How can I check why a process was stopped / killed in Ubuntu?

I know using dmesg I can check if a process is killed by OS.

But can some one let me know if the process is killed by a user, how can I know which user killed the process?

  • Aside from OOM errors, there's no reason why any process being killed by the OS would logged, unless the process itself does logging. – muru Oct 25 '17 at 10:16
  • Is there any tool I can use that will monitor a process and let me know when it was killed, how & by whom? – tuk Oct 25 '17 at 10:19
  • You could catch the usual signals and handle them different within the process. E.g. writing your own isKilled function where you can log what exactly was the signal and where it came from.. – derHugo Oct 25 '17 at 12:22
  • I am not the author of the program. I am looking for some monitoring tool. – tuk Oct 25 '17 at 12:45
  • 4
    Possible duplicate of How to find out why process was killed on server – Elder Geek Oct 28 '17 at 20:56

The only solution to your question that I can think of (assuming that you know the details of the process) would be to parse the history file of those users that would have the permissions necessary to terminate the process in question for a command that would terminate it.

This would of course require that you have permission to access the users in question .bash_history file. And would also require that the user in question was oblivious as to how to or didn't bother to turn off their own history.

I consider the odds of both of these conditions being met highly unlikely, so perhaps this comment is more accurate in the real world.

However, regardless of the likelihood of both these conditions being met, it is possible.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.