parent process

[steven Burgess_2]

Hi everyone

We had an issue with a process last week that flooded our transaction files with a large number of dummy transactions over a 11 hour period. This caused issues during reconcilation of such information. I have identified the process that started the transactions through the details and perfview. I also have the parent process id of this process, again from perfview. What I don't seem to be able to get are the details of this particular parent processes that started all the problems. It's no longer on the system as the application crashed. This sounds slightly bizarre but perfview can only give me details of PID's and not PPID's, which sounds daft as a PPID is also a PID !!

Any help appreciated

Steven

[Gerhard Roets]

Hi Steven

True a PPID is only a PID but ...

If you have logging to the level of forking ( SYSCALL ) ... you might be able to pickup wich process forked to your PID. Just an idea though.

Looking again at your "submission" ... if you have that PID of the parent(PPID) you should be able to look at it in perfview ... except if it is a process that was excluded on purpose from the perfview monitoring. The reason I say this is a PPID is only the PID of the process that forked the new process ( CPID aka Child Process ID )


I hope this points you in some direction ...more correctly a direction :P

HTH
Gerhard