6

When my Ubuntu server starts up, I see a message that says: kernel: [11.895392] init: failsafe main process (631) killed by TERM signal. I would like to know what process this is but I'm not sure where to look. When I search through my syslog and kernel.log, I don't see any evidence of processes starting and being given an identifier (PID).

I'd like to investigate my boot message (failsafe main process killed...) but first, I need to answer the question: When a process starts, where is that logged and does the PID that is assigned to it get logged as well?

I understand that a process will write a PID file to reference later as necessary, but once the process is killed, can I find out what PID it used to have?

Renan
  • 16,976
  • 8
  • 69
  • 88
harperville
  • 435
  • 3
  • 7
  • 18

2 Answers2

5

First of all your message already contains the program name: 

kernel: [11.895392] init: failsafe main process (631) killed by TERM signal

This means that the program failsafe with the pid 631 received a TERM signal.

To answer your original question, no most Linux Distributions don't log the pids of created processes per default but you can use the audit framework and create the necessary rules to log all created processes. https://www.wzdftpd.net/docs/selinux/audit.html provides an introduction into these rules and should help you get started.

Ulrich Dangel
  • 25,079
  • 3
  • 80
  • 80
1

You could log newly executed commands/processes using Snoopy.

If you need simple logger and you are NOT looking for security/auditing solution, then Snoopy might be it.

Disclosure: Snoopy maintainer here.

Community
  • 1
Bostjan Skufca Jese
  • 81
  • 1
  • 1