0

I'd like to read the process metadata for a process that has already exited.

Say I ran a command some-bash-command and it exited. A few hours later, in another shell, I'd like to get the metadata for this process, given I have its PID.

I'd like to be able to inspect:

  1. The start time
  2. The user who started it
  3. When it exited, and thereby the total runtime
  4. The folder it was executed in? (This isn't fully necessary).

If possible, could someone point me to resources where I can learn more about this? I'd like to solve this by using built-in commands, or by reading directly from "somewhere" (I'm not sure where? /proc?)

I see that an exited process isn't listed in /proc/$PID, so is there no possibility of getting that processes metadata?

Improve this question
1
  • 1
    You really want the system to store information on every process for a few hours ? I just opened a new tab in Firefox, and it ran over a hundred transient processes. IIRC, Linux runs threads as lightweight processes. Commented Aug 20, 2022 at 8:44

1 Answer 1

Reset to default
0

For this you need to activate beforehand audit daemon and set what should be logged.

Post factum you can see nothing about past processes.

Improve this answer
1
  • 1
    Technically, you can get some metadata from processes that have exited until their parent has acknowledged their death (while they're still in the zombie stage). But shells always acknowledge the death of their children as soon as they die as long as they themselves are still running. If they're gone the death will be acknowledged by init (or the child subreaper). If the shell is suspended, you'll be able to inspect some of the processes metadata in /proc/<pid> or from ps Commented Aug 20, 2022 at 8:46

You must log in to answer this question.

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.