Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I know that a certain process is restarting my web server at a certain time (probably in a cron job? It doesn't happen every day, though) but I don't know which process, only it's id (from looking at the webserver logs. I've checked a couple of the logs for the pid). Is there a way to find the process name/batch file of a process that has been gone for a while (few hours), given only the pid?

share|improve this question
    
Just for posterity, I think I fixed the issue by moving my web app from fastcgi to mongrel. –  thenoviceoof Oct 28 '09 at 6:25

2 Answers 2

up vote 1 down vote accepted

Turn on BSD process accounting (acct in Debian/Ubuntu, psacct in the RHEL-like distros I've used) and then just look through the resulting logs (using lastcomm) for the process you're interested in.

share|improve this answer

Unless you explicitly log any new process, its name and its PID or have (by coincidence) an entry by this process in your system logs (which usually mention PID and the program's name), I think there is no way of finding out which program had a certain PID in the past.

Since you mentioned lighttpd there are several possibilites, three of which are:

  • logrotate (because after rotating the log files, lighttpd has to reopen the file descriptors)
  • lighttpd-angel
  • monit, god, Nagios, Zabbix, or any monitoring software which restarts your web server process, when it runs too long or uses too much memory.
share|improve this answer
1  
+1 It's probably logrotate, which is configured by default for lighttpd in Ubuntu. OP doesn't specify distribution, though. –  Kyle Smith Oct 18 '09 at 20:38

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.