audit a process that disappears

audit a process that disappears

[ESGLinux]

[-- Attachment #1.1: Type: text/plain, Size: 485 bytes --]

Hi All,

I have a problem with a java application that I run on a RHEL machine. The
problem is that the java process dissapears without logging anything,

it´s like anybody outside the process gives a kill to it.

My question is with audit rules I can get any information about what is
happening with this process.

something like this:

-a entry,always -F pid=32179 -S all -k TOMCAT_JAVA

(pid=32179 is the pid of the process)

any idea,

Thanks in advance,

ESG

[-- Attachment #1.2: Type: text/html, Size: 690 bytes --]

[-- Attachment #2: Type: text/plain, Size: 0 bytes --]

Re: audit a process that disappears

[Steve Grubb]

On Tuesday, November 09, 2010 08:25:07 am ESGLinux wrote:
> it´s like anybody outside the process gives a kill to it.

There are 2 other possibilities and that is that it terminates abnormally or that it 
"ends".

 
> My question is with audit rules I can get any information about what is
> happening with this process.
> 
> something like this:
> 
> -a entry,always -F pid=32179 -S all -k TOMCAT_JAVA
> 
> (pid=32179 is the pid of the process)

You should be able to get something. You would probably just need the "kill", "exit", 
and "exit_group" syscalls.

-Steve

Re: audit a process that disappears

[ESGLinux]

[-- Attachment #1.1: Type: text/plain, Size: 736 bytes --]

Thanks Steve,

I´m going to try it,


Greetings,

ESG

2010/11/9 Steve Grubb <sgrubb@redhat.com>

> On Tuesday, November 09, 2010 08:25:07 am ESGLinux wrote:
> > it´s like anybody outside the process gives a kill to it.
>
> There are 2 other possibilities and that is that it terminates abnormally
> or that it
> "ends".
>
>
> > My question is with audit rules I can get any information about what is
> > happening with this process.
> >
> > something like this:
> >
> > -a entry,always -F pid=32179 -S all -k TOMCAT_JAVA
> >
> > (pid=32179 is the pid of the process)
>
> You should be able to get something. You would probably just need the
> "kill", "exit",
> and "exit_group" syscalls.
>
> -Steve
>

[-- Attachment #1.2: Type: text/html, Size: 1221 bytes --]

[-- Attachment #2: Type: text/plain, Size: 0 bytes --]