Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

When my Ubuntu server starts up, I see a message that says: kernel: [11.895392] init: failsafe main process (631) killed by TERM signal. I would like to know what process this is but I'm not sure where to look. When I search through my syslog and kernel.log, I don't see any evidence of processes starting and being given an identifier (PID).

I'd like to investigate my boot message (failsafe main process killed...) but first, I need to answer the question: When a process starts, where is that logged and does the PID that is assigned to it get logged as well?

I understand that a process will write a PID file to reference later as necessary, but once the process is killed, can I find out what PID it used to have?

share|improve this question
No, started processes are not logged. There are too many. – Janus Troelsen Jul 28 '12 at 23:26
You can't find the PID of killed processes. – Janus Troelsen Jul 28 '12 at 23:27
Only some processes have .pid files in /var/run. – Janus Troelsen Jul 28 '12 at 23:27
Only daemons will have the PID files (because they need it). – Renan Jul 28 '12 at 23:52
up vote 4 down vote accepted

First of all your message already contains the program name:

kernel: [11.895392] init: failsafe main process (631) killed by TERM signal

This means that the program failsafe with the pid 631 received a TERM signal.

To answer your original question, no most Linux Distributions don't log the pids of created processes per default but you can use the audit framework and create the necessary rules to log all created processes. https://www.wzdftpd.net/docs/selinux/audit.html provides an introduction into these rules and should help you get started.

share|improve this answer
Thanks for such a complete response! – harperville Jul 29 '12 at 0:57

You could log newly executed commands/processes using Snoopy.

If you need simple logger and you are NOT looking for security/auditing solution, then Snoopy might be it.

Disclosure: Snoopy maintainer here.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.