On Fri, 7 Sep 2007, Dr. David Alan Gilbert wrote: > * David Stevens (dlstevens@xxxxxxxxxx) wrote: > > A program called "lsof". > > lsof wouldn't help me after the processes have exited and just left the > ports in timewait would it? In these cases I was seeing a storm of > port creation by what turned out to be processes that ran for a > fraction of a second. I don't think lsof would have helped me there. The only thing I can think of that might hive helped is use of BSD process accounting. You need to have CONFIG_BSD_PROCESS_ACCT enabled in your kernel config, have the psacct package installed, enable process accounting using the accton command, and then you can use commands like lastcomm or sa to get information about previously executed commands. I don't know if it records info on sockets used (don't think so), but it still might have provided some useful clues as to what was happening. -Bill - To unsubscribe from this list: send the line "unsubscribe linux-net" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
