# min hr day month day_of_week
# every minute run :
1 * * * * /root/watch_processes.sh
one time do manually:
create simple script
# %cpu pid command args
ps -eo "%C %P %U %c %a" > /root/process_watch/`date +%Y%m%d_%H%M`
The above will create a text file, every minute, having only the date as the filename but they will all be under the given folder which in the example above is
/mkdir/process_watch. Adjust accordingly.
tweak the output as needed of
ps -eo for every process, using
%C %P %U %c %a will result in these 5 columns of data
- cpu %
- process id
- user name
- command running
- arguments given to command running
In each file you will get a lot of listing with 0.0 in the first column. Someone good with
sed can maybe add syntax to the above to filter out the 0% cpu processes.
like was said you have to catch the process when it happens, once the process finishes there is no record of pid# having taken %cpu when. You will have to do a process watch like this then go back and find the offenders.