Processes history

[Filosofo]

Hi,
I would monitoring the processes that running on my system from *:58 and *:02 (* is all hours ).
I woul like have a list of proceses that start in thet times.....
What can I do to view the processes?
Please help me....

By

Filo

[Cheryl Griffin]

Outside of some script that may possibly provide this, auditing is the answer.

Auditing is a feature of Trusted Security. http://www.docs.hp.com/hpux/onlinedocs/5187-2216/00/00/72-con.html

An HP-UX Trusted System provides auditing. Auditing is the selective recording of events for analysis and detection of security breaches.

audevent Changes or displays event or system call status. See audevent(1M) . http://www.docs.hp.com/hpux/onlinedocs/5187-2216/00/00/72-con.html#bajdcaca See Table 2 Audit Event Types and System Calls

audisp analyzes and displays the audit information contained in the specified audit_filename audit files. The audit files are merged into a single audit trail in time order. Although the entire audit trail is analyzed, audisp allows you to limit the information displayed, by specifying options. This command is restricted to privileged users. ...
By the same principle, citing -t start_time without -s stop_time displays all audit information beginning from start_time to the end of the file.

[Mark Grant]

I think from your post, you want something that's a little bit less of change and perhaps something simpler. If I'm wrong. I apologize. Otherwise, you could always put something in cron like this

02,58 * * * * date >> /tmp/pslog;ps -ef >>/tmp/pslog

This will give you a running log file of the processes that are running at *.58 and *.02 on your system.

[Mike Stroyan]

Here is a tentative suggestion.
You could use the tusc system call tracer to watch for fork and exec during that interval.
Start a script like this from a cron entry.

58 * * * * tusc -f -S 31 -A -o /tusc.out -s fork,exec 1 $(UNIX95=1 /usr/bin/ps -e -opid=) & p=$!;sleep 240; kill $p

http://hpux.cs.utah.edu/hppd/hpux/Sysadmin/tusc-7.5/

I would be concerned about how this might affect running jobs, particulary other uses of tusc or debugging sessions.

[Sundar_7]

Hi,

Do you have measureware agent running in ur system ?

If yes then "man extract"

Sundar