BeeOnRope
BeeOnRope

Reputation: 64895

Find a mystery process which is killing my process

Let's say I have some process - in this case a Java process, launched by ant. I find that randomly something is sending this Java process SIGTERM. It could be the process sending that signal to itself, or it could be something else.

I have eliminated most of the obvious causes (oom killer, parent process killing child, etc), but I really want to find out who is sending this process SIGTERM. Any way to trace this behavior at the OS or process level?

Upvotes: 4

Views: 1524

Answers (3)

jlliagre
jlliagre

Reputation: 30813

If you have dtrace available (Solaris, OS X, FreeBSD), this simple Dtrace script would easily detect the mystery process:

#!/usr/sbin/dtrace -qCs

#include <signal.h>

proc:::signal-send
/ args[2] == SIGTERM && args[1]->pr_fname == "java" /
{
    printf("Process %d (%s) run by uid %d is sending SIGTERM to java (pid %d)\n",
            pid, execname, uid, args[1]->pr_pid);
}

Upvotes: 1

holgero
holgero

Reputation: 2730

You can install a signal handler in your java program via JNI, see interface java with C timer library using JNI for an example of that (catches SIGALRM, but should be easily adaptable). Beware of some problems when messing with signals in java, though (see http://nerds-central.blogspot.de/2011/04/java-jvm-jni-and-signal-handling.html ): Basically you need to take care to chain your signal handlers to the existing and not to replace them.

If you suspect human interaction another approach might be to modify the kill executable on the machine where this mystery happens. Replace it with a shell script that logs who is logged in, its PID and parent PID and then calls the original kill.

I put something together that works on my PC: https://gist.github.com/4183018

Upvotes: 2

Mark Bramnik
Mark Bramnik

Reputation: 42441

are you sure you're getting SIGTERM signal? Have you tried to use linux strace command and see what signal do you have. I'm not sure it will show you a pid of the process that sent the signal though.

Upvotes: 0

Related Questions