2

On my system, some processes always exit, Now I don't know if they exit on their own or if someone kills them.

Can I record linux process exit info?

For example, if I have a process killed by another process, I can see a kill record in a log like xx pid killed yy pid or if my process exits itself, I can see XX PID exit by self.

Dominique
  • 16,450
  • 15
  • 56
  • 112
violetgo
  • 21
  • 5
  • [This](https://unix.stackexchange.com/questions/14270/get-exit-status-of-process-thats-piped-to-another) might have an answer, or possibly [this answer](https://stackoverflow.com/questions/1058047/wait-for-any-process-to-finish/41613532#41613532) might help .. but you might get downvoted on here or have your question closed if you don't have a specific question to any code itself .. – txtechhelp Feb 19 '19 at 10:54

1 Answers1

0

Linux has process accounting -- acct(5).

If you turn it on, e.g., with the accton command, Linux will record some process info into a file each time a process exits. The info does record signal deaths int the ac_flags field (though this doesn't distinguish the signal that caused the deatH) and it looks like you could get the complete exit information (as from wait(2)) from the ac_exitcode field. Unfortunately the shipped dump-acct command isn't showing it, but I suppose you could show it if you parsed the file from C.

Apart form this feature, in a basic UNIX POSIX system, only process parents can get the exit information their child (ptrace too, but ptrace-based tracers sort of act like a second parent).

Petr Skocik
  • 58,047
  • 6
  • 95
  • 142