topic Re: killed processes in Operating System - HP-UX

killed processes

Ragni Singh — Tue, 16 Oct 2001 18:51:09 GMT

Hello,

My question here is we had some processes running an while ago and all of a sudden it just disappeared. There was no idication of any error in their out file nor did it create a core dump of any sort. It just looks lke someone killed the process but noone seems to claim as to who did. Are there any systems logs that would provide us any clues as to what might have happened. Any help will be greatly appreciated.

Re: killed processes

harry d brown jr — Tue, 16 Oct 2001 18:58:28 GMT

How was this process started? Did you redirect error messages to a log file? Could have the process stopped because it was awaiting input from a keyboard?

Re: killed processes

Sridhar Bhaskarla — Tue, 16 Oct 2001 18:58:58 GMT

Sanman,

It's difficult to trace these events. You can probably write a script to check each 'capable' user's .sh_history to find out the commands. If you are running accounting on the system, you can generate some reports based on the commands.

If there is any 'remsh' access allowed for these users, there will not be even .sh_history if they used remsh commands. But you can find them in 'last' outputs.

However, it's general pain to audit the application processes as application owners have control over it.

-Sri

Re: killed processes

Uday_S_Ankolekar — Tue, 16 Oct 2001 19:15:02 GMT

Hi,

Check the users .history or sh_history file who owned this process/application. Chances are there that you get some information from the history file.

Good luck..
-USA...