Linux: Tool to monitor every process, execute-command, shortly, monitor what's happening at the moment

Question

Possible Duplicate:
How can I log all process launches in Linux

Hello,
due to a freeze problem of my Ubuntu 10.10 (it is not isolatable) I though about logging every executable of the kernel somehow in any file to see what happens last when a freeze occures the next time to not lose valuable information.
I found acct but this is obviously not what I'm looking for. Actually it logs just user commands and those things. I need something which logs in a much "deeper" level. The best would be some kind of script which records every interrupt. Does anybody know some tool like that?

i.e. start with http://superuser.com/questions/222912/how-can-i-log-all-process-launches-in-linux — Gilles 'SO- stop being evil', Dec 18 '10 at 00:32
Maybe you can get a [kernel core dump](http://askubuntu.com/q/3051/1059). See also [CrashdumpRecipe](https://wiki.ubuntu.com/Kernel/CrashdumpRecipe) and other [Ubuntu kernel debugging topics](https://wiki.ubuntu.com/Kernel/Debugging). — Gilles 'SO- stop being evil', Dec 18 '10 at 00:36
Thanks Gilles, this is what I'm looking for. Can you post is as answer, so I can check it answered. — Bevor, Dec 18 '10 at 09:32
You can try 'execsnoop' from perf-tools. https://github.com/brendangregg/perf-tools/blob/master/execsnoop — Changbin Du, May 22 '22 at 08:02

score 1 · Answer 1 · answered Dec 17 '10 at 21:21

1

You might try a 'ps' -aux that will list all processes running on the system at a point in time. You could put it into a shell script to iteratively run over time, probably with a sleep in between iterations. A 'top' runs continuously and lists the largest users of system resources. It also has flags that can tailor its output (man top or man ps)

Alan

answered Dec 17 '10 at 21:21

apolinsky

111
3

ps is not low level enough. AFAIK it is not possible to get kernel interrupts with it. I will get auditd a try. – Bevor Dec 18 '10 at 09:18

score 0 · Accepted Answer · edited Apr 13 '17 at 12:22

0

Gilles' comment was the solution:

Maybe you can get a kernel core dump. See also CrashdumpRecipe and other Ubuntu kernel debugging topics.

edited Apr 13 '17 at 12:22

Community

1

answered Jan 09 '11 at 19:35

Bevor

319
5
24

Linux: Tool to monitor every process, execute-command, shortly, monitor what's happening at the moment

2 Answers2