How to find out who sent the 'signal-15'

https://access.redhat.com/solutions/360993

 SOLUTION 已验证 - 已更新 2017年七月19日09:14 - 

English 

环境

• Red Hat Enterprise Linux (RHEL) 7
• Red Hat Enterprise Linux (RHEL) 6
• Red Hat Enterprise Linux (RHEL) 5

问题

• System is getting rebooted automatically, some process is sending 'SIGTERM' signal.
• How do I find out who sent a 'SIGTERM/Signal-15'?

决议

The following systemtap script can find out who sent the Signal-15:

• Let's try the following:

Raw

#!/usr/bin/env stap

probe signal.send {
    if (pid_name == @1) {
        if (sig_name == "SIGTERM") {
            printf("%s(pid: %d) received a %s signal sent by %s(%d)\n", pid_name, sig_pid, sig_name, execname(), pid())
            exit()
        }
    }
}

• Example:

Raw

$ stap sigcheck.stp sshd
sshd(pid: 34469) received a SIGTERM signal sent by bash(31815)

• Please ensure the correct execname of the process is specified

• For more info about SystemTap script please refer to the documentation.