Linux – How to know which user killed a process

killlinuxloggingprocessusers

Is there a way in linux to find out which user or which process killed another process? Maybe a log?

I searched through /var/log and specifically on auth.log.* but I didn't find anything interesting..

I suppose that the process was killed using htop but as far as I know it doesn't keep activities logs.

Thanks

Best Answer

Without some form of auditing enabled, it's not possible to find out as far as I know.

There are some useful docs on Audit Control here (other distros will also find this useful): http://doc.opensuse.org/products/draft/SLES/SLES-security_sd_draft/cha.audit.comp.html

Specifically (untested):

auditctl -a exit,always -S all

Should have the desired effect providing the audit system is set up correctly.

Christian.

Related Solutions

Linux Bash – How to Sort du -h Output by Size

As of GNU coreutils 7.5 released in August 2009, sort allows a -h parameter, which allows numeric suffixes of the kind produced by du -h:

du -hs * | sort -h

If you are using a sort that does not support -h, you can install GNU Coreutils. E.g. on an older Mac OS X:

brew install coreutils
du -hs * | gsort -h

From sort manual:

-h, --human-numeric-sort compare human readable numbers (e.g., 2K 1G)

SCP – How to Move Files with SCP?

rsync over ssh is probably your best bet with the --remove-source-files option

rsync -avz --remove-source-files -e ssh /this/dir remoteuser@remotehost:/remote/dir

a quick test gives;

[tomh@workstation001 ~]$ mkdir test1
[tomh@workstation001 ~]$ mkdir test2
[tomh@workstation001 ~]$ touch test1/testfile.1
[tomh@workstation001 ~]$ ls test1/
testfile.1
[tomh@workstation001 ~]$ rsync --remove-source-files -av -e ssh test1/testfile.1 tomh@localhost:/home/tomh/test2/
sending incremental file list

sent 58 bytes  received 12 bytes  10.77 bytes/sec
total size is 0  speedup is 0.00

[tomh@workstation001 ~]$ ls test1/
[tomh@workstation001 ~]$
[tomh@workstation001 ~]$ ls test2/
testfile.1

As @SvenW mentioned, -e ssh is the default so can be omitted.

Best Answer

Related Solutions

Linux Bash – How to Sort du -h Output by Size

SCP – How to Move Files with SCP?

Related Topic