Application disappearing..

[Michael Mittelstadt]

[Quoth FRamsay at castelhq.com]
] I've got a really strange situation, we have had an application that stopped
] running, it either crashed or the PID's were killed.
] Is there any way (from an admin perspecitve) I can tell when processes were
] killed?

If you have BSD Process Accounting turned on, then you can run
'lastcomm', and that will at least show if a process was terminated
with a SIGTERM (ie, it was killed).

# xlogo &
[2] 9919
# kill 9919
[2]  - 9919 terminated  xlogo
# lastcomm | grep X
xlogo                 X root     stdin      0.03 secs Wed Dec 18 17:15

the 'X' means that it was terminated with a SIGTERM.

-- 
Michael Mittelstadt
Sudbury, MA