Received unhandled signal: 15

[Leon Allen]

I suspect just the system call :-(
Other processes in this category with kill are exit, fork, mlock........

[rick jones]

Given that the kill command uses the kill system call, auditing the system call is goodness. If it were only auditing the command that would leave the big gaping hole.

[Simon Wickham_6]

Hi Leon,

To receive a default signal (SIGTERM = 15) would mean it was issued by a user with top level access. I would begin by checking there are no cron jobs running.

Is this second crash at about the same time as the previous. Also check the the alert log.

Regards,
Simon

[Leon Allen]

Different times, 1st one 15:30; 2nd time 10:11.

Nothing what-so-ever in the alert log pertaining to this.

Specifically, what priviledged accout?

root, for sure.

Could the oracle account kill all the processes in a group?

Could another user, a member of the dba group, kill all the processes in a process group?

What is the best way to monitor / capture this info? (I've already turned auditing of kill process on through sam)

My gut feel is still it's a genuie crash - there are other cases of this problem on metalink - but no resolution for it detailed.

Cheers!

[Simon Wickham_6]

Hi Leon,

Do you have any core dumps or are there any Oracle ora- messagges. I would point out it may be worth now enabling tracing and going from there.

Regards,
Simon

[Leon Allen]

I have turned on some tracing, as per recommendations above, and waited for the problem to occurr again. Well, it has happened again (7/2/2006 14:11) - all oracle processes killed with sig 15. I am closing this thread and opening a new one in the hope of understanding what the auditing is telling me, and how I might take the next step towards resolving this problem.