Tracing a Process from OS

[Arun Jain]

Dear All,

Is there any method on HPUX (OS Level) to trace any process from where it originated through its Process id.

Originated means
1. It is from a pc or device.
2. Its IP.
3. any other relevant information

If there is any method then please let me know.
It is very urgent.

Thanks and Regards :
Arun Jain

[Ivan Krastev]

All processes are runned locally - perhaps you need to trace some remote session (ssh, telnet, ftp).

With rsh, ssh you can start a process from the remote machine and all you need to know is remote address.


regards,
ivan

[Arun Jain]

Hi Ivan,

I think you misunderstood my question, I exactly want to trace out the remote address and everything related to process.

But you are saying that for tracing you need to know the remote address.

Regards
Arun

[Dennis Handly]

As Ivan said, you trace sessions not processes.

By using "UNIX95=EXTENDED_PS ps -Hfu user", you can get the whole process trees. By looking at the top you can figure out how it started, cron, login, rlogin, etc.
"who -R" may be able to give you the remote machine.

[SKR_1]

Try to have some idea from Glance utility.

Go to Glance

# /opt/perf/bin/glance
select S and give PID number you will get details of that process.

Also you can check with command

# who -u ( Check man page for who )

Thanks

SKR

[Arun Jain]

Hi Dennis,

This Unix95 command is for which HPUX version. Will it work in 11.23 also. If yes whether it requires any patch or not.

should I use the command the way you wrote the syntax or it is in small case.

Regards :
Arun

[DavidJ]

Arun,
Dennis's command, will work on 11.23 just as he typed it with one small change, replace with the Unix user name of the person who started the process you wish to trace.
UNIX95=1 ps -Hfu .

You can also user who -R |grep .

This will give you the tty date and time user logged on and the ip address/machine name of the device which initiated the command. This will only be true if the is still logged on.

[Dennis Handly]

>This UNIX95 command is for which HP-UX version.

Setting the UNIX95 environment variable should work on any version if you are using a real shell. (The syntax is different for the scummy C shell.)

>should I use the command the way you wrote the syntax or it is in small case.

As David mentioned, you adjust it to the user you want to trace.

>David: This will only be true if the is still logged on.

You can get similar info if logged off by using the last(1) command.