Linux – How to know if the Linux server killed the process and which process it killed

killkill-processlinuxprocess

It seems my server killed a process due to it using too much RAM. Is this possible? If it can happen, how can I know when and what process it killed?

It's quite possibly OOM killer, killed your process. You may be able to find out what when etc by looking in the logs.

egrep -i 'killed process' /var/log/messages

The actual log file varies by distribution so it could also be /var/log/syslog or even

egrep -i -r 'killed process' /var/log

cat /proc/<pid>/environ

If you want to have pid(s) of a given running executable you can, among a number of other possibilities, use pidof:

AlberT$ pidof sshd   
30690 6512

EDIT:

I totally quote Dennis Williamson and Teddy comments to achieve a more readable output. My solution is the following:

tr '\0' '\n' < /proc/<pid>/environ

If you want only the start time, you can select the field and suppress the header by doing this:

 ps -p YOURPID -o lstart=

the output will look like this:

 Mon Dec 14 17:17:16 2009

which is ctime(3) format and you can parse it to split out the relevant parts.

Other start fields such as start, stime, bsdstart and start_time age the time (after 24 hours only the date is shown, for example).

You can, however, use them directly for recently started processes without further parsing:

ps -p YOURPID -o stime=

which would output something like:

09:26