Who started process

[Md. Farhan A Azam]

Hi Gurus,

I have killed one process,

but i want to know that who has started the process.

I tried to search in syslog.log but didn't get any log regarding my problem.

[VK2COT]

Hello,

Your information is very vague.
It would help if we knew the name of
the process you killed.

Unless you run auditing or Unix system accounting, you probably lost the valuable
information.

Many processes do not get logged via
standard syslog facilities.

If, by any chance, your process was
started at boot time, you might be
lucky to see some details in /etc/rc.log
which logs events from RC startup scripts
at boot time.

Another idea, if the process was started from the command-line by any chance, maybe
searching through Shell history files
in each account would help...

Cheers,

VK2COT

[Md. Farhan A Azam]

Hi ,

I have killed one Oracle process, which was not necessery....but i want to know that who has strated this Process id - 16133

I am using hpux 11.11

[Dennis Handly]

>I want to know that who has started this Process id - 16133

You look at the PPID of the process, before you kill it. If it is 1 (init), you'll have to look harder.

[VK2COT]

Hello,

As Dennis said, either look at parent process
(PPID), or ask Oracle admins if they can
trace it via their logs.

As a good learning experience, never kill
processes that belong to applications or
databases.

Let application and DB admins worry about
it :)

Cheers,

VK2COT

[Laurent Menase]

If its parent process id is 1 (init) you can look if it still has ptys opened - it should not but worth it checking-. it could give some indications.
use lsof or crashinfo -ofiles [pid]-v
if there is still a pts opened by that process.

[Md. Farhan A Azam]

thanks...