* monitor of SEGFAULT processes
@ 2017-03-16 6:23 Lev Olshvang
2017-03-16 14:55 ` Frank Ch. Eigler
0 siblings, 1 reply; 2+ messages in thread
From: Lev Olshvang @ 2017-03-16 6:23 UTC (permalink / raw)
To: kernelnewbies
Thank you Greg and others advising on my first question.
I am writing monitor sybsytem, abd here the question :
Is it possible from kernel module or user space to monitor which processes were terminated
abnormally ?
I understand that trap gates are initialized to handle it , fill trap_info, then sig_info and send signal to faulting process.
Is it correct to place a hook in these chain? probably in signal.c : next_signal()?
If so what is the proper method, ex jprobe?
ThanX
^ permalink raw reply [flat|nested] 2+ messages in thread
* monitor of SEGFAULT processes
2017-03-16 6:23 monitor of SEGFAULT processes Lev Olshvang
@ 2017-03-16 14:55 ` Frank Ch. Eigler
0 siblings, 0 replies; 2+ messages in thread
From: Frank Ch. Eigler @ 2017-03-16 14:55 UTC (permalink / raw)
To: kernelnewbies
levonshe wrote:
> [...] Is it possible from kernel module or user space to monitor
> which processes were terminated abnormally ? [...]
Depending on the version & configuration, there exist both kernel
tracepoints and kprobe/jprobe sites where the kernel side of these
events may be hooked. You may be able to attach to each of those from
userspace via perf.
For comparison, systemtap chooses whatever facility is available in your
kernel, by internally mapping the abstract "signal.send" name into a
list of candidates.
# stap -e '
probe signal.send {
if (sig_name == "SIGKILL")
printf("%s was sent to %s (pid:%d) by %s uid:%d\n",
sig_name, pid_name, sig_pid, execname(), uid())
}'
- FChE
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2017-03-16 14:55 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2017-03-16 6:23 monitor of SEGFAULT processes Lev Olshvang
2017-03-16 14:55 ` Frank Ch. Eigler
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.