• Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 989
  • Last Modified:

Logging of UNIX Process IDs

In unix - and specifically HP-UX - is there extensive logging of ALL process IDs that are run?  If so, where is that log kept?

That is the question, here are some specifics.  I have a script that is run every 5 minutes out of cron, all day long.  One of the very first things I do is echo the current script's PID ($$) to a log file.  Then I check very carefully to see if that script is already running.  It should NOT be - it is run every 5 minutes and takes about 40 seconds to complete.  If it IS running, I loop for 30 seconds, up to 3 times, and check again to see if the 'other' instance of the script is running.  If that 'other' instance is running after that 1.5 minutes, I bail out and send an email.  If the 'other' disappears, the current script goes on to do its work.

The PROBLEM is - that 'other' instance sometimes shows up in my log.  And, it simply should NOT be there.  When I loop, I send the process id information to the log (ps -efx).  I can see the current instance PID.  The 'other' instance is a different PID.  Where is it coming from?

If there was a full log of every single process, I'd like to find it, and try to determine exatly where that 'other' process came from, who started it, its parent process...whatever.  I tried the cron log (/var/adm/cron/log) and that does not show what I am looking for.
0
birkdale10
Asked:
birkdale10
1 Solution
 
tfewsterCommented:
You should be able to trace the "other" process from its PPID, using the output of `ps -efx` that you've logged?

I've seen alerts from system monitoring software where there appear to be e.g. 2 copies of cron running. However when you check everything is normal. The explanation there was that when a process starts another one, it forks (so a `ps` snapshot _would_ show 2 copies of cron at that instant) before it is overlaid with the "real" child code & process name.

In your case, I suspect that the `ps` call is seeing itself in the "forked" state (Though if the child process code is actually executing, I'd have expected the "process management" to sort itself out!) If I'm right, `ps -efx` should show 2 instances of "yourscript", one the parent of the other,  and not the child instance of `ps` that you would expect to see.

Is your system particularly busy at the times you've seen this happen?
0
 
gheistCommented:
PID= $??
logger Started $??
if [-f /var/run/script/it.pid] ; then
 kill -0 `cat /var/run/script/it.pid` || echo $?? > /var/run/script/it.pid
fi
0
 
ahoffmannCommented:
> .. that 'other' instance sometimes shows up in my log.
is "my log" a fixed filename?
I'd use a filename like
  log=/tmp/myscript.$USER.$$.log

And keep tfewster's comment in mind.
0
 
birkdale10Author Commented:
All.  I am accepting tfewster's solution.  I added more logging to the script, and let it run on our development system for over a week.  I can't find a 'forked' process.  But, on the other hand, the 'errors' that were happening almost daily in the production system have tapered off - only one in a week, and none since the Unix Admin disabled a system monitoring program that seemed to be using up to 97% of CPU cycles.  So, I'm putting this whole subject on a back burner at work.
0

Featured Post

Free Tool: IP Lookup

Get more info about an IP address or domain name, such as organization, abuse contacts and geolocation.

One of a set of tools we are providing to everyone as a way of saying thank you for being a part of the community.

Tackle projects and never again get stuck behind a technical roadblock.
Join Now