kill signal investigation

[amithp]

Hi

One of the job failed in our application
stating "Program GTMATCH killed by user"

without mentioning name of the user
unfortunately there is no program called GTMATCH in our environment

Is there a way to find out if kill signal was issue in some period of time with the user name in the system?

[Matti_Kurkela · Accepted solution]

Only if you had the audit sub-system already enabled and were logging the appropriate audit event types.

By the way, unless you have assigned special permissions to your users, the user must be either "root" or the same user that is running the application: by default, non-root users can kill only their own processes, not anyone else's.

MK

[amithp]

I m not sure about any audit system running. But OVO and mwa are running in the system.
Can these help?

[Dennis Handly]

>OVO and mwa are running in the system. Can these help?

Not likely, these just measure performance, not what's going on in the detail you need.

You could reprogram your application to add a SIGTERM handler to record the killing PID.

That's assuming that "killed by user" means a signal (possibly SIGINT?) instead of just an abort button. And find out who printed that GTMATCH message.

[amithp]

thank you Matti and Hadely.

[amithp]

i got the answer