0

How to get this list (table)? From turn on the computer until now. Don't miss any [PID] (still running [PID], already ended [PID]).

List field: PPID, PID, Threads, USER, Start-time, Change-time, End-time, full-Command

Among:

  • [Start-time]: Start time of the process
  • [Change-time]: Process change time. When [PPID] or [full-command] changes
  • [End-time]: The end time of the process.
9
  • To get previous process information you will need to be running something to capture this information. Traditionally this is part of the sa (system accounting). However this will not tell you about the currently running processes. Why do you want this information? We might be able to suggest an alternative approach.
    – icarus
    Jul 19 '20 at 4:47
  • What's Threads? If it's the number of threads, note that the number of threads of a process goes up and down during the lifetime of a process. euid, ruid can also change. Jul 19 '20 at 6:40
  • What's the OS(es)? Note that computers can run more than one OS after they've been turned on. Presumably you want the list of processes handled by this kernel or maybe at least since init was started if you don't care about the processes started in an init ramdisk for instance. Jul 19 '20 at 6:44
  • What's full command? Is it contents of strings passed in the argv[] parameter to execve() system calls made by the process? Jul 19 '20 at 6:47
0

You're better off using something like auditd which will hook into each system call. The problem with using ps or in-fact anything that uses the proc filesystem is stuff can get missed, especially if that stuff (or it's user) actually wants to be missed and effectively invisible.

The proc filesystem is a point in time view of the processes. In fact, its a few points in time as processes with larger PIDs are scanned slightly later than ones with smaller PIDs.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.