From mboxrd@z Thu Jan  1 00:00:00 1970
From: fche@redhat.com (Frank Ch. Eigler)
Date: Thu, 16 Mar 2017 10:55:26 -0400
Subject: monitor of SEGFAULT processes
In-Reply-To: <1351991489645397@web55g.yandex.ru> (Lev Olshvang's message of
	"Thu, 16 Mar 2017 09:23:17 +0300")
References: <1351991489645397@web55g.yandex.ru>
Message-ID: <y0m1stxp8yp.fsf@fche.csb>
To: kernelnewbies@lists.kernelnewbies.org
List-Id: kernelnewbies.lists.kernelnewbies.org


levonshe wrote:

> [...]  Is it possible from kernel module or user space to monitor
> which processes were terminated abnormally ?  [...]

Depending on the version & configuration, there exist both kernel
tracepoints and kprobe/jprobe sites where the kernel side of these
events may be hooked.  You may be able to attach to each of those from
userspace via perf.

For comparison, systemtap chooses whatever facility is available in your
kernel, by internally mapping the abstract "signal.send" name into a
list of candidates.

# stap -e '
probe signal.send {
  if (sig_name == "SIGKILL")
    printf("%s was sent to %s (pid:%d) by %s uid:%d\n",
           sig_name, pid_name, sig_pid, execname(), uid())
}'


- FChE