Online Expert Day - HPE Data Storage - Live Now
April 24/25 - Online Expert Day - HPE Data Storage - Live Now
Read more
cancel
Showing results for 
Search instead for 
Did you mean: 

Who started process

Md. Farhan A Azam
Trusted Contributor

Who started process

Hi Gurus,

I have killed one process,

but i want to know that who has started the process.

I tried to search in syslog.log but didn't get any log regarding my problem.
6 REPLIES
VK2COT
Honored Contributor

Re: Who started process

Hello,

Your information is very vague.
It would help if we knew the name of
the process you killed.

Unless you run auditing or Unix system accounting, you probably lost the valuable
information.

Many processes do not get logged via
standard syslog facilities.

If, by any chance, your process was
started at boot time, you might be
lucky to see some details in /etc/rc.log
which logs events from RC startup scripts
at boot time.

Another idea, if the process was started from the command-line by any chance, maybe
searching through Shell history files
in each account would help...

Cheers,

VK2COT
VK2COT - Dusan Baljevic
Md. Farhan A Azam
Trusted Contributor

Re: Who started process

Hi ,

I have killed one Oracle process, which was not necessery....but i want to know that who has strated this Process id - 16133

I am using hpux 11.11
Dennis Handly
Acclaimed Contributor

Re: Who started process

>I want to know that who has started this Process id - 16133

You look at the PPID of the process, before you kill it. If it is 1 (init), you'll have to look harder.
VK2COT
Honored Contributor

Re: Who started process

Hello,

As Dennis said, either look at parent process
(PPID), or ask Oracle admins if they can
trace it via their logs.

As a good learning experience, never kill
processes that belong to applications or
databases.

Let application and DB admins worry about
it :)

Cheers,

VK2COT
VK2COT - Dusan Baljevic
Laurent Menase
Honored Contributor

Re: Who started process

If its parent process id is 1 (init) you can look if it still has ptys opened - it should not but worth it checking-. it could give some indications.
use lsof or crashinfo -ofiles [pid]-v
if there is still a pts opened by that process.
Md. Farhan A Azam
Trusted Contributor

Re: Who started process

thanks...