From: Steve Grubb <sgrubb@redhat.com>
To: linux-audit@redhat.com
Subject: Re: Identifying thread/process termination
Date: Tue, 06 Oct 2020 16:20:32 -0400 [thread overview]
Message-ID: <5549003.MhkbZ0Pkbq@x2> (raw)
In-Reply-To: <CAPErmPdDACGemKqTrUk4xKNBwnoj6FEeWbsvmk7jS0TjOyaOqg@mail.gmail.com>
Hello,
On Monday, October 5, 2020 3:07:12 PM EDT Natan Yellin wrote:
> I've been tracking all process terminations using a rule for the exit and
> exit_group syscalls. However, by looking at the audit events for exit it is
> impossible to differentiate between the death of different threads in the
> same thread group. Is there an alternative way to track this?
I don't think the audit system was ever designed to distinguish between
threads. But there is a general need to determine the exit of a process
rather than a thread.
Paul, Richard, Do you have any thoughts?
-Steve
> For my use case, I would like to know when either processes or individual
> threads execute and terminate. (I'm fine tracking at either granularity.)
> Right now I can track the creation properly using fork/clone/etc but for
> termination I receive multiple exit events with identical information that
> doesn't let me know which thread died.
--
Linux-audit mailing list
Linux-audit@redhat.com
https://www.redhat.com/mailman/listinfo/linux-audit
next prev parent reply other threads:[~2020-10-06 20:20 UTC|newest]
Thread overview: 13+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-10-05 19:07 Identifying thread/process termination Natan Yellin
2020-10-06 20:20 ` Steve Grubb [this message]
2020-10-08 1:27 ` Paul Moore
2020-10-08 7:59 ` Natan Yellin
2020-10-09 1:12 ` Paul Moore
2020-10-08 12:49 ` Richard Guy Briggs
2020-10-08 15:33 ` Lenny Bruzenak
2020-11-16 6:41 ` L. A. Walsh
2020-11-16 13:43 ` Paul Moore
2020-11-17 15:22 ` L A Walsh
-- strict thread matches above, loose matches on Subject: below --
2020-11-20 19:43 L. A. Walsh
2020-11-24 15:43 ` Lenny Bruzenak
2020-11-20 19:45 L. A. Walsh
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=5549003.MhkbZ0Pkbq@x2 \
--to=sgrubb@redhat.com \
--cc=linux-audit@redhat.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.