PID history of a process

Question

What I want to know is PIDs that were assigned to a process before its last 2-3 restart.

Scenario is after this particular process crashes, a log file is generated and PID of the process is concatenated to the name of log file. I have such 5 log files with name as hs_err_PIDs. I want to confirm whether these PIDs were assigned to the process I am concerned with, as I am little confused about it.

Is there a way I can do it?

Solution 1

You MAY find this information in the system log files /var/log/messages, /var/log/syslog. Some processes print messages to the system log when it starts. For example, squid prints the following:

May  8 00:00:00 proxy squid[7274]: Squid Parent: child process 28819 started

If your process logs such information, you can know the old PIDs like 7274.

Another possibility is the case when your process causes an error like segfault when it died. You will find a log like this:

May  8 00:00:00 proxy kernel: [1075746.767514] squid[24442]: segfault at 20 ip 00000000005bae26 sp 00007fff144918e0 error 4 in squid[400000+264000]

You can also find the PID in such a log record 24442.

For future cases, you need to log such information if you are interested in finding it later.

Solution 2

Unless the application writes it's PID to a log file then you can't get this information retrospectively. Going forward you could write a wrapper script to start your application and log the PIDs to a file or you could enable accounting.

A simple wrapper might be

yourcommand &
echo $! >>/path/to/pid_history.log

Solution 3

If there is no log entry somewhere of this (made either by the program itself or it's start script), there is no way to get this info, as there is no standard logging of this info.

Comments

[stillStudent]

I also doubted that I will get it. Thanks for clearing the doubt!

[stillStudent]

These files are empty. And I think this logging is controlled at OS level so I am wondering why it didn't happen. I think there is something wrong with machine. I will dig more. Thanks for info!

[Khaled]

@stillStudent: For starting information (1st case), it is done by the running process. For the segfault (2nd case), it is done by the kernel.