Tracking which Unix process pid just crashed


I got a monitoring alert that says a Unix process just crashed but the alert did not
specify the pid or process name that just crashed.

Is there any way to find out?

What about the directory /usr/ucb/... : does it hold any clue

I recall in Linux  /var/run   there are *.pid files that hold the pid of processes.
If a process was abrupted terminated or manually "killed", does the pid file
stays behind?  I thought of going thru one by one the .pid files to see the pid
& check which ones are no longer found in "ps -ef"

/var/log/messages did not give any clue

any good Shell script / command to check this easily would be most welcome
as well
sunhuxAsked:
Who is Participating?

Improve company productivity with a Business Account.Sign Up

x
 
apresenceConnect With a Mentor Commented:
Not all applications write the pid files.  But, you are right, the pid files are usually deleted when a process exits normally.  The date stamp (mtime) on the /var/run/*.pid files is the last time the process was started.

If you want to check those pid files to see if any of their processes are missing, the attached code will do it for ya.

Sample output (I create a theoretical testproc.pid file with a pid that doesn't exist for testing):
root@beta:~/exex/test9 $ echo 999 >/var/run/testproc.pid
root@beta:~/exex/test9 $ ./show_missing_pids.sh
PID 3146 (/var/run/atd.pid): RUNNING
PID 2334 (/var/run/auditd.pid): RUNNING
PID 3015 (/var/run/crond.pid): RUNNING
...
PID 999 (/var/run/testproc.pid): NOT RUNNING
...
root@beta:~/exex/test9 $
#!/bin/sh
for i in `ls /var/run/*.pid`; do
  actual_pid=`perl -ne 'print "$1\n" if /^(\d+)/' < $i`
  if [ -n "$actual_pid" ]; then
    ps -p $actual_pid >/dev/null 2>&1
    if [ $? -eq 0 ]; then
      echo "PID $actual_pid ($i): RUNNING"
    else
      echo "PID $actual_pid ($i): NOT RUNNING"
    fi
  fi
done

Open in new window

0
 
sunhuxAuthor Commented:


What does the date stamp of those /var/run/*.pid files mean?
0
 
gheistConnect With a Mentor Commented:
do you have any log or boot message entry confirming a process crash?
0
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

All Courses

From novice to tech pro — start learning today.