Question on strace

Wed Jun 25 13:04:55 UTC 2008

Hi Satish,

On Wed, 25 Jun 2008 14:48:51 +0200, Satish Kumar Tedla wrote:
> <!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">

please send text/plain mails here.

> I have an issue where my process is getting killed due to a SIGTERM issued by
> an unknown process.  Is there a way to trace the process which is sending
> SIGTERM to my process?

You cannot use strace globally on all the processes - I would use systemtap for
this purpose.  Attached a script for it - it traces all the kill(2)s on the
system.  There may be some better one supplied in the systemtap examples.

# stap /tmp/kill.stp 
START
...
bash (4599): kill (24688, sig 15) = 0

Regards,
Jan
-------------- next part --------------
probe begin
{
	print ("START\n")
}

global kill_enter
probe kernel.function("sys_kill")
{
	kill_enter = sprintf ("%s (%d): kill (%d, sig %d)", execname (), pid (), $pid, $sig);
}
probe kernel.function("sys_kill").return
{
	if (kill_enter != "")
		printf ("%s = %s\n", kill_enter, returnstr (1))
}

global tkill_enter
probe kernel.function("sys_tkill")
{
	tkill_enter = sprintf ("%s (%d): tkill (%d, sig %d)", execname (), pid (), $pid, $sig);
}
probe kernel.function("sys_tkill").return
{
	if (tkill_enter != "")
		printf ("%s = %s\n", tkill_enter, returnstr (1))
}

global tgkill_enter
probe kernel.function("sys_tgkill")
{
	tgkill_enter = sprintf ("%s (%d): tgkill (tgid %d, tid %d, sig %d)", execname (), pid (), $tgid, $pid, $sig);
}
probe kernel.function("sys_tgkill").return
{
	if (tgkill_enter != "")
		printf ("%s = %s\n", tgkill_enter, returnstr (1))
}