2 Replies Latest reply: Jun 5, 2014 10:47 AM by user10137826 RSS

    Which user is executing a [very short lived] process?

    user10137826

      Solaris 10

       

      We have emits like:

      genunix: [ID 184622 kern.warning] basic rctl process.max-file-descriptor (value 256) exceeded by process 19975.

      in /var/adm/messages (various process ids).

       

      We'd like to know which user(s) and command(s) are associated with this/these process(es) (such that we can make a determination as to whether we should give it a higher value).

       

      It appears that the processes are very short lived - by the time we look for it, it's gone/completed execution.

      We created a script which gets the PID from /var/adm/messages and, using ps, we can get the process owner.

      We see that it's root executing sshd, however, we know that is just the spawning of the shell on behalf of another user.

      Using ptree, we can see the commands (scripts) which are spawned, but can see the executing user.

       

      What we'd really like is to have ptree show the executing user, but (from man) I don't think that's possible.

       

      Any ideas?

       

      TIA,

      Rich