I know that a certain process is restarting my web server at a certain time (probably in a cron job? It doesn't happen every day, though) but I don't know which process, only it's id (from looking at the webserver logs. I've checked a couple of the logs for the pid). Is there a way to find the process name/batch file of a process that has been gone for a while (few hours), given only the pid?
Asked
Active
Viewed 362 times
1
-
Just for posterity, I think I fixed the issue by moving my web app from fastcgi to mongrel. – thenoviceoof Oct 28 '09 at 06:25
2 Answers
3
Turn on BSD process accounting (acct in Debian/Ubuntu, psacct in the RHEL-like distros I've used) and then just look through the resulting logs (using lastcomm) for the process you're interested in.
womble
- 95,029
- 29
- 173
- 228
0
Unless you explicitly log any new process, its name and its PID or have (by coincidence) an entry by this process in your system logs (which usually mention PID and the program's name), I think there is no way of finding out which program had a certain PID in the past.
Since you mentioned lighttpd there are several possibilites, three of which are:
- logrotate (because after rotating the log files, lighttpd has to reopen the file descriptors)
- lighttpd-angel
- monit, god, Nagios, Zabbix, or any monitoring software which restarts your web server process, when it runs too long or uses too much memory.
joschi
- 20,747
- 3
- 46
- 50
-
1+1 It's probably logrotate, which is configured by default for lighttpd in Ubuntu. OP doesn't specify distribution, though. – Kyle Smith Oct 18 '09 at 20:38