2

I am needing to do some debugging work, and as a part of that debugging work I need to know if there are any processes still running after a user session has logged out. And I need to specifically be able to also tell to which user those processes belong to. It would also be useful for me to be able to log the processes still active during as much of the shutdown process as possible.

I have already tried for instance to log which processes are still active after a certain user session logs out by having an admin account active at the same time as another account, so that while the other account is logging out the admin account will be logging the process activity with:

top > ~/top.txt

But there were two problems with that, firstly it would not allow for me to tell anything about the processes which are active during the shutdown process (well as much of it as I could log before the logging process gets terminated), and secondly the output into the text file was unreadable for me because most lines looked something like this:

top strange output

And although I can pick this apart and by looking at an actual example of top running in my CLI, I can tell what some bits are, but it's really hard to tell with what I have got to do, plus I don't know at which points what happened, I don't know if one of the outputs in the file is before the log out, or after, or some point during, and it is just really hard to read.

So I am wondering if there is a way to better achieve what I am trying to achieve? And if anybody could give me any suggestions on maybe how I could improve my methods, or suggest some new methods.

I was thinking about perhaps running a logging script as root automatically, but as well as it being a bit of a possible security risk, it would probably give me the same scrambled output as I got from top before. Please let me know if you need any more information.


OS Information:

Description:    Ubuntu 14.10
Release:    14.10
1
  • For scripting with top, use batch mode: top -b.
    – muru
    Apr 14, 2015 at 11:13

5 Answers 5

2

You're on the right track: I would also have one user watching the other. If top doesn't give you the output you want I would use ps aux in an infinite loop with a 1 second delay.

#!/bin/bash
# Example script for watching a logging off user
# This script is an answer to http://askubuntu.com/questions/608921/how-to-check-which-processes-are-still-active-after-a-user-session-has-logged-ou/608925#608925

# Copyright (c) 2015 Fabby

# This program is free software: you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation, either version 3 of the License, or (at your option) any later version.
# This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. See the GNU General Public License for more details.
# You DID NOT receive a copy of the GNU General Public License along with this program as the license is bigger then this program.

while true
do
  date   >> /tmp/watch-logoff.txt
  ps aux >> /tmp/watch-logoff.txt
  sleep 1
done

You'll come to the conclusion that no processes belonging to the logged-off user are running any more after they've logged off completely.

2
  • Is there anyway in which I could tell what the time is each time it logs the information so that I can better tell at what stage what is happening?
    – user364819
    Apr 14, 2015 at 10:15
  • Yes, off course! :)
    – Fabby
    Apr 14, 2015 at 10:31
2

This answer by Radu gives you a complete overview of how to execute particular script upon logout or shutdown.

What you can do is create the script like this

#!/bin/bash
ps -u username > /home/yourusername/outputfile.txt

Then sudo chmod +x scriptname and add line

session-cleanup-script=/path/to/script to /etc/lightdm/lightdm.conf

As for shutdown . . . I believe during shutdown runs /etc/rc6.d/S20sendsigs which sends kill signals to all the jobs, So you may want to run that script with file name S10_scriptname to start it before that sendsigs script(refer back to Radu's answer for more info)

Edit: as of 14.04, lightdm.conf isn't created by default, hence you may need to create this file in /etc/lightdm/lightdm.conf.d/ directory ,with the first line saying [Seat Defaults]

6
  • 1
    Apparently the /etc/lightdm/lightdm.conf does not exist in my system. The only file in fact that exists within the lightdm directory is users.conf, is that perhaps the file that I should edit, or do I need to create the lightdm.conf file, or...?
    – user364819
    Apr 14, 2015 at 10:21
  • 1
    @Toroidal that file is no longer present on 14.04+, if you create one with that path it will either be useless or may mess things up a bit. I believe we now create individual files in /etc/lightdm/lightdm.conf.d
    – mchid
    Apr 14, 2015 at 11:56
  • @mchid I'm running 14.04 , upgraded from 13.04. So that's a remnant from 13.04 , and not created in fresh install of 14.04 at all ? Apr 14, 2015 at 12:01
  • no sir. this created much of a headache for us users that were accustom to configuring this file. now there is the directory lightdm.conf.d where you will find individual files. you can create a file here to set options.
    – mchid
    Apr 14, 2015 at 12:57
  • @mchid Thank you for letting us know. I edited my answer to include this info Apr 14, 2015 at 13:01
1

Use the following to list all the processes of any particular user:

$ ps -fu "username"

For example:

$ ps -fu foobar

To save it in a file:

$ ps -fu foobar > ~/ps_foobar

Here is a one liner that can be used via cron or any other repitition mechanism:

[[ $(ps -u foobar | wc -l) -gt 1 ]] && echo "user foobar has process running" || echo "user foobar has no process running"

To check the logs while shutting down (as much as can be logged):

tail -f /var/log/syslog  ## Run it prior to shutdown

Or just read the file /var/log/syslog anytime, it contains the full time info so will be easy to understand.

1

You can run htop from one of the tty consoles so that you can log a user out of an xsession but still maintain an open terminal (htop is better than top and easier to read).

CTRL + ALT + F2 You can login a text session under a different username from there and then, use:

sudo htop

to start it up. Use F6 and then scroll up to USER using the arrow button and press Enter. This will filter the results by user to make it easier to read for these purposes.

To return to the xsession, press CTRL + ALT + F7 and CTRL + ALT + F2 to go back to tty2 again and so forth.

0

You could use the ~./bash_logout if it's for when users log off (note, bash shell, e.g ssh). But some other situations are also described in the article/answer below,

superuser.com: create-a-logoff-script-task-for-linux

@heemayl and others already describe some of the commands you can use to get the still running processes when the users logs off.

If you wanted only the running PIDs of the user you could also use below,

$ id -u username | xargs pgrep -U

You must log in to answer this question.