topic Who started process in Operating System - HP-UX

Who started process

Md. Farhan A Azam — Wed, 31 Dec 2008 06:02:47 GMT

Hi Gurus,

I have killed one process,

but i want to know that who has started the process.

I tried to search in syslog.log but didn't get any log regarding my problem.

Re: Who started process

VK2COT — Wed, 31 Dec 2008 06:10:59 GMT

Hello,

Your information is very vague.
It would help if we knew the name of
the process you killed.

Unless you run auditing or Unix system accounting, you probably lost the valuable
information.

Many processes do not get logged via
standard syslog facilities.

If, by any chance, your process was
started at boot time, you might be
lucky to see some details in /etc/rc.log
which logs events from RC startup scripts
at boot time.

Another idea, if the process was started from the command-line by any chance, maybe
searching through Shell history files
in each account would help...

Cheers,

VK2COT

Re: Who started process

Md. Farhan A Azam — Wed, 31 Dec 2008 06:29:57 GMT

Hi ,

I have killed one Oracle process, which was not necessery....but i want to know that who has strated this Process id - 16133

I am using hpux 11.11

Re: Who started process

Dennis Handly — Wed, 31 Dec 2008 07:27:58 GMT

>I want to know that who has started this Process id - 16133

You look at the PPID of the process, before you kill it. If it is 1 (init), you'll have to look harder.

Re: Who started process

VK2COT — Wed, 31 Dec 2008 08:30:33 GMT

Hello,

As Dennis said, either look at parent process
(PPID), or ask Oracle admins if they can
trace it via their logs.

As a good learning experience, never kill
processes that belong to applications or
databases.

Let application and DB admins worry about
it :)

Cheers,

VK2COT

Re: Who started process

Laurent Menase — Wed, 31 Dec 2008 10:40:58 GMT

If its parent process id is 1 (init) you can look if it still has ptys opened - it should not but worth it checking-. it could give some indications.
use lsof or crashinfo -ofiles [pid]-v
if there is still a pts opened by that process.

Re: Who started process

Md. Farhan A Azam — Mon, 01 Feb 2010 05:21:52 GMT

thanks...