Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S261910AbVBAJEY (ORCPT ); Tue, 1 Feb 2005 04:04:24 -0500 Received: (majordomo@vger.kernel.org) by vger.kernel.org id S261868AbVBAI4Y (ORCPT ); Tue, 1 Feb 2005 03:56:24 -0500 Received: from hermine.aitel.hist.no ([158.38.50.15]:50181 "HELO hermine.aitel.hist.no") by vger.kernel.org with SMTP id S261895AbVBAIyh (ORCPT ); Tue, 1 Feb 2005 03:54:37 -0500 Message-ID: <41FF45DA.80404@hist.no> Date: Tue, 01 Feb 2005 10:03:22 +0100 From: Helge Hafting User-Agent: Mozilla Thunderbird 0.9 (X11/20041124) X-Accept-Language: en-us, en MIME-Version: 1.0 To: Tim Schmielau CC: Michael Buesch , lkml Subject: Re: [RFC] "biological parent" pid References: <200501312309.57464.mbuesch@freenet.de> In-Reply-To: Content-Type: text/plain; charset=UTF-8; format=flowed Content-Transfer-Encoding: 7bit Sender: linux-kernel-owner@vger.kernel.org X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 879 Lines: 22 Tim Schmielau wrote: > >I'm trying to reconstruct the complete history of processes from the >BSD accounting records. However, this is not very useful if a large >fraction of the processes look as if they were started by init. > >The following program will print the history in a form vaguely resembling >pstree output from the accounting file: > > Just having those original ppids won't really help you, if the process is long gone with no trace of what it was. Consider adding logging to "fork()" and "exec()" instead of doing this. Then you can reconstruct history all the way back to the correct executables. Helge Hafting - To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/