killed processes

[Ragni Singh]

Hello,

My question here is we had some processes running an while ago and all of a sudden it just disappeared. There was no idication of any error in their out file nor did it create a core dump of any sort. It just looks lke someone killed the process but noone seems to claim as to who did. Are there any systems logs that would provide us any clues as to what might have happened. Any help will be greatly appreciated.

[harry d brown jr]

How was this process started? Did you redirect error messages to a log file? Could have the process stopped because it was awaiting input from a keyboard?

[Sridhar Bhaskarla · Accepted solution]

Sanman,

It's difficult to trace these events. You can probably write a script to check each 'capable' user's .sh_history to find out the commands. If you are running accounting on the system, you can generate some reports based on the commands.

If there is any 'remsh' access allowed for these users, there will not be even .sh_history if they used remsh commands. But you can find them in 'last' outputs.

However, it's general pain to audit the application processes as application owners have control over it.

-Sri

[Uday_S_Ankolekar]

Hi,

Check the users .history or sh_history file who owned this process/application. Chances are there that you get some information from the history file.

Good luck..
-USA...