2

On my system, some processes always exit, Now I don't know if they exit on their own or if someone kills them.

Can I record linux process exit info?

For example, if I have a process killed by another process, I can see a kill record in a log like xx pid killed yy pid or if my process exits itself, I can see XX PID exit by self.

Dominique
  • 13,061
  • 14
  • 45
  • 83
violetgo
  • 21
  • 5
  • [This](https://unix.stackexchange.com/questions/14270/get-exit-status-of-process-thats-piped-to-another) might have an answer, or possibly [this answer](https://stackoverflow.com/questions/1058047/wait-for-any-process-to-finish/41613532#41613532) might help .. but you might get downvoted on here or have your question closed if you don't have a specific question to any code itself .. – txtechhelp Feb 19 '19 at 10:54

1 Answers1

0

Linux has process accounting -- acct(5).

If you turn it on, e.g., with the accton command, Linux will record some process info into a file each time a process exits. The info does record signal deaths int the ac_flags field (though this doesn't distinguish the signal that caused the deatH) and it looks like you could get the complete exit information (as from wait(2)) from the ac_exitcode field. Unfortunately the shipped dump-acct command isn't showing it, but I suppose you could show it if you parsed the file from C.

Apart form this feature, in a basic UNIX POSIX system, only process parents can get the exit information their child (ptrace too, but ptrace-based tracers sort of act like a second parent).

PSkocik
  • 55,062
  • 6
  • 86
  • 132