process tracking in unix

[Nemer_1]

hi,
I have some log files pointing to a problem comming form specific process with a known PID, but when I issue "ps -ef|grep PID" to know the process name it returns nothing.

form the log file it seems that this process runs repeatedly on the system but not on a scheduled time. is there any idea on how can I capture this process??

thanks

[RAC_1]

Keep ps runnning through cron. you might be successful in captruning it when it runs. but with no information on when it runs, it diffcult to do it. Does it run though cron/at?? If yes, you may want to check the at and cron entries and schedule your cron job (ps -ef|grep "program name") at about the same time.

[Nemer_1]

RAC,
the main problem is that I don't know anything about this process except it PID, there is no scheduled jobs in the cron/at. it seems that this process is trigred form one of the already running processes.

thanks

[RAC_1]

If it being triggered from exising process, you can not have control over what pid it will use. So I think, what you is parent process id. you can run tusc (trace unix system calls tool) and dump it to a file.

Such files grow very fast.

tusc -vfp -o /tmp/somelog_file.

You can get tusc from hpux.connect.org.uk

[Ishmael Vestas Lesolame]

check the parent process ID and track it from there. It might be a script you can fix.

Ish

[Vibhor Kumar Agarwal]

Run a job from cron which will find out exactly when that particular log file is touched.

Now you will be in a situation to handle the problem.

Since the pid can be arbitrary, now you can process that log file manually or via a script if you know the structure to get the pod and then get the information about that process.

[Nemer_1]

RAC,
thanks very much Im trying now to catch that process using the tusc tool hope this will succeed

[RAC_1]

As I said, it will do what you want. But these file grow very fast. So make sure that you have enough space before you start.

tusc -vf -o /some_dir_with_enough_space/logfile -p "pid"