On Thu, 23 Nov 2006 21:45:36 -0700 "Kelly Jones" <kelly.terry.jones@xxxxxxxxx> wrote: > If a process runs for a long time, I can use "ps -aux -www" to see > info about it, and even look at /proc/pid/* > > But sometimes a process starts, runs, and ends before I can see it > with "ps -aux -www" or can look at /proc/pid/* > > Is there a way to log processes? A daemon or kernel module that > creates syslog entries like this: > > Nov 23 16:57:38 machine processd[6052]: Process 1234 started, > command=foo, arg1=bar, arg2=blah > > Nov 23 16:57:38 machine processd[6052]: Process 1234 opened file > "/tmp/foobar.txt", file descriptor 3 > > Nov 23 16:57:39 machine processd[6052]: Process 1234 ended > > Obviously this would be something that could turned on/off (would > really clutter the logs otherwise). > > I know about strace, but that only works well for processes I start > from the command-line. If you're still looking for info on this, you might be interested in the GNU system accounting utilities. I've not really used them myself, but I think they do pretty close to what you want. More info at <http://directory.fsf.org/acct.html> and <http://savannah.gnu.org/projects/acct/> Good luck, Conway S. Smith
Attachment:
signature.asc
Description: PGP signature
