05 '09 23:12

Aaron


People also ask

What happens when we kill a process?

calls TerminateProcess (amongst others), which force-closes all handles and threads. The MSDN API ref says "TerminateProcess initiates termination and returns immediately. This stops execution of all threads within the process and requests cancellation of all pending I/O.

How is a process killed?

Terminate the process. When no signal is included in the kill command-line syntax, the default signal that is used is –15 (SIGKILL). Using the –9 signal (SIGTERM) with the kill command ensures that the process terminates promptly.

Does kill terminate the process?

The kill command sends a signal (by default, the SIGTERM signal) to a running process. This default action normally stops processes.

How do you find who killed a process in Linux?

To verify that the process has been killed, run the pidof command and you will not be able to view the PID. In the above example, the number 9 is the signal number for the SIGKILL signal.


1 Answers

If your Linux kernel is compiled with the process accounting (CONFIG_BSD_PROCESS_ACT) option enabled, you can start recording process accounting info using the accton(8) command and use sa(8) to access the recorded info. The recorded information includes the 32 bit exit code which includes the signal number.

(This stuff is not widely known / used these days, but I still remember it from the days of 4.x Bsd on VAXes ...)

like image 143
Stephen C Avatar answered Oct 15 '22 10:10

Stephen C