topic Re: Tracing a Process from OS in Operating System - HP-UX

Tracing a Process from OS

Arun Jain — Mon, 06 Oct 2008 02:49:00 GMT

Dear All,

Is there any method on HPUX (OS Level) to trace any process from where it originated through its Process id.

Originated means
1. It is from a pc or device.
2. Its IP.
3. any other relevant information

If there is any method then please let me know.
It is very urgent.

Thanks and Regards :
Arun Jain

Re: Tracing a Process from OS

Ivan Krastev — Mon, 06 Oct 2008 03:07:14 GMT

All processes are runned locally - perhaps you need to trace some remote session (ssh, telnet, ftp).

With rsh, ssh you can start a process from the remote machine and all you need to know is remote address.

regards,
ivan

Re: Tracing a Process from OS

Arun Jain — Mon, 06 Oct 2008 03:16:33 GMT

Hi Ivan,

I think you misunderstood my question, I exactly want to trace out the remote address and everything related to process.

But you are saying that for tracing you need to know the remote address.

Regards
Arun

Re: Tracing a Process from OS

Dennis Handly — Sun, 31 Jul 2011 04:14:32 GMT

As Ivan said, you trace sessions not processes.

By using "UNIX95=EXTENDED_PS ps -Hfu user", you can get the whole process trees. By looking at the top you can figure out how it started, cron, login, rlogin, etc.
"who -R" may be able to give you the remote machine.

Re: Tracing a Process from OS

SKR_1 — Mon, 06 Oct 2008 03:23:49 GMT

Try to have some idea from Glance utility.

Go to Glance

# /opt/perf/bin/glance
select S and give PID number you will get details of that process.

Also you can check with command

# who -u ( Check man page for who )

Thanks

SKR

Re: Tracing a Process from OS

Arun Jain — Mon, 06 Oct 2008 08:45:07 GMT

Hi Dennis,

This Unix95 command is for which HPUX version. Will it work in 11.23 also. If yes whether it requires any patch or not.

should I use the command the way you wrote the syntax or it is in small case.

Regards :
Arun

Re: Tracing a Process from OS

DavidJ — Mon, 06 Oct 2008 11:32:38 GMT

Arun,
Dennis's command, will work on 11.23 just as he typed it with one small change, replace with the Unix user name of the person who started the process you wish to trace.
UNIX95=1 ps -Hfu .

You can also user who -R |grep .

This will give you the tty date and time user logged on and the ip address/machine name of the device which initiated the command. This will only be true if the is still logged on.

Re: Tracing a Process from OS

Dennis Handly — Mon, 06 Oct 2008 11:39:29 GMT

>This UNIX95 command is for which HP-UX version.

Setting the UNIX95 environment variable should work on any version if you are using a real shell. (The syntax is different for the scummy C shell.)

>should I use the command the way you wrote the syntax or it is in small case.

As David mentioned, you adjust it to the user you want to trace.

>David: This will only be true if the is still logged on.

You can get similar info if logged off by using the last(1) command.