Is there an existing tool for solaris/unix that keeps a history trail of the list of running processes. I'd like to be able to review backwards in time what processes were active/running.

I can create a cron job that just regularly logs the output of ps into files, but this is crude and over a large server farm seems inefficient and can create many files.

And I need full command arguments so it has to be /usr/ucb/ps auxww output, ideally with cpu times, state, rss, pid, ppid, zone information.

Also, if possible the output should be easy to parse--e.g. in a consistent delimited format or some other.

1 Answer 1


Use auditing.

Solaris Auditing (Overview)

Auditing generates audit records when specified events occur. Most commonly, events that generate audit records include the following:

  • System startup and system shutdown
  • Login and logout
  • Process creation or process destruction, or thread creation or thread destruction
  • Opening, closing, creating, destroying, or renaming of objects
  • Use of privilege capabilities or role-based access control (RBAC)
  • Identification actions and authentication actions
  • Permission changes by a process or user
  • Administrative actions, such as installing a package
  • Site-specific applications

Audit records are generated from three sources:

  • By an application
  • As a result of an asynchronous audit event
  • As a result of a process system call

A good blog article on Solaris auditing can be found here.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .