1 Star2 Stars3 Stars4 Stars5 Stars (还没有评分)
Loading...

使用DTrace检测进程间发送信号

下面这个DTrace脚本可以记录哪些程序kill掉了其它进程:

#!/usr/sbin/dtrace -qs
proc:::signal-send
/ (args[2] == SIGKILL) /
{
    printf("[%s - %d - %d] sent SIGKILL to pid %d\n",
    execname, pid, tid, args[1]->pr_pid);
}

你也可以把SIGKILL换成其它感兴趣的信号。如果在FreeBSD上运行,需要把args[1]->pr_pid换成args[1]->p_pid。运行结果如下:

# ./sigkill.d
[bash - 24693 - 100121] sent SIGKILL to pid 24839
[bash - 24693 - 100121] sent SIGKILL to pid 24841

参考资料:
DTRACE: KILL() [WHO KILLED MY PROCESS?]

Leave a Reply

Your email address will not be published. Required fields are marked *