From: Natan Yellin <aantny@gmail.com>
To: linux-audit@redhat.com
Subject: Identifying thread/process termination
Date: Mon, 5 Oct 2020 22:07:12 +0300 [thread overview]
Message-ID: <CAPErmPdDACGemKqTrUk4xKNBwnoj6FEeWbsvmk7jS0TjOyaOqg@mail.gmail.com> (raw)
[-- Attachment #1.1: Type: text/plain, Size: 644 bytes --]
Hello,
I've been tracking all process terminations using a rule for the exit and
exit_group syscalls. However, by looking at the audit events for exit it is
impossible to differentiate between the death of different threads in the
same thread group. Is there an alternative way to track this?
For my use case, I would like to know when either processes or individual
threads execute and terminate. (I'm fine tracking at either granularity.)
Right now I can track the creation properly using fork/clone/etc but for
termination I receive multiple exit events with identical information that
doesn't let me know which thread died.
Thanks,
Natan
[-- Attachment #1.2: Type: text/html, Size: 746 bytes --]
[-- Attachment #2: Type: text/plain, Size: 102 bytes --]
--
Linux-audit mailing list
Linux-audit@redhat.com
https://www.redhat.com/mailman/listinfo/linux-audit
next reply other threads:[~2020-10-05 19:09 UTC|newest]
Thread overview: 13+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-10-05 19:07 Natan Yellin [this message]
2020-10-06 20:20 ` Identifying thread/process termination Steve Grubb
2020-10-08 1:27 ` Paul Moore
2020-10-08 7:59 ` Natan Yellin
2020-10-09 1:12 ` Paul Moore
2020-10-08 12:49 ` Richard Guy Briggs
2020-10-08 15:33 ` Lenny Bruzenak
2020-11-16 6:41 ` L. A. Walsh
2020-11-16 13:43 ` Paul Moore
2020-11-17 15:22 ` L A Walsh
2020-11-20 19:43 L. A. Walsh
2020-11-24 15:43 ` Lenny Bruzenak
2020-11-20 19:45 L. A. Walsh
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=CAPErmPdDACGemKqTrUk4xKNBwnoj6FEeWbsvmk7jS0TjOyaOqg@mail.gmail.com \
--to=aantny@gmail.com \
--cc=linux-audit@redhat.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).