Is there an existing tool for solaris/unix that keeps a history trail of the list of running processes. I'd like to be able to review backwards in time what processes were active/running.

I can create a cron job that just regularly logs the output of ps into files, but this is crude and over a large server farm seems inefficient and can create many files.

And I need full command arguments so it has to be /usr/ucb/ps auxww output, ideally with cpu times, state, rss, pid, ppid, zone information.

Also, if possible the output should be easy to parse--e.g. in a consistent delimited format or some other.


Use auditing.

Solaris Auditing (Overview)

Auditing generates audit records when specified events occur. Most commonly, events that generate audit records include the following:

  • System startup and system shutdown
  • Login and logout
  • Process creation or process destruction, or thread creation or thread destruction
  • Opening, closing, creating, destroying, or renaming of objects
  • Use of privilege capabilities or role-based access control (RBAC)
  • Identification actions and authentication actions
  • Permission changes by a process or user
  • Administrative actions, such as installing a package
  • Site-specific applications

Audit records are generated from three sources:

  • By an application
  • As a result of an asynchronous audit event
  • As a result of a process system call

A good blog article on Solaris auditing can be found here.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.