I have a daemon process (slapd) which sometimes stops with no apparent reason. No segfault occurs. Nothing special in the logs.

So, I'm trying to use acct to track the process' life, especially its exit value. The man says that the kernel does log this value. Surprisingly, my dump-acct does not show this information...

I had to change the source by adding this line in the print_pacct_record() function:

(void)fprintf(out, "%4u|", rec->ac_exitcode >> 8);

EDIT: this change has been recently added mainstream.

However, I feel this won't be enough to discover what the problem is.

Is there better ways to track how the program exits? A stack trace, for example, would be interesting. The "last seconds trace" would be even better.

I thought of strace or ltrace but the program can run for days before it "stops itself". I fear "tracing" will impact performance. I don't know if gdb could help.

  • 1
    You could attach to it with gdb, give gdb the break exit and break _exit commands, continue the program, and wait. You ought to be able to get a stack trace of the functions that called exit. Or if it dies because of a signal. Of course, if it exits because main returns, it won't be that interesting. – Mark Plotnick Mar 16 '15 at 19:41

What about if you use strace and redirect the output of it to a file using the -o option?

[root@host ~]# strace -o /root/slapd_strace.log slapd --parameters --you --want


Try running strace under either screen or tmux. Once it's running you can disconnect, and only reconnect when required. screen keeps a scroll buffer (as might tmux) so you don't even need to worry about important clues scrolling off the top of the page.

screen -h 1000
strace ...
# disconnect with Ctrl-a d


screen -r
  • 1
    You'll probably want to increase the size of the scroll-back buffer, as the default is 100 lines. Use the -h NUM arg to set it at start. See here and here – Steve Wills Mar 16 '15 at 20:33
  • 1
    Or use strace -fp PID 2>&1 | tail -n 200 > strace.log, but I wonder "stracing" has a significant impact on performance. – Totor Mar 17 '15 at 13:54
  • 1
    @Totor I think that If I were going to use screen at all I would prefer strace -fp PID 2>&1 | tee strace.log so that I could see in real-ish time what was going on – roaima Mar 17 '15 at 14:58
  • @SteveWills thank you for that suggestion. Now added to the Answer – roaima Mar 17 '15 at 15:00

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.